Privacy Policy

1. Who We Are and Data Controller Information

This website (https://haandco.uk) is operated by H A & CO ACCOUNTANTS LTD, trading as HA & CO. We are registered in England and Wales under company number 11177488, with our registered office at Regal Court Business Centre, 42-44 High Street, Slough, England, SL1 1EL.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, H A & CO ACCOUNTANTS LTD acts as the data controller responsible for the personal information processed through this website and initial enquiries.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details below:

• Email: [email protected]
• Telephone: 020 8288 1525
• Registered Office: Regal Court Business Centre, 42-44 High Street, Slough, England, SL1 1EL
• Chessington Branch: 100 Gilders Road, Chessington, KT9 2AN
• Slough Branch: Regal Court Business Centre, 42 High Street, Slough, SL1 1EL

2. Scope of This Privacy Notice

This notice applies specifically to personal data collected when you visit our website, use our online contact form, or communicate with us by email or telephone regarding website enquiries. It describes what information is processed, how it is used, our lawful bases under UK GDPR, and your data protection rights.

Please note that when you become a client of HA & CO, engagement-specific records and ongoing professional services may be governed by separate professional terms of business and statutory client privacy notices provided during onboarding.

3. Personal Information We Collect

We process personal information that you voluntarily provide when contacting our firm or interacting with the website:

• Contact Form Data: Information submitted via our website contact form, consisting of your name, email address, optional telephone number, subject, and message content.
• Direct Communications: Information supplied when you contact us directly by email, telephone, post, or in person.
• Privacy Acknowledgement: Records confirming your acknowledgement of this Privacy Policy when submitting an enquiry.
• Infrastructure Security Logs: Our web hosting and security infrastructure (Cloudflare) automatically processes temporary technical logs (such as IP address, user agent, and request headers) at the network edge solely to deliver web pages securely, maintain server performance, and prevent malicious attacks or spam. HA & CO does not store or aggregate visitor IP addresses for tracking or profiling purposes.

4. How and Why We Use Your Personal Data

We process your personal information for specific, transparent business purposes:

• Responding to Enquiries: To review and answer your service enquiries, fee requests, or general questions.
• Pre-contractual Steps: To evaluate potential client relationships and provide quotes or consultation information upon request.
• Service Delivery: To deliver requested professional accountancy and tax services when a formal engagement is established.
• Website Security & Infrastructure: To maintain the security, performance, and integrity of our website and protect against cyber threats or spam.
• Regulatory & Legal Obligations: To comply with statutory accounting, anti-money laundering, tax, or legal requirements where applicable.

5. Lawful Bases for Processing (UK GDPR)

Under UK GDPR, we rely on the following lawful bases to process your personal data:

• Pre-contractual Steps / Contract Performance (Article 6(1)(b)): Where processing is necessary to take steps at your request prior to entering into a contract or to perform a service contract.
• Legitimate Interests (Article 6(1)(f)): Where processing is necessary for our legitimate business interests, such as handling customer enquiries efficiently, maintaining network and information security, and managing business operations, provided these interests do not override your rights.
• Legal Obligation (Article 6(1)(c)): Where processing is required to comply with UK statutory regulations or statutory reporting obligations.
• Consent (Article 6(1)(a)): Where you have given specific, explicit consent for optional processing activities. (Note: We do not currently operate general marketing mailing lists).

6. Contact Form Acknowledgement Notice

When submitting our website contact form, you are required to check a box stating: "I have read the Privacy Policy and understand how my information will be used to respond to my enquiry."

This checkbox serves as confirmation that you have been informed of how your data will be handled. It is not an opt-in for marketing, newsletter subscriptions, or third-party promotional emails. We do not use contact form submissions to send unsolicited marketing communications.

