Privacy Policy

About this policy

Egbenn Limited, company number 11968982, is the data controller for the personal data described here. Our registered office is 167-169 Great Portland Street, 5th Floor, London W1W 5PF. This policy covers the personal data of clients and their staff, directors and connected parties, people who enquire about our services or answer the questions on this site, suppliers, and visitors to www.egbenn.co.uk. It applies from 18 October 2026 and replaces any earlier version. We recommend reading it alongside our cookie policy. Egbenn also has this policy reviewed by a suitably qualified compliance adviser or solicitor before publication and when the law changes.

What personal data we collect

Personal data reaches us in three ways: you give it to us, our website records it, or another organisation supplies it.

Information you give us

Your name, business name, email address, phone number, postal address and the details you type into the questions on this site or send us by email. Once you become a client we also hold the records needed to do the work: accounting records, bank data, invoices and receipts, payroll and pension details for you and your staff, National Insurance and tax reference numbers, dates of birth, and the identity documents required for anti-money-laundering checks.

Information collected automatically

When you visit the site, our hosting and analytics tools record technical data such as your IP address, approximate location, browser and device type, the pages you look at, how you arrived and how long you stay. Some of this is collected through cookies and similar technologies. Non-essential cookies are only set where you have agreed to them. Our cookie policy explains each category and how to change your choice.

Information from third parties

We may receive data about you from your previous accountant during a handover, from Companies House and HMRC, from your bookkeeping, banking and payroll software where you have connected it to us, from identity verification and anti-money-laundering screening services, and from anyone who refers you to us. We also receive data when you contact us through a third-party platform, for example an email provider or an online form service.

Why we process your data

Every use of personal data has to rest on a lawful basis under Article 6 of the UK GDPR, and here are the ones we rely on.

To provide our services (Contract)

When you engage us, we process personal data to carry out the engagement letter: bookkeeping, VAT returns, payroll and auto-enrolment, CIS, year-end accounts, corporation tax, Self Assessment, management reporting and advisory work. We also use it to agree the monthly fee, raise invoices and take payment.

To meet our legal obligations (Legal obligation)

The Money Laundering Regulations 2017 require us to verify identity, keep those records and report suspicions. Tax and company law requires us to file returns and accounts with HMRC and Companies House, to retain supporting records, and to respond to lawful requests during an enquiry or investigation.

To run and improve our business (Legitimate interests)

We rely on legitimate interests for client care and relationship management, keeping existing clients informed about services that relate to the ones they already have, website analytics, security monitoring, debt recovery, insurance, internal administration and professional indemnity. We balance these against your rights, and you can object at any time.

Where you have agreed (Consent)

We rely on consent for marketing emails to people who are not clients, for non-essential cookies, and for anything optional such as using a client story in anonymised form. You can withdraw consent at any time by emailing info@egbenn.co.uk, using the unsubscribe link or changing your cookie settings, and withdrawal does not affect earlier processing.

Who we share your data with

We do not sell personal data, and we share it only where the work, the law or your instructions require it.

Data goes to a third party where it is needed to deliver the service you have engaged us for, where we are legally obliged to disclose it, or where you have asked us to. Anyone processing data on our behalf is bound by a written contract and may only act on our instructions.

HMRC and Companies House

We submit VAT returns, payroll and CIS returns, Self Assessment and corporation tax returns, accounts and confirmation statements. We also correspond with HMRC on your behalf during enquiries, disclosures and routine queries, with your authority in place.

Software providers

We use cloud bookkeeping, payroll, tax filing, document exchange, email and website hosting services. Personal data is stored on their systems under data processing agreements. We can tell you which providers are used on your engagement if you ask us.

Professional advisers

Where a matter needs specialist input, and with your knowledge, we may share data with solicitors, tax specialists, insurance brokers, IT support or our professional indemnity insurers. We do not pass your details to introducers or lenders without asking you first.

Regulatory and legal authorities

ACCA may review our files as part of its monitoring of registered practices. We may also disclose data to law enforcement, the National Crime Agency or a court where the law requires it, including reports made under the Money Laundering Regulations 2017.

International data transfers

Most of the data we hold stays in the UK. Some of the cloud services we use, including hosting, email and analytics, are run by providers with servers in the European Economic Area or elsewhere, so personal data can be transferred outside the UK. Where that happens, we rely on the UK adequacy regulations covering the EEA, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards the provider has in place. You can ask us for details of the transfers relevant to your engagement.

How long we keep your data

We keep personal data for as long as the work, the law or a live dispute requires, then delete or anonymise it.

Client records

Engagement records, accounting records and identity verification documents are kept for at least six years after the engagement ends, in line with the Money Laundering Regulations 2017 and tax law. Some records are held for seven years where HMRC time limits make that sensible.

