Who we are and what this policy covers

SUPREME CONSULTANTS LTD (company number 14000780), trading as Supreme Consultants, is the data controller for the personal data described here. Our registered office is T206 Titan House, Cardiff Bay Business Centre, Titan Road, Cardiff, CF24 5BS. This policy applies to the people we act for, the directors, employees and contacts connected to those businesses, anyone who enquires about our services, and anyone who visits our website. It takes effect from the last reviewed date shown above. We would recommend any business publishing a policy like this has it checked by a solicitor or compliance professional before it goes live.

What personal data we collect

The data falls into three groups depending on where it comes from.

Information you give us

Your name, email address, phone number, postal address and the details of your business. When you engage us, that extends to the records we need to do the work: bank statements, invoices, payroll and employee details, National Insurance and Unique Taxpayer Reference numbers, dividend and share information, and the identity documents we are required to take for anti money laundering checks. You may also send us data in emails, in meetings or through our booking form.

Information collected automatically

When you use our website we collect your IP address, browser and device type, the pages you look at, how long you stay and the site or search that sent you. This comes through cookies and similar technologies and is used to keep the site working and to understand which pages are useful. Our cookies policy sets out what is set, by whom, and how you can refuse the non-essential ones.

Information from third parties

We obtain data about you from Companies House, HMRC once we are authorised as your agent, and your previous accountant through professional clearance. Bookkeeping and payroll software, pension providers and banks feed us data where you have connected them. Identity verification and sanctions screening services supply the results of the checks we run on new clients and directors.

Why we process your data

Each type of processing rests on one of four lawful bases under Article 6 of UK GDPR.

To provide our services (Contract)

We process your data to do the work set out in your engagement letter: bookkeeping, VAT returns, payroll, year-end accounts, corporation tax, self assessment, company formations and advisory work. Without it we cannot prepare your figures, file on your behalf or answer your questions.

To meet our legal obligations (Legal obligation)

The Money Laundering Regulations 2017 require us to verify your identity and keep those records. Tax and company law requires us to submit returns and filings and to retain supporting evidence. Where HMRC opens an enquiry, we process the data needed to respond to it and keep the file.

To run and improve our business (Legitimate interests)

We rely on legitimate interests for internal administration, billing, record-keeping, securing our systems, measuring how the website performs, and sending existing clients information about services related to the ones we already provide. We weigh that interest against your rights, and you can object at any time.

Where you have agreed (Consent)

We rely on consent for marketing emails to people who are not yet clients and for non-essential cookies. You can withdraw it whenever you want by replying to any email, emailing info@supremeconsultants.co.uk or changing your cookie settings. Withdrawing consent does not affect processing carried out before you withdrew it.

Who we share your data with

We share data only where the work or the law requires it, and we do not sell it.

Personal data leaves us only where it is needed to deliver what you have engaged us for, to meet a statutory duty, or to run the systems we use. Every supplier who handles data on our behalf does so under a written contract that limits what they can do with it.

HMRC and Companies House

Once you authorise us as your agent, we submit VAT returns, payroll filings, corporation tax and self assessment returns to HMRC, and accounts, confirmation statements and director information to Companies House.

Software providers

We use cloud bookkeeping, payroll, document signing, email and file storage platforms, together with identity verification services. These providers host and process your data on our instructions and are not permitted to use it for their own purposes.

Professional advisers

Where your matter calls for it and you have asked us to, we share information with solicitors, tax specialists, independent financial advisers, insurers or your bank. We also pass records to a new accountant when you ask us to hand over.

Regulatory and legal authorities

The AAT may review our files as part of practice monitoring. We report suspicions to the National Crime Agency where the Money Laundering Regulations require it, and we disclose data to courts, the police or other authorities under a valid legal order.

Sending data outside the UK

Some of the software and hosting we use stores or backs up data outside the United Kingdom, usually in the European Economic Area or the United States. Where data goes to a country the UK Government has found to offer adequate protection, the adequacy decision covers it. Where it does not, we rely on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and we check what the supplier has in place before we use them. If you want to know where a particular system holds your data, email us and we will tell you.

How long we keep your data

Retention periods are driven by the law first and by practical need second.

Client records

We keep client files, including accounts, tax returns and supporting records, for at least six years after the end of the engagement. Identity and anti money laundering records are kept for five years from the end of the business relationship, as the Money Laundering Regulations require.