7. How We Receive Information

Personal data is received directly from you through:

• Our online website contact form at https://haandco.uk/contact/
• Direct email correspondence sent to our firm
• Telephone calls to our office branches
• Written postal correspondence or in-person consultations

8. Service Providers and Data Processors

To operate our website and manage digital communications securely, we share data with trusted third-party technology providers acting as data processors under contract:

• Cloudflare Inc.: Provides web hosting, content delivery network (CDN) distribution, SSL/TLS encryption, and edge security filtering.
• Resend: Transmits contact form submissions securely via API to our staff email inboxes.
• IT & Email Infrastructure Providers: Managed IT, cloud storage, and email system providers used to receive and store business correspondence.

All data processors are bound by data processing agreements ensuring appropriate technical and organisational security measures.

9. Information Sharing and Disclosure

We respect your privacy and never sell, rent, or trade your personal information to third parties for marketing purposes.

We disclose personal data only in the following limited circumstances:

• To our technical service providers necessary to operate our website and email communications.
• Where required by law, court order, law enforcement, or regulatory bodies (such as HMRC or professional accountancy bodies).
• To protect the rights, property, or safety of HA & CO, our clients, or the public.

10. International Data Transfers

Some service providers may process information in countries outside the United Kingdom. Where a restricted international transfer occurs, HA & CO will take steps required by applicable UK data-protection law. You may contact us for more information about the safeguards relevant to your information.

11. Data Retention Policy

We retain personal information only for as long as reasonably necessary to fulfill the purposes for which it was collected, taking into account:

• The purpose for which the information was collected and whether an enquiry develops into a formal engagement;
• Our contractual, professional, and ethical obligations as accountants;
• Applicable statutory, legal, tax, and regulatory record-keeping requirements;
• The establishment, exercise, or defence of legal claims; and
• Ongoing network security and operational record-keeping needs.

Where an enquiry leads to a formal professional client engagement, engagement-specific records are governed by separate professional and statutory requirements provided during onboarding.

12. Data Security

We implement appropriate technical and organisational measures to safeguard your personal data against accidental loss, unauthorized access, alteration, or disclosure. All web traffic between your browser and our server is encrypted using HTTPS/TLS. Access to personal data is restricted to authorised personnel and service providers operating under strict confidentiality obligations.

13. Your Data Protection Rights

Under UK data protection law, you have several rights regarding your personal information:

• Right to be Informed: To receive clear, transparent information about how your data is processed.
• Right of Access: To request a copy of the personal information we hold about you (Subject Access Request).
• Right to Rectification: To ask us to correct inaccurate or incomplete data.
• Right to Erasure: To request the deletion of your personal data where there is no legal reason for its continued storage.
• Right to Restrict Processing: To ask us to block or suppress the processing of your personal data under certain conditions.
• Right to Object: To object to processing based on legitimate interests.
• Right to Data Portability: To request the transfer of your data to another organization where technically feasible.

Please note that these rights are not absolute and may be subject to legal exemptions or statutory record-keeping duties. To exercise any of these rights, please email us at [email protected].

14. Right to Complain to the ICO

If you have concerns about how we handle your personal data, we encourage you to contact us first so we can resolve the issue. You also have the right to lodge a complaint with the UK data protection supervisory authority:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

15. Cookies and Similar Technologies

We believe in simple, privacy-friendly web design. HA & CO does not set non-essential cookies, tracking scripts, advertising pixels, or analytics tags on this website.

Strictly necessary technical cookies or security headers may be utilised by our web host and edge security infrastructure (Cloudflare) solely to ensure website availability, prevent denial-of-service attacks, and maintain network security. Because no non-essential cookies are used, this website does not display an intrusive cookie consent banner.

16. Children's Privacy

Our website is designed for business owners and adult users seeking professional accountancy services. We do not knowingly collect or solicit personal information from individuals under the age of 13.

17. External Web Links

Our website contains links to external websites (such as government portals, software platforms, or regulatory resources). This Privacy Policy applies solely to https://haandco.uk. We are not responsible for the privacy practices, content, or security of external websites.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices or statutory regulations. Any updates will be published on this page with a revised "Last updated" date.

19. Contact Us

If you have any questions, comments, or data protection requests, please reach out to us: