Company Assist Privacy Policy

1. Purpose of this Privacy Policy

1.1 This Privacy Policy explains how Company Assist ("Company Assist", "we", "our" or "us") collects, uses, stores, protects and shares your personal data when you use our website, purchase our services, communicate with us or otherwise interact with our business.

1.2 We are committed to protecting your privacy and handling your personal information responsibly, transparently and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable privacy legislation.

1.3 This policy also explains your rights regarding your personal data and how you can exercise those rights.

2. Important Information

2.1 This Privacy Policy applies to all visitors to our website, existing clients, prospective clients, suppliers and other individuals whose personal information we process.

2.2 Our website is not intended for children under the age of 18 and we do not knowingly collect personal information from children.

2.3 By using our website or engaging our services you acknowledge that you have read this Privacy Policy.

3. Definitions

For the purposes of this Privacy Policy:

Personal Data means any information relating to an identified or identifiable individual.

Processing means collecting, recording, storing, using, sharing or deleting personal data.

Data Controller means the organisation responsible for deciding how and why personal data is processed.

Data Processor means a third party processing personal data on behalf of a Data Controller.

Special Category Data means personal data relating to health, ethnicity, political opinions, religious beliefs, biometric information, trade union membership, sexual orientation or other information requiring additional legal protection.

UK GDPR means the United Kingdom General Data Protection Regulation.

ICO means the Information Commissioner's Office.

4. Data Controller

4.1 Company Assist is the Data Controller responsible for the personal data collected through this website and our services.

4.2 Our registered office is:

4.3 Privacy enquiries should be sent to:

Email: info@companyassist.co.uk

4.4 Our ICO registration is currently pending. Once issued, this policy will be updated accordingly.

5. Our Responsibilities

We are committed to ensuring that personal data is:

• processed lawfully, fairly and transparently;
• collected only for legitimate purposes;
• adequate, relevant and limited to what is necessary;
• accurate and kept up to date;
• retained only for as long as necessary;
• protected using appropriate technical and organisational security measures.

6. Your Responsibilities

6.1 You should ensure the information you provide to us is accurate and kept up to date.

6.2 Where you provide personal information relating to another individual, you confirm you have authority to do so and that they have been informed of how their data may be used.

6.3 Failure to provide certain information may prevent us from providing some or all of our services.

7. Personal Data We Collect

Depending on the services you request, we may collect the following categories of information.

Identity Data

Including:

• name
• title
• date of birth
• nationality
• National Insurance number
• passport or driving licence information
• Companies House information
• photographic identification where required for identity verification.

Contact Data

Including:

• postal address
• email address
• telephone number
• billing address
• correspondence address.

Financial Data

Including:

• payment information
• bank account details
• direct debit details
• transaction history.

We do not store full payment card details.

Transaction Data

Including:

• services purchased
• invoices
• quotations
• payments received
• refunds
• subscription history.

Tax & Accounting Data

Where relevant to the services provided, we may collect:

• accounting records
• payroll information
• VAT records
• corporation tax information
• self assessment information
• CIS records
• bookkeeping records
• Companies House filings
• statutory accounts
• confirmation statements
• dividend information
• pension contributions
• business expenses
• banking information required for accounting purposes.

Technical Data

Including:

• IP address
• browser type
• operating system
• device identifiers
• screen resolution
• referring website
• pages visited
• session duration
• diagnostic information
• cookies.

Usage Data

Including information about how you use:

• our website
• client portal
• software
• online forms
• customer support services.

Communications Data

Including:

• emails
• telephone calls
• live chat messages
• support tickets
• feedback
• reviews
• survey responses.

Telephone calls may be recorded for training, quality assurance, security and compliance purposes.

Marketing Data

Including:

• marketing preferences
• newsletter subscriptions
• consent records
• campaign interactions.

Public Information

We may obtain publicly available information from sources including:

• Companies House
• HM Land Registry
• Electoral Register (where legally available)
• Insolvency Register
• FCA Register
• other publicly accessible government databases.

