Privacy Policy

PRIVACY NOTICE

Last updated: 19th October 2026

1. Who we are - Aptus Professional Ltd (“we”, “us”) is a firm of accountants registered in England and Wales, company number 06433911, with its registered office at Punters House, Park Road, Malmesbury, SN16 0BX. We are registered with the Information Commissioner’s Office under registration number ZA890289. For any question about this notice or how we handle personal data, contact Adam Bendall at adam@aptus.pro.

2. Who this notice covers - This notice explains how we use personal data about:

• our clients, and the directors, shareholders, partners, trustees and family members of our clients;
• our clients’ employees, customers and suppliers, where their details appear in records we work with;
• people who enquire about our services;
• visitors to our website.

3. The personal data we collect

Depending on the services we provide, this may include:

• names, addresses, contact details and dates of birth;
• identity documents and the results of identity checks;
• National Insurance numbers, Unique Taxpayer References and other tax references;
• income, expenses, assets, bank, pension, investment and other financial details;
• information about family circumstances relevant to tax;
• payroll information about our clients’ employees;
• names and transaction details of our clients’ customers and suppliers;
• notes and transcripts of calls and meetings with us;
• correspondence with you.

We do not usually need special category data, such as information about health. We may receive it where it is relevant to your affairs, for example statutory sick pay in payroll, or where you choose to share it with us.

4. Where we get it from

Most of the personal data we hold is provided by you or by our client. We may also obtain it from:

• HMRC, Companies House and other public sources;
• identity verification and anti-money laundering screening providers;
• banks, pension providers and other advisers, with your authority.

5. Why we use it and our lawful basis

We use personal data:

• To provide the services set out in our engagement letter. The lawful basis is that processing is necessary to perform our contract with you, or for our legitimate interests in providing services to our clients where the data is about someone other than our client.
• To meet our legal and regulatory obligations, including anti-money laundering checks, tax law, and the requirements of our professional body. The lawful basis is legal obligation.
• To run our business, including managing our client relationships, keeping records, using service providers and AI tools to work efficiently, handling complaints, and protecting our legal position. The lawful basis is our legitimate interests, which we balance against your rights.
• To respond to enquiries and send you information about our services. The lawful basis is our legitimate interests or, where required, your consent. You can opt out of marketing at any time.

Where we act as a processor for our clients, for example when running payroll, our client decides how the data is used and their own privacy notice applies.

6. Who we share it with

We may share personal data with:

• HMRC, Companies House, pension providers and other bodies, where needed to provide our services;
• banks, lenders, solicitors and other advisers, at your request;
• our professional body, anti-money laundering supervisor, insurers and professional advisers;
• law enforcement agencies, where the law requires it, including reports we are obliged to make under anti-money laundering law;
• a buyer of, or investor in, our business, under appropriate safeguards;
• our service providers, as described below.

7. We do not sell personal data.

8. Our service providers and use of AI

We use carefully selected service providers to help us deliver our services. These include:

• our client management system and client portal;
• accounting and payroll software;
• cloud storage and email;
• artificial intelligence (AI) tools that help us with drafting, analysis and taking notes of meetings.

A current list is available at https://aptus.pro/service-providers.

Each provider processes personal data only on our instructions, under a written agreement that requires it to keep the data confidential and secure. We use AI tools only on business plans whose terms do not allow the provider to use our data to train its AI models.

When we use an AI note-taker on a call, we will tell you at the start. Audio is used only to create a transcript and notes, and is deleted when no longer needed.

All work produced with the help of AI is reviewed by a member of our team, and we remain responsible for it. We do not make decisions about anyone based solely on automated processing.

9. International transfers

Some of our service providers store or process data outside the UK, including in the United States. Where this happens, we make sure the transfer is protected as UK data protection law requires, for example by relying on UK adequacy regulations, or on safeguards such as the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

10. How we keep your data secure

We use appropriate technical and organisational measures to protect personal data. These include multi-factor authentication, encrypted cloud systems, access controls, and confidentiality obligations on everyone who works with us.

Please use our secure client portal to send documents and information to us.

If you choose to send information to us by other means, such as WhatsApp, text message or ordinary email, you do so at your own risk. We cannot control the security of those channels or of the devices you use.

11. How long we keep it

We keep personal data only for as long as we need it. In general, we keep:

• client records for 7 years after the end of our engagement, or after the end of the tax year they relate to if later;
• anti-money laundering records for at least 5 years after our business relationship ends, as the law requires;
• enquiries from people who do not become clients for 12 months.

We may keep data for longer where there is a legal or regulatory reason, or where it is needed for a claim or dispute.

12. Our website

If you contact us through our website, we use your details to respond to your enquiry.

We use Google Analytics to understand how visitors use our site. Analytics cookies are set only if you accept them through our cookie banner.

13. Your rights

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data deleted in some circumstances;
• restrict or object to our use of your data in some circumstances;
• receive data you provided to us in a portable format, in some circumstances;
• withdraw consent where we rely on it.

Some rights are limited, for example where we must keep records by law. To use any of these rights, contact us using the details above. We will normally respond within one month.

14. Complaints

If you are unhappy with how we have handled your personal data, please contact us first. We will acknowledge your complaint within 30 days and aim to resolve it promptly.

You also have the right to complain to the Information Commissioner’s Office (or its successor) at ico.org.uk or on 0303 123 1113.

15. Changes to this notice

We may update this notice from time to time. We will tell our clients about any significant changes. The date at the top shows when it was last updated.