WPC Accountants Privacy Policy
How WPC Accountants Ltd uses personal data and cookies
Version 1.0 | Effective date: 3 November 2026
WPC Accountants Ltd | Company number 15741398
1. Who we are
1.1WPC Accountants Ltd is a company registered in England and Wales with company number 15741398, whose registered office is at 3rd Floor, 112-116 Whitechapel Road, London E1 1JE. In this policy “WPC Accountants”, “we”, “us” and “our” mean WPC Accountants Ltd.
1.2We provide accountancy and related services in the UK, including bookkeeping, accounts, tax returns, VAT, payroll, CIS, registrations (including charity registration), Universal Credit support and consultancy.
1.3We are the controller of the personal data described in this policy, except where section 3 says that we act only on a client’s instructions. We decide how and why your personal data is used. Our contact for data protection is support@wpcaccountants.co.uk (telephone 07838 125511), or you can write to us at the address above.
1.4We are registered with the Information Commission (formerly the Information Commissioner’s Office, ICO), registration number ZB822304.
1.5Our anti-money-laundering supervisor is the Association of Accounting Technicians (AAT), licence number 1008840.
1.6We are part of the WPC Group, a trading style for a family of separate companies under common ownership. Each company is its own controller. Using WPC Accountants does not by itself share your data with, or create a client relationship with, any other WPC Group company (see section 8).
2. Who this policy covers
- Website visitors to www.wpcaccountants.co.uk, and anyone who uses our Free Tools.
- Enquirers: people who contact us or book a free consultation.
- Clients: individuals and the people behind businesses that use, or are thinking of using, our services.
- People connected to a client: a director, partner, shareholder, employee, trustee or other individual whose details we handle for a client.
- Social media and advert audiences: people who follow or interact with us on social media or respond to our adverts.
We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). Where you engage us for services, our engagement letter and terms of business also apply. If you deal directly with another WPC Group company, that company’s own privacy notice applies to its services.
3. If you are connected to one of our clients
3.1For some services, such as running a client’s payroll, the client decides how your details are used and we process them only on its instructions, as its processor, under our engagement letter and terms of business. The client’s own privacy notice explains how it uses your information.
3.2If you ask us about information we hold on a client’s behalf, we pass your request to the client and help them answer it, and we tell you we have done so.
3.3For other work, such as identity and anti-money-laundering checks on the people connected to a client, we decide how the data is used and we are the controller. This policy explains that use.
4. What we collect
| Type | Examples | Where it comes from |
|---|---|---|
| Identity | Name, title, date of birth, nationality, photo ID (passport, driving licence), proof of address | You; your client, if you are connected to one; identity verification providers |
| Contact | Email address, phone number, postal address | You; your client |
| Tax and government identifiers | National Insurance number, Unique Taxpayer Reference (UTR), VAT number, PAYE and Accounts Office references, Companies House authentication code, Government Gateway details you choose to share | You; your client; HMRC, where we act as your authorised agent |
| Financial | Bank statements, income and expenses, invoices, receipts, rental and capital gains information, pension and benefits information, loan details | You; your client |
| Business | Company or partnership details, shareholders and directors, payroll records, CIS records, charity trustee details | You; your client; Companies House; the Charity Commission |
| Employee data (from clients) | Your employees’ names, NI numbers, salaries, tax codes and pension details and, for sponsor licence holders, information needed to keep payroll in line with sponsor duties | Our clients, about their own employees |
| Anti-money-laundering (AML) | Results of identity and verification checks, source of funds and source of wealth information, sanctions and politically exposed person (PEP) screening results | You; your client; verification, AML screening and credit reference providers; sanctions lists; the electoral roll |
| Communications | Emails, call notes, messages and consultation notes | You and our staff |
| Payment | Billing details and payment history. Card payments are handled by our payment provider; we do not store full card numbers | You and our payment provider |
| Website and device | IP address, browser and device type, pages viewed, clicks, scrolls, referring site, approximate location, cookie identifiers (see section 7) | Your device, through cookies and similar technologies; advertising platforms, when you respond to our adverts |
| Marketing | Your marketing preferences, and how you respond to our emails, messages, calls and adverts | You; your responses to our marketing |
4.1Special category and criminal offence data. Some services, such as Universal Credit applications, may involve information about health, disability or family circumstances. AML checks may reveal information about criminal offences. We collect this only when it is needed for the service or required by law, and we apply extra safeguards (see section 5).
4.2If you ask to be referred to us by another WPC Group company, that company passes us your details. We do not otherwise receive your data from other WPC Group companies.
4.3If you give us personal data about someone else, such as a spouse, director or employee, please make sure they know you are sharing it and point them to this policy.
