Introduction

The Data Protection Act 2018 (“DPA 2018”) and the UK General Data Protection Regulation (“UK GDPR”) impose certain legal obligations in connection with the processing of personal data. Mavani Shah & Co is a data controller within the meaning of the UK GDPR and we process personal data in the course of providing our professional accountancy and advisory services.

Mavani Shah & Co respects your right to privacy. Please read this Privacy Notice carefully as it contains important information about how we collect, use, and protect your personal information. This notice should be read alongside our engagement letter, schedule of services, and standard terms and conditions.

The Information We Collect About You

When you engage with our firm — whether as a client, prospective client, event attendee, newsletter subscriber, or job applicant — we may collect some or all of the following personal information:

• Full name, date of birth, and national insurance number
• Postal address, email address, and telephone number
• Financial information relevant to the services you have instructed us to provide (e.g. income, tax records, company accounts, payroll data)
• Unique Tax Reference (UTR), VAT registration number, or Companies House registration number where applicable
• Identity verification documents required for anti-money laundering compliance (e.g. passport, driving licence, utility bills)
• Information submitted through our website contact or consultation forms
• IP addresses logged for website administration and security purposes
• CV and application details if you apply for a role or work placement with us

We do not collect sensitive personal data (such as information relating to health, ethnicity, religion, or criminal records) unless it is legally required as part of a specific engagement or the recruitment process.

Occasionally, we may receive information about you from third-party sources, such as HMRC or Companies House, which we will combine with data we already hold in order to fulfil our professional obligations.

The Purposes for Which We Process Your Personal Data

We process your personal data for the following purposes:

• To provide contracted professional accountancy and advisory services to you as our client
• To prepare and file tax returns, accounts, payroll, and VAT submissions on your behalf
• To comply with statutory and regulatory obligations, including the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“MLR 2017”)
• To comply with our professional obligations as a chartered accountancy firm
• To invoice you for our services and manage any fee-related queries or disputes
• To contact you about additional services we provide which may be of interest to you, where you have given consent
• To monitor and continually improve the quality of services we deliver
• To maintain accurate and up-to-date administrative records
• To manage and respond to any legal claims or regulatory investigations

Legal Bases for Processing Your Personal Data

Our processing of your personal data is based on one or more of the following legal grounds:

• Consent — where you have expressly agreed to us processing your data for a specific purpose
• Contractual necessity — where processing is required to fulfil our engagement agreement with you
• Legal obligation — where we are required by law to process your data (e.g. under MLR 2017 or HMRC requirements)
• Legitimate interests — where processing is necessary for legitimate business purposes, such as defending legal claims or maintaining the security of our systems, provided those interests are not overridden by your rights

Please note that providing us with the personal data we request is a requirement of our engagement. If you are unable or unwilling to provide such information, we may not be able to commence or continue acting for you.

Who We May Share Your Personal Data With

We treat your information with strict confidentiality. We may share your personal data only where necessary and in accordance with applicable law, including with the following parties:

• HM Revenue & Customs (HMRC)
• Companies House
• Third parties you have authorised us to correspond with on your behalf
• Professional indemnity insurers and tax insurance providers
• Subcontractors or specialist advisers assisting with specific aspects of your engagement
• Our professional regulatory body in connection with practice assurance reviews or anti-money laundering supervision
• A nominated alternate in the event of the incapacity or death of a key person at our firm

Where required by law, we may also share your data with:

• The police and law enforcement agencies
• Courts and tribunals
• The Information Commissioner’s Office (ICO)

If you ask us not to share your personal data with a party that we are legally obligated to report to, we may be required to cease acting for you.

How Long We Retain Your Personal Data

In accordance with recognised best practice within the accountancy sector, we retain records as follows:

• Where tax returns have been prepared: six years from the end of the relevant tax year
• Where ad hoc advisory work has been undertaken: six years from the date the business relationship ended
• Where an ongoing client relationship exists and data spans multiple years (e.g. capital gains base costs, elections submitted to HMRC): retained throughout the engagement, then deleted six years after the relationship ends, unless you request otherwise

You are responsible for retaining copies of documents we send to you. Under UK law, you are required to retain records as follows:

• Individuals, trustees and partnerships with trading or rental income: five years and ten months after the end of the tax year
• Individuals without trading or rental income: 22 months after the end of the tax year
• Companies, LLPs and other corporate entities: six years from the end of the accounting period

How We Protect Your Personal Data

We have implemented appropriate technical and organisational security measures to protect your personal data against loss, misuse, unauthorised access, alteration, or destruction. Our privacy and security policies are reviewed on a regular basis.

All team members at Mavani Shah & Co are bound by a confidentiality obligation, and access to personal data is restricted strictly to those who require it to carry out their professional duties.

Your Rights Under UK GDPR

Under UK data protection law, you have the following rights in relation to the personal data we hold about you:

To exercise any of the above rights, please contact us in writing using the details provided at the bottom of this notice. We may ask you to verify your identity before responding to your request.

Further information about your rights is available on the Information Commissioner’s Office website: www.ico.org.uk

Subject Access Requests (SARs)

To submit a Subject Access Request, please write to us at the address below. To help us locate the relevant information and verify your identity, please include:

• Your full name and date of birth
• Any previous names or addresses in the past five years
• Your national insurance number, UTR, or VAT registration number (where applicable)
• A description of the information you are requesting

If you do not have a national insurance number, please provide a copy of the relevant page of your passport or driving licence, along with a recent utility bill. We will not charge a fee for handling SARs and will respond within one calendar month of receipt.

If you wish to authorise a third party (such as a solicitor or family member) to submit a SAR on your behalf, please provide written confirmation of that authority.

Automated Decision-Making

We do not use automated decision-making or profiling in relation to your personal data in the course of delivering our services.

Cookies and Website Data

Our website may use cookies to improve your browsing experience and gather anonymised statistical data about how visitors use our site. IP addresses may be logged for security and administration purposes. No individual user is identifiable from IP data alone. You may adjust your cookie preferences using the settings available on our website.

Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in the law or our internal practices. Where we make material changes, we will notify you directly or publish an updated version on our website. The date at the bottom of this page indicates when the policy was last reviewed.

Complaints

If you believe we have not handled your personal data in accordance with the UK GDPR or DPA 2018, or if you are dissatisfied with our response to a request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

We would, however, welcome the opportunity to address your concerns directly before you approach the ICO. Please contact us in the first instance:

This Privacy Notice was last reviewed and updated in April 2026.