Privacy Notice

1. Purpose of this notice

This notice explains what personal data we collect about you, what we do with it, who we share it with, and what rights you have over it. It applies to clients, people who approach us about becoming clients, people connected to our clients, our suppliers and subcontractors, and visitors to this website.

We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, and the other UK legislation that implements and sits alongside them, as amended from time to time.

Please read it. If anything in it is unclear, ask us.

2. About us

Saymur Accountants is a firm of chartered accountants and tax advisers in Harrow, registered to carry on audit work and regulated for a range of investment business activities by the Institute of Chartered Accountants in England and Wales. We are registered in England and Wales under company number 05157991 and our registered office is at Metroline House 4th Floor, 118-122 College Road, Harrow, HA1 1BQ.

For the purposes of data protection law we are the data controller. That means we are responsible for deciding how your personal data is held and used, and the law requires us to tell you what is in this notice.

We are not required to appoint a Data Protection Officer and have not appointed one. Responsibility for data protection rests with Abbas Gulamhusein, who is our point of contact for anything in this notice or for any question about how we handle your personal data. His contact details are in section 14.

Where we act as a processor on behalf of someone else who is the controller, when we run a payroll for example, we provide a separate schedule as part of that agreement. That schedule should be read alongside this notice.

3. How we collect your personal data

We obtain personal data about you when:

• you ask us for a proposal for our services;
• you engage us, and throughout the work we then do for you;
• you contact us by email, telephone, post or through this website;
• a client we act for gives us your details because your affairs are connected to theirs, as a shareholder, director, employee, beneficiary or family member for instance; or
• we obtain it from third parties or public sources, such as HMRC, Companies House, the Land Registry, your other professional advisers, or the checks we are required to carry out under the money laundering regulations.

If you are connected to a client rather than a client yourself, we will usually have been given your details by that client rather than by you.

4. The information we hold about you

What we hold depends on the work we do for you. It may include:

• your personal details, such as your name, address, email address and telephone numbers;
• identification documents and evidence of address, which we are required to obtain and keep under the money laundering regulations;
• your unique taxpayer reference, national insurance number and VAT registration number;
• your bank details, for collecting our fees and for HMRC repayments;
• details of your income, assets and liabilities, and the records behind them;
• information about your residence, domicile and connections to other countries, where that is relevant to your tax position;
• payroll information, including information about your employees where we run a payroll for you;
• a record of our contact with you about the services we provide or have been asked to provide;
• details of the services you have received from us, and our correspondence and communications with you;
• information about any complaint or enquiry you make to us; and
• information from public sources, such as Companies House and HMRC.

We do not normally need special category data, meaning information about health, religious or philosophical beliefs, or similar. Where a piece of work does require it, a claim that turns on a health condition for example, we process it with your explicit consent or because it is necessary in connection with legal claims.

5. How we use your personal data

Most of what we do with your personal data rests on performing our contract with you, or with the client whose affairs yours are connected to, and on complying with the legal and professional obligations we are subject to.

What is our lawful basis?

We rely on one or more of the following:

• the processing is necessary to take pre-contractual steps at your request;
• the processing is necessary for the performance of our contract with you or with our client;
• the processing is necessary for compliance with legal obligations we are subject to, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 in particular;
• the processing is necessary for our legitimate interests or those of others, provided those interests do not override your own interests, rights and freedoms; or
• you have consented.

We may rely on more than one basis at a time, depending on what we are using the data for.

What do we use it for?

We use your personal data to:

• carry out our obligations under the engagement between us, which will usually be the provision of our services;
• meet our obligations under the money laundering regulations and the professional obligations we are subject to as an ICAEW member firm;
• invoice for our services and deal with any fee dispute that arises;
• investigate or defend complaints, disciplinary proceedings and legal proceedings;
• tell you about changes to our services; and
• send you accounting and tax information relevant to you, where you have agreed to receive it.

If you have agreed to receive those updates, you can stop them at any time by unsubscribing or by telling us.

Where we can do the job without identifying you, we may anonymise the data so that it can no longer be associated with you, in which case we may use it without further notice to you.

If you decline to give us information we have asked for, we may not be able to perform our contract, or to comply with a legal or regulatory obligation. If that happens we will either not be able to start acting or will have to stop acting.

We may also process your personal data without your knowledge or consent where the law requires or permits it.

Change of purpose

If we need to use your personal data for a reason other than the one we collected it for, we will do so only where the new reason is compatible with the original one. If it is not, we will tell you and explain the legal basis for the new use before we start.

Automated decision-making

We do not use automated decision-making in relation to your personal data.

6. How long we keep your personal data

We keep personal data only for as long as we need it for the purpose we collected it for, and for as long as the law and our professional obligations require.

