Privacy policy

Section 1Who we are

Acuna Bookkeeping is a self-employed bookkeeping practice based in Edinburgh, Scotland, run by Jose Acuna. We provide bookkeeping, VAT, payroll, Making Tax Digital and related financial services to small businesses and sole traders across the UK.

For the purposes of UK data protection law, we are the data controller of your personal information. We are registered with the Information Commissioner’s Office (ICO) and supervised by the Association of Accounting Technicians (AAT) for anti-money laundering purposes.

Section 2What information we collect

We collect personal information in the following situations:

• Enquiry form: name, email address, phone number, business name, and anything you include in your message.
• Identity verification: photo ID (passport or driving licence) and proof of address, which anti-money laundering regulations require before we can start work.
• As a client: business and personal financial records, bank statements, invoices, payroll data, HMRC agent authorisation codes, National Insurance numbers, UTR numbers, and other information needed to provide bookkeeping services.
• Payment details: bank account information used to collect our fees by direct debit, where applicable.
• Communications: emails, calls or messages you send us.
• Website usage: if you accept analytics cookies, basic information about how you use the website, such as the pages you visit. See section 9.

Section 3How we use your information

• To respond to your enquiry and discuss our services.
• To provide the bookkeeping and related services you have engaged us for.
• To meet our legal obligations, including submitting returns to HMRC on your behalf.
• To comply with anti-money laundering regulations, including verifying your identity and monitoring for unusual activity.
• To send relevant updates about your accounts or our services. We never send marketing without your consent.
• To keep accurate financial records as required by law.
• If you accept analytics cookies, to understand which pages of our website are useful so we can improve it.

Section 4Legal basis for processing

• Contract: processing is necessary to provide the bookkeeping services you have engaged us for.
• Legal obligation: we must process certain data to comply with HMRC, Companies House, the Money Laundering Regulations 2017 and other regulatory requirements.
• Legitimate interests: responding to your enquiry and managing our business relationship.
• Consent: where you have explicitly agreed, for example by ticking the consent box on our contact form or accepting analytics cookies.

Section 5Who we share your information with

We do not sell or rent your personal data to anyone. We only share information in these circumstances:

• HMRC: as required to submit VAT returns, payroll, MTD updates and other statutory filings on your behalf.
• Xero: our cloud accounting software stores your financial data. Xero is headquartered in New Zealand and operates under UK GDPR-compliant safeguards. See xero.com for their privacy policy.
• Netlify: hosts our website and receives the messages you send through our contact form.
• Google: if you accept analytics cookies, Google Analytics processes information about your visit on our behalf. See Google’s privacy policy.
• National Crime Agency: where we are legally required to submit a Suspicious Activity Report under the Money Laundering Regulations 2017. We may not be permitted to tell you if we make such a report.
• The Association of Accounting Technicians (AAT): as our anti-money laundering supervisor, AAT may inspect our records as part of compliance reviews.
• Your accountant or other advisers: if you ask us to share records with them.
• Legal requirements: if we are required to disclose information by law or court order.

Section 6How long we keep your data

• Client financial records: at least 6 years from the end of the relevant tax year, as required by HMRC.
• Anti-money laundering records (ID, proof of address, due diligence): 5 years after our business relationship ends, as required by the Money Laundering Regulations 2017.
• Enquiries from non-clients: up to 12 months, then securely deleted.
• Payroll records: at least 3 years after the tax year they relate to.

After the relevant retention period, your data is securely deleted or anonymised.

Section 7Your rights

Under UK GDPR you have the following rights:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your data, subject to legal retention obligations.
• Right to restrict processing: ask us to limit how we use your data in certain circumstances.
• Right to data portability: request your data in a portable format.
• Right to object: object to processing based on legitimate interests.
• Right to withdraw consent: where we rely on your consent, you can withdraw it at any time.

To exercise any of these rights, contact us at jose@acunabookkeeping.co.uk. We will respond without undue delay and within one month at the latest.

Section 8Data security

We use secure, cloud-based software (Xero), communicate by encrypted email where possible, and do not store sensitive financial information in unsecured formats. Access to your data is limited to Jose Acuna, the sole owner of the practice.

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO as required by law, within 72 hours of becoming aware of it.

Section 9Cookies & analytics

We use Google Analytics to understand how visitors use our website, for example which pages are viewed most. Google Analytics uses cookies, and these are only set if you click “Accept” on the cookie banner. If you decline, or don’t make a choice, no analytics cookies are set.

Your choice is saved in your browser so we don’t ask again on every page. You can change it at any time using the Cookie settings link at the bottom of every page.

The contact form is hosted by Netlify, which may set short-lived cookies for spam prevention and form submission. Our fonts are loaded from Google Fonts, which may log your IP address when fonts are served. Neither is used to track you across other websites.

Change cookie settings

Section 10Complaints

If you have concerns about how we handle your data, please contact us first. You also have the right to complain to the Information Commissioner’s Office:

For concerns about the professional service you have received, you can also complain to our professional body:

Section 11Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with a revised date.

Questions? Contact us at jose@acunabookkeeping.co.uk.