5. Why we use it
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Responding to enquiries and booking consultations | Legitimate interests (answering people who contact us); steps before entering a contract |
| Delivering our services: bookkeeping, accounts, tax returns, VAT, payroll, CIS, registrations, Universal Credit support, charity registration and consultancy | Performance of a contract |
| Filing with HMRC, Companies House and other authorities on your behalf | Performance of a contract; legal obligation |
| Identity checks, AML due diligence and ongoing monitoring | Legal obligation (Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017) |
| Reporting suspicious activity to the National Crime Agency | Legal obligation (Proceeds of Crime Act 2002) |
| Keeping accounting and tax records | Legal obligation |
| Invoicing, collecting fees and managing our accounts | Performance of a contract; legitimate interests |
| Handling complaints, claims and professional regulation | Legal obligation; legitimate interests (defending legal claims) |
| Quality control, training and business administration | Legitimate interests (running our practice well) |
| Website analytics, session recordings and improving our site | Consent (given in our cookie banner) |
| Advertising, retargeting and measuring campaigns on Meta, LinkedIn and Google | Consent (given in our cookie banner) |
| Sending marketing by email, newsletter, SMS, WhatsApp and phone | Email, SMS and WhatsApp: consent, or legitimate interests for existing clients about similar services, with an easy opt-out (the PECR “soft opt-in”). Phone calls: legitimate interests; we screen numbers against the Telephone Preference Service (TPS) and Corporate TPS unless you have agreed to be called |
| Keeping our systems and data secure and preventing fraud | Legitimate interests; legal obligation |
5.1Special category data (such as health information for a Universal Credit application) is processed with your explicit consent, or where needed to establish, exercise or defend legal claims. Criminal offence data from AML checks is processed under Schedule 1 to the Data Protection Act 2018, for preventing fraud and meeting regulatory requirements.
5.2Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details of that assessment.
6. Marketing
We may contact you about our services by email, SMS, WhatsApp or phone. We send electronic messages only with your consent, or to existing clients about similar services. We do not call numbers registered with the TPS or Corporate TPS unless you have agreed to hear from us. You can opt out at any time: use the unsubscribe link in an email, reply STOP to an SMS or WhatsApp message, tell us during a call, or email support@wpcaccountants.co.uk. We never sell or rent your personal data.
7. Cookies, analytics and advertising technologies
7.1Cookies are small text files placed on your device. Similar technologies include pixels, tags and scripts that collect information about how you use our site, and this section covers them too.
7.2Your choice on our website. We only set non-essential cookies and tags after you accept them in our cookie banner. Until you accept, only strictly necessary cookies are used, and the analytics and advertising tools listed below do not load. Strictly necessary cookies do not need consent.
7.3You can change your choice at any time through the “Cookie settings” link in the website footer. If you withdraw consent, this does not affect data already collected. We remember your choice for 12 months.
7.4We use Google Consent Mode and equivalent settings so that these tools do not set cookies until you consent.
| Category | Tool and provider | What it does | Main cookies (typical lifespan) |
|---|---|---|---|
| Strictly necessary | Our website and cookie banner | Keeps the site secure, remembers your cookie choices, makes forms work | Consent preference cookie (12 months) |
| Analytics | Google Analytics 4 (Google Ireland Ltd / Google LLC) | Counts visits and measures which pages and tools are used. IP addresses are not stored by GA4 | _ga, _ga_<ID> (2 years) |
| Analytics and session recording | Microsoft Clarity (Microsoft Corporation) | Creates heatmaps and session recordings of clicks, scrolls and mouse movement so we can fix usability problems. Form fields and sensitive text are masked | _clck (1 year), _clsk (1 day), CLID (1 year), MUID (1 year) |
| Advertising | Meta Pixel (Meta Platforms Ireland Ltd) | Measures responses to our Facebook and Instagram adverts and shows our adverts to people who visited our site | _fbp (3 months), fr (3 months) |
| Advertising | LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) | Measures LinkedIn campaign results, provides anonymised visitor demographics and enables retargeting | li_fat_id, UserMatchHistory, AnalyticsSyncHistory (30 days); li_sugr (3 months); bcookie (1 year); lidc (1 day) |
| Advertising | Google Ads (Google). Not currently in use; listed so that visitors know in advance. It will run only after you consent | Will measure Google Ads conversions and show our adverts to people who visited our site | _gcl_au (3 months) |
7.5Lifespans are set by each provider and may change. If we change the tools or cookies we use, we update this section and, where consent is needed, ask you again.
7.6What the providers see. Meta, LinkedIn, Google and Microsoft may combine information from our site with information they already hold about you, under their own privacy policies. We do not send them your name, email or financial information from our forms.
7.7Managing cookies. Besides our banner, you can block or delete cookies in your browser settings, opt out of Google Analytics with Google’s browser add-on, and manage ad preferences in your Meta and LinkedIn account settings. Blocking strictly necessary cookies may stop parts of the site working.