Identity Verification Information

Where required by law, particularly for Anti-Money Laundering regulations, we may collect:

• identity verification results
• proof of address
• sanctions screening
• politically exposed person checks
• fraud prevention checks
• electronic identity verification results.

Identity verification may be carried out using approved third-party verification providers.

8. Information That Is Not Personal Data

We may collect anonymous statistical information to understand how visitors use our website.

Examples include:

• page popularity
• average session length
• browser statistics
• geographical trends
• device types
• conversion rates.

This information cannot identify you personally.

9. Special Category Data

We generally do not collect Special Category Data unless required by law or where necessary to provide our services.

Where required, this may include:

• biometric identity verification provided by an authorised identity verification provider;
• information necessary to comply with Anti-Money Laundering legislation;
• information required to establish or defend legal claims.

Where Special Category Data is processed, we will ensure an appropriate lawful basis exists under UK GDPR.

10. How We Collect Your Information

We collect personal information in several ways.

10.1 Information You Provide

You may provide information when you:

• complete forms on our website;
• request a quotation;
• become a client;
• purchase services;
• subscribe to newsletters;
• create an online account;
• upload documents;
• communicate with us by email or telephone;
• use our live chat;
• request customer support.

10.2 Automatically Collected Information

When you visit our website we may automatically collect Technical Data and Usage Data using:

• cookies;
• server logs;
• analytics software;
• website performance tools;
• security monitoring systems.

We may use services such as Microsoft Clarity, Google Analytics and similar technologies to understand how visitors interact with our website and improve user experience.

10.3 Third Parties

We may receive personal information from:

• identity verification providers;
• payment providers;
• accountants or advisers authorised by you;
• publicly available government records;
• referral partners;
• software providers;
• fraud prevention agencies;
• Companies House.

11. How We Use Your Personal Data

We will only process your personal data where we have a lawful basis for doing so under the UK GDPR.

The lawful bases we rely upon include:

• Performance of a contract.
• Compliance with a legal obligation.
• Legitimate interests.
• Your consent, where required.

11.1 To Provide Our Services

We use your information to:

• create and administer your account;
• provide accounting and taxation services;
• prepare statutory accounts;
• prepare Self Assessment tax returns;
• prepare Corporation Tax returns;
• prepare VAT returns;
• process payroll;
• manage bookkeeping;
• submit Companies House filings;
• provide company secretarial services;
• respond to enquiries;
• manage subscriptions;
• provide customer support.

Lawful Basis

• Performance of a contract.

11.2 Identity Verification

Where required by legislation, we may process your information to:

• verify your identity;
• comply with Anti-Money Laundering Regulations;
• prevent fraud;
• perform Know Your Customer (KYC) checks;
• verify directors and beneficial owners.

Lawful Basis

• Legal obligation.
• Legitimate interests.

11.3 Payment Processing

We use your information to:

• collect payments;
• issue invoices;
• process refunds;
• manage subscriptions;
• recover unpaid invoices where necessary.

Payments are processed securely through authorised payment providers.

We do not store full payment card details on our systems.

Lawful Basis

• Performance of a contract.

11.4 Customer Support

We may use your information to:

• respond to enquiries;
• resolve technical issues;
• investigate complaints;
• improve our support services.

Telephone calls may be monitored or recorded for training, quality assurance and security.

Lawful Basis

• Legitimate interests.

11.5 Improving Our Website

We analyse how visitors use our website to improve:

• navigation;
• usability;
• performance;
• security;
• customer experience;
• conversion rates.

We may use services including:

• Microsoft Clarity
• Google Analytics

These services may collect anonymous behavioural information including mouse movement, page interactions and session recordings.

Lawful Basis

• Legitimate interests.

11.6 Legal Compliance

We may process personal information where required to:

• comply with HMRC requirements;
• comply with Companies House requirements;
• comply with court orders;
• comply with legal investigations;
• comply with regulatory obligations.

Lawful Basis

• Legal obligation.

