Privacy Policy
Last updated: 27th September 2026
This policy explains how ClearSum Accounting Ltd uses personal data relating to website visitors, prospective clients, clients and people connected with client organisations.
1. Who is responsible for your data
ClearSum Accounting Ltd is the data controller for the personal data covered by this policy. We are registered in England and Wales under company number 15643082. Our registered office is Knoll Business Centre, Old Shoreham Road, Hove, East Sussex, England, BN3 7GS.
Our privacy contact is Harry Whittington. For privacy questions or requests, email privacy@clearsum.co.uk.
When we process information about a client’s employees or other individuals solely on that client’s instructions (for example, to run payroll) we may act as the client’s data processor instead.
2. What we collect
Depending on our relationship with you, we may collect:
- identity and contact details, including name, address, email, telephone number, date of birth and identity documents;
- business, employment, accounting, tax, payroll, pension and financial information, including bank details and tax or National Insurance identifiers;
- information needed for anti-money laundering checks, including sanctions, politically exposed person and adverse-media screening results;
- health information where relevant to payroll or statutory leave, such as sickness, maternity or disability information;
- communications, meeting notes and, where notified in advance, meeting recordings and transcripts;
- website and device information, including IP-derived location, browser or device data, pages viewed, clicks and scrolling, where you consent to analytics; and
- any other information you choose to give us or that is reasonably needed to provide our services.
3. Where information comes from
We obtain information from you, from people in your organisation, from your previous advisers, from HMRC and other public bodies, from public registers such as Companies House, from banks and software providers you authorise, and from identity and anti-money laundering screening providers.
4. Why we use it and our lawful bases
Purpose | Main lawful basis |
Responding to enquiries, arranging calls and taking steps before engagement | Legitimate interests; steps at your request before a contract |
Providing accounting, tax, payroll, pension and related professional services | Contract; legitimate interests |
Identity, anti-money laundering, tax and other regulatory duties | Legal obligation; substantial public interest where special-category data is involved |
Managing our practice, records, security, quality, complaints and legal claims | Legitimate interests; legal obligation; establishment, exercise or defence of legal claims where needed |
Website analytics and heatmaps | Consent |
| Sending a LinkedIn newsletter or other direct marketing | Consent or legitimate interests, depending on the communication and recipient; you can opt out at any time |
Where we rely on legitimate interests, those interests are operating and improving our practice, communicating with business contacts, protecting our systems and rights, and delivering an efficient professional service. We balance those interests against your rights.
We use health and other special-category information only where necessary and where an additional legal condition applies, such as employment and social-protection law, substantial public interest or legal claims.
5. Who we share information with
We share personal data only where needed for our services, legal duties or business operations. Current service providers include Zoho Sites, Bookings and PageSense; Microsoft 365; Xero and Hubdoc; BrightPay and NEST; Adfin; Xama Hub; Client Engager; BrightAccounts/BrightAP and BrightTax; Fireflies.ai; and ChatGPT Business. Their purposes include website hosting and bookings, communications, accounting, tax, payroll, pensions, payments, identity checks, practice management, meeting transcription and AI-assisted work.
We may also share information with HMRC, Companies House, CIMA as our professional body and anti-money laundering supervisor, other regulators or law-enforcement bodies, professional advisers, insurers, subcontractors bound by confidentiality, and any buyer or successor to our business where lawful. We do not sell personal data.
6. International transfers
Some suppliers or their subprocessors may process data outside the UK, including in the EEA and the United States. Where required, we use an approved safeguard such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses. You can ask the Data Protection Officer for more information about the safeguard used.
7. AI and meeting recording
We may use approved business-grade artificial intelligence tools, such as ChatGPT Business, to assist with professional work. Where necessary, relevant client information may be processed in accordance with this policy and our professional confidentiality obligations. We minimise the information used, restrict access and use a business account configured so that business data is not used to train the provider’s models by default. All AI-assisted work is reviewed by a suitably qualified person. We do not use AI to make solely automated decisions with legal or similarly significant effects. Clients may opt out; see our AI Usage Statement.
We may use a meeting recording and transcription service. We tell participants in advance, and they may decline recording.
8. How long we keep information
We normally keep client accounting, tax and correspondence records, and meeting recordings and transcripts, throughout the relationship and for six years after it ends. We keep anti-money laundering records for five years after the relationship ends, then delete them unless a permitted reason requires or allows longer retention. Unsuccessful enquiries are normally kept for 12 months after last contact. Website analytics and cookie data follow our Cookie Policy and provider settings.
We may keep a record longer where reasonably required for an HMRC enquiry, litigation, a complaint, insurance, another legal or regulatory requirement, or to establish, exercise or defend legal claims.
9. Security
We use proportionate technical and organisational safeguards, including access controls, business-grade cloud services, encryption where supported, staff confidentiality and review of suppliers. No system is completely secure, but we work to prevent unauthorised access, loss, alteration or disclosure.
10. Your rights
Depending on the circumstances, you may ask for access to or correction of your personal data; deletion or restriction; transfer of data you provided; or withdrawal of consent. You may object to processing based on legitimate interests and you have an absolute right to object to direct marketing. Withdrawing consent does not affect earlier lawful processing.
To exercise a right, email privacy@clearsum.co.uk. We may need to confirm your identity and may refuse or charge for a request only where the law permits.
11. Complaints
Please send a data protection complaint to privacy@clearsum.co.uk. We will acknowledge it within 30 days, investigate it appropriately, keep you informed where necessary and provide an outcome without undue delay.
You may also complain to the UK Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.
12. Information we need and changes
Some information is required by law or to enter into or perform our engagement. If it is not provided, we may be unable to act. We may update this policy when our services, systems or legal obligations change. The latest version will be published on the website with its update date.