8. Who we share it with
We never sell or rent your personal data. We share it only where needed, and only as far as each recipient needs.
| Recipient | What for |
|---|---|
| Government and regulators | HMRC, Companies House, the Department for Work and Pensions, the Charity Commission, The Pensions Regulator and pension providers, when filing or acting for you |
| Our AML supervisor and law enforcement | The AAT, for supervision and monitoring, and the National Crime Agency where the law requires us to report |
| Bright Pay &IRIS | Bright Pay for our payroll processing and compliance and IRIS for statutory accounting and tax reporting. |
| Other service providers working for us | Cloud hosting and email, accounting, payroll and tax software, secure file-sharing and e-signature tools, identity verification and AML screening providers, payment processors, messaging and SMS platforms (including WhatsApp Business) and IT support. They act on our instructions under written contracts |
| Analytics and advertising providers | Google, Microsoft, Meta and LinkedIn, only if you accept cookies (section 7). They also use some data for their own purposes, as their own privacy policies explain |
| Professional advisers | Our lawyers, insurers, auditors and AAT-appointed reviewers |
| Third parties you ask us to deal with | Banks, mortgage lenders, landlords, your previous or new accountant, or anyone else you authorise |
| WPC Group companies | Only with your agreement, for example if you ask us to involve Work Permit Cloud on a sponsor licence matter, or where a group company provides shared IT or administrative support under a data sharing agreement |
| A buyer of our business | If we sell or merge all or part of our business, your data may pass to the buyer, who must use it in line with this policy |
| Courts and public authorities | Where the law requires, to comply with court orders, legal proceedings or lawful requests from public authorities |
9. Data used outside the UK
9.1Some of the providers named in this policy, including Google, Microsoft, Meta, LinkedIn and Monday.com, may process data outside the UK, including in the United States and the European Economic Area (EEA).
9.2When data leaves the UK we make sure it is protected by one of these safeguards:
- a UK adequacy decision (for example, for the EEA, or the UK Extension to the EU-US Data Privacy Framework for certified US companies); or
- the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
9.3You can ask us for more information about the safeguards used at support@wpcaccountants.co.uk.
10. How long we keep it
| Data | How long |
|---|---|
| Enquiries that do not lead to an engagement | 2 years from last contact |
| Client files, working papers and tax records | 6 years after the end of the tax year or accounting period they relate to, or 6 years after our engagement ends if later |
| AML identity and due diligence records | 5 years after the business relationship ends, as required by the Money Laundering Regulations 2017 |
| Payroll records | 6 years after the end of the tax year they relate to |
| Invoices and payment records | 6 years from the end of our financial year |
| Complaints and claims | 6 years after resolution |
| Marketing preferences | Until you unsubscribe, then kept on a suppression list so we do not contact you again |
| Analytics and advertising data | As set out in section 7, and no longer than 14 months in Google Analytics |
When the period ends we delete the data or make it anonymous, securely. We may keep data longer where a regulator, a law or an ongoing claim requires it.
11. How we keep it secure
We use technical and organisational measures to protect your data, including:
- encryption of data in transit and secure, access-controlled cloud storage;
- two-factor authentication on our systems and client portals;
- access limited to staff who need it, all bound by confidentiality;
- secure file-sharing for documents, instead of ordinary email attachments where possible; and
- staff training on data protection, AML and cyber security.
WPC Group holds Cyber Essentials certification. No method of transmission over the internet is completely secure, but we will notify you and the Information Commission of a data breach where the law requires.
12. Your rights
Under UK data protection law you have the right to:
- Access a copy of the personal data we hold about you.
- Rectification of inaccurate or incomplete data.
- Erasure of your data, where we have no legal reason to keep it.
- Restriction of how we use your data in certain cases.
- Data portability: receive data you gave us in a usable format, or have it sent to another provider.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time, including for cookies and marketing, without affecting earlier processing.
- Not be subject to solely automated decisions with significant effects.
Some rights are limited where we must keep data by law, for example AML and tax records. We cannot tell you about a suspicious activity report if doing so would be “tipping off” under the Proceeds of Crime Act 2002.
To use any right, email support@wpcaccountants.co.uk. We may ask you to verify your identity. We will reply within one month, or tell you if we need up to two more months for complex requests. There is normally no fee. If your request is about information we hold on a client’s behalf, see section 3.
13. Contact us and complaints
13.1For questions about this policy or your data, contact:
WPC Accountants Ltd3rd Floor, 112-116 Whitechapel Road, London E1 1JEEmail: support@wpcaccountants.co.ukTelephone: 07838 125511Office hours: Monday to Friday, 10:00 am to 6:30 pm (excluding bank holidays)
13.2If you are unhappy with how we have handled your data, please tell us first so we can put it right. We will acknowledge your complaint within 30 days.
13.3You also have the right to complain to the Information Commission (formerly the ICO), the UK data protection regulator:
Website: ico.org.uk/make-a-complaintHelpline: 0303 123 1113Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
14. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
15. Children and links to other websites
15.1Children. Our website and services are not aimed at children under 18. Where a client’s affairs involve a child, such as a dependant on a tax return, we use only the information needed.
15.2Links to other websites. Our site links to GOV.UK, professional bodies and other WPC Group websites. Their privacy practices are their own; please read their policies.
16. Changes to this policy
We review this policy regularly. The current version is always on our website, with its version number and date. If a change significantly affects how we use your data, we tell clients by email before it applies.