Enquiry and prospect data

If you enquire and we do not go on to work together, we hold your details for up to 24 months from the last contact so we can pick up the conversation if you come back. After that we delete the record or strip it of anything identifying.

Website analytics

Analytics data tied to a visitor is held for no more than 26 months and is then deleted or kept only in aggregate form, where nobody can be identified from it. Cookie lifespans vary by cookie and are set out in the cookies policy.

Marketing consent records

Where you have consented to marketing, we keep a record of that consent, and of any withdrawal, for as long as the consent is live and for two years afterwards. That record exists so we can show when and how permission was given.

Your rights over your data

These rights come from UK GDPR and you do not need a reason to use them. Some of them are qualified, which means there are situations where we can lawfully refuse, and we will explain it if that happens.

Right to be informed

You are entitled to know what we do with your data and why. This policy, together with your engagement letter and our cookies policy, is how we provide that information.

Right of access

You can ask for a copy of the personal data we hold about you and the reasons we hold it. Email us to make a subject access request. We respond within one month and there is no charge in ordinary cases.

Right to rectification

If something we hold about you is wrong or incomplete, tell us and we will correct it. Where we have passed that data to someone else, we will let them know about the correction where we can.

Right to erasure

You can ask us to delete your data. We cannot delete records we are legally required to keep, such as anti money laundering files and tax records, until those retention periods have run out.

Right to restrict processing

You can ask us to pause processing while a dispute about accuracy or lawful basis is sorted out. We will keep the data but stop using it, except for storage, legal claims or protecting someone else’s rights.

Right to data portability

Where we process data you gave us by consent or under contract, and we do it by automated means, you can ask for it in a structured, commonly used, machine-readable format, or ask us to send it to another provider.

Right to object

You can object to processing based on legitimate interests, and we will stop unless we have compelling grounds that override your rights. If you object to direct marketing, we stop immediately and with no exceptions.

Rights on automated decision-making

We do not make decisions about you by automated means alone and we do not carry out profiling that produces legal or similarly significant effects. A person reviews every judgement we make about your affairs.

How to exercise your rights

Email info@supremeconsultants.co.uk or write to us at Titan House, and say which right you are using and what you want. We may ask for identification before we release anything, which protects you as much as us. We reply within one month, and if the request is complex we will tell you within that month how much longer we need. There is no fee unless a request is manifestly unfounded or excessive, in which case we will explain the charge before doing the work.

How we protect your data

Your data travels to and from our website and portals over encrypted connections, and the cloud platforms we use encrypt it in storage. Access is limited to the people who need it to do their job, protected by individual logins and multi-factor authentication. Paper records at Titan House are kept locked away. Mudassir and Shaista brief the team on handling client data and on spotting phishing attempts, which remain the most common route into a small practice. We review our systems and suppliers regularly. If a breach happens that puts your rights at risk, we will report it to the ICO within 72 hours and tell you where the law requires it.

Cookies on this website

Our website uses cookies that are needed to make pages load and forms work, plus analytics cookies that tell us which pages people read. Non-essential cookies are only set once you agree, and you can change your mind at any point. The full list, including who sets each one and how long it lasts, is in our cookies policy at /cookies-policy/.

Data about children

Our services are for businesses and the people who run them, and the website is not aimed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their details, email info@supremeconsultants.co.uk and we will delete the record.

Changes to this policy

We update this policy when the law changes or when we change how we work. The last reviewed date at the top of the page always shows the current version. If a change materially affects how we handle your data, we will tell existing clients by email rather than relying on you to spot it here.

How to contact us about your data

One address handles every data question we get.

Send data protection queries, subject access requests and anything about this policy to the address below. We have not appointed a statutory Data Protection Officer because we are not required to. Mudassir Dehghani deals with these requests.

Data queries: info@supremeconsultants.co.uk We respond within one month, as UK GDPR requires. Data controller: SUPREME CONSULTANTS LTD, T206 Titan House, Cardiff Bay Business Centre, Titan Road, Cardiff, CF24 5BS. Companies House 14000780. ICO registration [ICO registration number — to be added].

Complaints to the ICO

If you are unhappy with how we have handled your data, tell us first and we will look into it. You also have the right to complain to the Information Commissioner’s Office at any time, and using us first does not affect that right. The ICO is at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can call 0303 123 1113 or make a complaint online at https://ico.org.uk/make-a-complaint/. The ICO will usually expect you to have raised it with us before they take it up.