11.7 Fraud Prevention

We may use personal information to:

• detect fraud;
• prevent identity theft;
• investigate suspicious activity;
• protect our clients;
• protect our business.

Lawful Basis

• Legitimate interests.
• Legal obligation.

11.8 Business Administration

We use information to:

• manage our business;
• maintain records;
• conduct internal audits;
• improve services;
• manage risk;
• maintain security.

Lawful Basis

• Legitimate interests.

12. Marketing Communications

12.1 We may send you information regarding:

• new services;
• software updates;
• tax changes;
• accounting news;
• compliance reminders;
• promotional offers.

12.2 Where legally required, we will only send marketing communications after obtaining your consent.

12.3 Where permitted by law, existing clients may receive information about similar services that may be relevant to their business.

12.4 You may unsubscribe from marketing communications at any time by:

• clicking the unsubscribe link in emails;
• contacting us directly;
• updating your communication preferences.

12.5 Opting out of marketing will not prevent us sending important service or legal communications relating to your account.

13. Sharing Your Personal Data

We only share personal data where necessary.

Depending on the services you receive, we may share information with:

• HM Revenue & Customs (HMRC)
• Companies House
• Identity verification providers
• Anti-Money Laundering providers
• Payment processors
• Banking providers where authorised
• Cloud hosting providers
• IT support providers
• Professional advisers
• Legal advisers
• Auditors
• Insurers
• Government agencies
• Regulatory authorities
• Courts and law enforcement agencies
• Delivery providers
• Software providers used to deliver our services

13.1 Payment Providers

Payments may be processed using providers such as:

• Stripe

These providers process payment information under their own privacy policies.

13.2 Professional Software

We may use specialist accounting and practice management software to deliver our services.

Examples include:

• bookkeeping software;
• payroll software;
• document management systems;
• client portal software;
• tax compliance software.

Only authorised personnel have access to this information.

13.3 Website Providers

We may use trusted providers for:

• website hosting;
• cloud infrastructure;
• domain management;
• email services;
• security monitoring;
• backups.

13.4 Marketing Providers

Where marketing services are used, limited information may be shared with providers that assist with:

• email campaigns;
• SMS communications;
• analytics;
• customer relationship management.

13.5 Legal Requirements

We may disclose information where required:

• by law;
• by court order;
• by HMRC;
• by Companies House;
• to prevent crime;
• to investigate fraud;
• to protect legal rights.

13.6 Business Transfers

If Company Assist is sold, merged or restructured, personal information may transfer to the new owners.

The new owner will continue processing personal data in accordance with this Privacy Policy or a replacement policy.

14. Third Party Providers

All third-party providers acting on our behalf are required to:

• comply with UK data protection law;
• implement appropriate security measures;
• process information only on our instructions where acting as processors;
• maintain confidentiality.

Where a third party acts as an independent Data Controller, their own privacy policy will apply.

15. International Transfers

Some of our software providers may store or process personal information outside the United Kingdom.

Where this occurs we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreements;
• International Data Transfer Addendums;
• adequacy regulations approved by the UK Government;
• contractual safeguards approved under UK GDPR.

We will only transfer information internationally where appropriate legal protections exist.

16. Data Retention

We retain personal data only for as long as necessary.

Retention periods depend upon:

• legal obligations;
• taxation requirements;
• accounting regulations;
• contractual obligations;
• dispute resolution;
• legitimate business needs.

Generally:

• client records are retained for a minimum of seven years following the end of our relationship;
• financial records are retained as required by law;
• identity verification records are retained in accordance with Anti-Money Laundering legislation.

Where information is no longer required it will be securely deleted or anonymised.

17. Keeping Your Information Secure

We take the security of your information seriously.

Measures may include:

• encrypted connections;
• secure servers;
• restricted staff access;
• password protection;
• multi-factor authentication;
• firewalls;
• malware protection;
• monitoring systems;
• regular software updates;
• encrypted backups;
• staff confidentiality obligations.

Although we take appropriate security measures, no internet transmission can ever be guaranteed to be completely secure.