Enquiry and prospect data

If you answer the questions on this site or contact us and we do not go on to work together, we keep what you sent for up to 24 months from your last contact with us, in case you come back, and then delete it or strip out anything identifying.

Website analytics

Analytics data tied to a device or visit is kept for up to 26 months, after which it is deleted or held only in aggregated form that does not identify anyone. Cookie consent records are kept for as long as that choice remains valid.

Marketing consent records

Where you have consented to marketing, we keep a record of that consent for as long as it is active and for two years after it is withdrawn, so we can evidence what was agreed and when, as PECR and the UK GDPR expect.

Your rights

These are statutory rights under the UK GDPR, and they apply to the personal data we hold about you. Some are qualified, which means they can be limited where the law requires us to keep records.

Right to be informed

You are entitled to know what personal data we hold, why we hold it, who we share it with and how long we keep it. This policy is how we provide that information, and we update it when our processing changes.

Right of access

You can make a subject access request and receive a copy of the personal data we hold about you, along with the supporting information. Email info@egbenn.co.uk with the words subject access request and tell us what you are looking for.

Right to rectification

If anything we hold about you is wrong or incomplete, tell us and we will correct it. Where we have passed the incorrect data to someone else, we will let them know unless that proves impossible or disproportionate.

Right to erasure

You can ask us to delete personal data we no longer need. We cannot delete records we are required to keep, for example accounting and anti-money-laundering records retained for six years, and we will explain which of your data that covers.

Right to restrict processing

You can ask us to pause processing while we check the accuracy of data, consider an objection you have raised, or where processing is unlawful but you would rather we held the data than erased it. We keep the data and stop using it.

Right to data portability

Where we process data you gave us by automated means on the basis of consent or a contract, you can ask for it in a structured, commonly used, machine-readable format, or ask us to send it directly to another provider where that is technically possible.

Right to object

You can object to processing we carry out on the basis of legitimate interests, and we will stop unless we can show compelling grounds that override your rights. If you object to direct marketing we stop immediately and without question.

Rights related to automated decision-making

We do not make decisions about you by automated means alone and we do not carry out profiling that produces legal or similarly significant effects. A person at Egbenn reviews every recommendation and every piece of advice before it reaches you.

How to exercise your rights

Email info@egbenn.co.uk or write to us at 167-169 Great Portland Street, 5th Floor, London W1W 5PF. Tell us which right you want to use and what the request covers. We will ask for proof of identity before releasing or changing anything, and we respond within one month, which can be extended by two further months for complex or multiple requests, in which case we tell you why. There is no charge unless a request is manifestly unfounded or excessive.

How we protect your data

Data sent to and from this website travels over an encrypted HTTPS connection. Client records are held in cloud accounting, payroll and document systems protected by encryption at rest, strong passwords and multi-factor authentication. Access is limited to the people who need it for the work in hand. Devices are encrypted and kept patched, and we use a secure portal rather than plain email for sensitive documents wherever it is practical. We review these arrangements regularly and when we change supplier. No system can be made completely secure, so if a breach happens that risks your rights, we will investigate, tell you where the law requires it and report it to the Information Commissioner’s Office within 72 hours where that duty applies.

Cookies

This site uses cookies that are needed to make pages work, along with analytics cookies that show us which pages people read and how they arrived. Non-essential cookies are only set where you have agreed to them, and you can change your choice at any time. Our cookie policy at /cookie-policy/ lists each one and what it does.

Children’s data

Our services are for business owners and we do not aim any part of this website at children. We do not knowingly collect personal data from anyone under 18, other than the payroll or pension details of a young employee supplied to us by a client employer. If you believe a child has given us data directly, email info@egbenn.co.uk and we will remove it.

Changes to this policy

We update this policy when our services, our systems or the law change. The last reviewed date at the top of the page tells you when the current version took effect, and earlier versions are available on request. Where a change materially affects how we handle client data, we tell existing clients directly by email.

How to contact us

Data questions go straight to Crosby Enninful, who handles them for the practice.

Egbenn does not have a statutory data protection officer, which is not required for a practice of this size. Data protection queries, subject access requests and complaints about how we have handled your information are dealt with by the founder and partner.

Data queries: info@egbenn.co.uk. We respond within one month, as the UK GDPR requires. Data controller: Egbenn Limited, 167-169 Great Portland Street, 5th Floor, London W1W 5PF. Companies House 11968982. ICO registration ZB621879.

Complaints to the ICO

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at any time. The ICO can be reached at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by phone on 0303 123 1113, or through the complaints pages at https://ico.org.uk/make-a-complaint/. Raising a complaint with the ICO does not affect any other legal remedy available to you, and it costs nothing to do.