Milestone Accountants Ltd (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This policy explains how we collect, use, store, and protect your personal data when you interact with our website or engage our services, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We may collect and process the following data:

Information you provide to us: This includes information you fill in on forms on our website (e.g., contact forms), details provided when you enquire about our services, and data you provide when you become a client. This may include your name, address, email address, phone number, and business details.

Technical Information: When you visit our website, we may automatically collect your IP address, browser type, and information about your visit (e.g., pages viewed) using cookies. For more details, please see our Cookie Policy.

Client Service Data: If you are a client, we will collect the necessary personal and financial data required to provide our accounting and tax services, as detailed in our client engagement letter.

We will only use your personal data when the law allows us to. Most commonly, we will use your data:

To perform a contract with you (Lawful Basis: Performance of a Contract): To provide the accounting and tax services you have requested.

To comply with a legal obligation (Lawful Basis: Legal Obligation): For example, conducting anti-money laundering checks required by law.

For our legitimate interests (Lawful Basis: Legitimate Interests): Such as managing our business operations, website administration, and for network security. We ensure these interests do not override your rights.

Based on your consent (Lawful Basis: Consent): For example, if you opt-in to receive marketing newsletters. You can withdraw consent at any time by contacting us.

We respect your privacy and will never sell your data. We may share your data with trusted third parties only where necessary, including:

• HMRC and other regulatory bodies as required by law.
• Anti-money laundering and identity verification services (e.g., SmartSearch, Veriphy).
• Our professional software providers (e.g., QuickBooks, TaxCalc, Xero, Sage) who act as data processors under strict contractual terms.
• Our professional indemnity insurer or regulator Association of Certified Public Accountants, HMRC and our Professional Indemnity Insurer.

All third-party providers are required to protect your data and use it only for the purposes we specify.

We have implemented appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way. These include secure cloud storage, encryption, password policies, and physical security at our premises.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Typically, we retain client records for 5 years after the end of our business relationship.

Under data protection law, you have rights including:

• Access: The right to request a copy of the personal data we hold about you.
• Rectification: The right to request correction of inaccurate data.
• Erasure: The right to request we delete your data (the “right to be forgotten”).
• Restriction: The right to request we temporarily stop processing your data.
• Objection: The right to object to how we are using your data.
• Portability: The right to request a transfer of your data to another service.

To exercise any of these rights, please contact us using the details below.

If you have any concerns about our use of your personal data, please contact us first so we can try to resolve it. You can also complain to the ICO:

• ICO Website: https://www.ico.org.uk/make-a-complaint/
• ICO Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

For any questions about this privacy policy or your data, please contact our Data Protection Lead:

• Email: imran.hafeez@milestoneaccountants.co.uk
• Post: Milestone Accountants Ltd, 18A Gawsworth Avenue, Didsbury, Manchester, M20 5NF

Milestone Accountants Ltd is committed to ensuring the security and protection of the personal data that we process. This policy outlines our framework for complying with the UK GDPR and the Data Protection Act 2018.

We adhere to the data protection principles, ensuring that personal data is:

• Processed lawfully, fairly, and transparently.
• Collected only for specified and legitimate purposes.
• Adequate, relevant, and limited to what is necessary.
• Accurate and kept up to date.
• Stored only as long as necessary.
• Processed securely to maintain integrity and confidentiality.
• And that we can demonstrate our compliance (Accountability).

To meet these principles, we have implemented the following:

• Policies & Procedures: Internal data protection policies and procedures.
• Staff Training: Regular data protection training for all staff.
• Data Mapping: We understand what data we hold, why we hold it, and how long we keep it.
• Secure Processing: Technical measures (like encryption) and organisational measures (like staff training) to protect data.
• Data Processing Agreements: Contracts are in place with all third-party data processors.
• Handling Requests: We have a process to handle individual rights requests promptly and in line with the law.

• Ultimate responsibility for data protection rests with the principals of Milestone Accountants Ltd.
• Day-to-day responsibility is assigned to our Data Protection Lead, Imran Hafeez.
• All employees are responsible for understanding and complying with this policy.

This policy is reviewed regularly to ensure its ongoing suitability and effectiveness.