18. Cookies

18.1 Our website uses cookies and similar technologies to improve functionality, analyse website traffic and enhance your browsing experience.

Cookies are small text files stored on your device when you visit our website.

18.2 Types of Cookies We Use

We may use the following categories of cookies:

Strictly Necessary Cookies

These cookies are essential for the operation of our website and cannot be disabled through our cookie preferences.

Examples include:

• login sessions
• security
• fraud prevention
• load balancing
• shopping basket functionality

Performance & Analytics Cookies

These help us understand how visitors use our website.

They may collect information such as:

• pages viewed
• time spent on pages
• navigation paths
• browser type
• device information
• website performance

Where used, analytics providers may include:

• Google Analytics
• Microsoft Clarity

Functional Cookies

These remember your preferences, including:

• language
• login preferences
• accessibility settings
• user preferences

Marketing Cookies

Where enabled, these may help us:

• understand advertising performance
• measure campaign effectiveness
• provide more relevant advertisements
• analyse website conversions

Where used, marketing providers may include:

• Google Ads
• Meta (Facebook and Instagram) Pixel and Conversions API

18.3 Cookie Consent

Where legally required, we will request your consent before placing non-essential cookies on your device.

You can change your cookie preferences at any time through your browser settings or our cookie management tools.

19. Third-Party Websites

19.1 Our website may contain links to third-party websites.

We are not responsible for the content, security or privacy practices of those websites.

19.2 We recommend reviewing the privacy policies of any third-party websites before providing personal information.

20. Your Data Protection Rights

Under UK data protection legislation, you may have the following rights.

20.1 Right of Access

You may request a copy of the personal information we hold about you.

20.2 Right to Rectification

You may request correction of inaccurate or incomplete personal information.

20.3 Right to Erasure

You may request that we delete your personal information where:

• it is no longer necessary;
• you successfully object to processing;
• processing is unlawful;
• deletion is required by law.

Certain legal obligations may prevent immediate deletion.

20.4 Right to Restrict Processing

You may ask us to temporarily restrict processing in certain circumstances.

20.5 Right to Object

You may object to processing based upon our legitimate interests.

Where your objection relates to direct marketing, we will stop processing for that purpose immediately.

20.6 Right to Data Portability

Where applicable, you may request your personal information in a structured, commonly used and machine-readable format.

20.7 Right to Withdraw Consent

Where processing is based upon consent, you may withdraw that consent at any time.

Withdrawal does not affect processing carried out before consent was withdrawn.

20.8 Automated Decision Making

Company Assist does not make decisions that produce legal or similarly significant effects based solely on automated processing without appropriate human involvement.

21. Exercising Your Rights

21.1 If you wish to exercise any of your rights, please contact us using the details below.

21.2 We may ask for proof of identity before responding to your request.

This helps protect your personal information from unauthorised disclosure.

21.3 We will normally respond within one month, although complex requests may require additional time where permitted by law.

21.4 Requests are generally free of charge.

However, we reserve the right to charge a reasonable fee or refuse requests that are manifestly unfounded, excessive or repetitive, as permitted by UK GDPR.

22. Contact Details

For questions regarding this Privacy Policy or your personal information, please contact:

23. Complaints

23.1 If you are unhappy with how we have handled your personal information, we encourage you to contact us first so that we can investigate and resolve your concerns promptly.

23.2 You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority responsible for data protection.

Further information is available from the ICO website:

24. Changes to this Privacy Policy

24.1 We may update this Privacy Policy from time to time to reflect changes in:

• legislation;
• regulatory guidance;
• technology;
• our services;
• our business operations.

24.2 The latest version will always be published on our website together with the date it was last updated.

24.3 Where required by law, we will notify users of significant changes before those changes take effect.

25. Contacting Company Assist

If you have any questions regarding this Privacy Policy or our handling of personal information, please contact us using the details provided above.

We are committed to handling all enquiries fairly, transparently and in accordance with applicable data protection legislation.

Document Information