If you are not a client

If you contacted us and nothing came of it, we keep your details for a year after we last heard from you. If you ask to come off our mailing list, we may keep enough of your details on a suppression list to make sure we do not contact you again.

If you are or were a client

Where we have prepared tax returns, we keep the information for seven years from the end of the tax year it relates to. Where we have carried out one-off advisory work, we keep it for seven years from the date the business relationship ended.

Where the relationship is ongoing, information needed for more than one year of compliance, capital gains base costs and claims and elections submitted to HMRC for instance, is kept throughout the relationship and deleted seven years after it ends, unless you ask us to keep it longer or there is some other legal hold on it.

Our standard terms of business provide for the destruction of documents after seven years, so agreement to those terms is agreement both to the retention and to the destruction.

Your own records

You are responsible for keeping the information we send you, and your own retention obligations are separate from ours. Broadly, individuals and partnerships with trading or rental income must keep records for five years and ten months after the end of the tax year, individuals and partnerships without that income for 22 months after the end of the tax year, and companies, LLPs and other corporate entities for six years from the end of the accounting period.

Where we act as a processor, we delete or return all personal data to the controller as agreed with them at the end of the contract.

7. Data sharing

Why might you share my personal data?

We share personal data where the law requires it, where it is necessary to run the relationship between us, or where we have another legitimate interest in doing so.

Who do you share it with?

• Your other professional advisers, your insurers, and anyone else you engage or ask us to correspond with.
• HM Revenue and Customs, Companies House and other government bodies we deal with on your behalf.
• Our IT and software providers, who host and maintain the systems we work in.
• Subcontractors we use to deliver part of our services.
• Our professional indemnity insurers, their lawyers and their advisers, and any tax fee protection insurer.
• The ICAEW, and the Office for Professional Body Anti-Money Laundering Supervision, in connection with practice assurance and the money laundering regulations.
• An alternate appointed by us in the event of incapacity or death.
• Your spouse, civil partner or business partner, where their affairs and yours are dealt with together.
• Fraud prevention agencies and others, where we are carrying out checks we are required to make.
• The police, law enforcement, other government agencies, courts and tribunals, and the Information Commissioner's Office, where the law allows or requires it.

Where the tax rules oblige us to collect information about where you are resident for tax purposes, we may have to pass information about you to the relevant authority, who may in turn pass it to the tax authorities of other countries.

We will never sell or lend your information to anyone.

If you ask us not to share your personal data with the third parties above, we may have to stop acting for you.

8. Transferring personal data outside the UK

We use cloud based systems to run the practice, including Xero and TaxCalc. This list is not exhaustive. If you want the full picture, ask us.

Our own records and the main systems we use sit in the UK or the EEA. There are occasions when we, or a supplier of ours, use a service that holds information elsewhere.

Where that happens we use established suppliers who have been through information security due diligence, whose contracts commit them to a defined standard of data processing, and whose transfer arrangements meet the legal requirements, including the standard contractual clauses and the International Data Transfer Addendum issued by the Information Commissioner. The aim is that your information is protected to the same standard as if it had stayed in the UK.

9. Data security

We have appropriate security measures in place to stop your personal data being lost, altered, disclosed, or used or accessed without authorisation.

Access is limited to the people who need it to do the work: our staff, our subcontractors, and the third parties described in section 7. They process your data on our instructions and are under a duty of confidentiality.

We have procedures for dealing with a suspected breach, and we will notify you and the Information Commissioner where the law requires us to.

10. How we use artificial intelligence

In providing our services we may use artificial intelligence tools as part of our normal working practices, including large language models and AI-assisted software. This may apply to any aspect of the work we carry out.

AI supports our work. It does not replace our professional judgement. Everything AI has helped produce is reviewed by a suitably qualified member of our team before it is relied on, sent to a client, or submitted to HMRC or anyone else. We remain fully responsible for the work we do.

What do you put into these tools?

To carry out client work we may input information about a client and their affairs, including personal and financial information. That information is processed on infrastructure operated by the AI provider, which we do not own or control, and which may sit outside the United Kingdom.

We only use AI tools supplied on a business or enterprise basis, under a data processing agreement that makes us the controller and the provider our processor, and whose terms confirm that client data is not used to train or improve the provider's models. We do not use free or personal-tier AI services for work involving client data.

Where data is transferred outside the United Kingdom, that transfer is covered by the safeguards described in section 8.

What about confidentiality?

Putting client data into an AI tool means disclosing it to the provider, who processes it on our behalf. Clients authorise that disclosure, for the purpose of delivering our services, by accepting our engagement terms. Our duty of confidentiality continues to apply to everything we hold, and the provider is bound by equivalent obligations under our agreement with it.

How do you manage the risk?

We review a provider's terms and data processing agreement before we adopt any tool for client work, and at intervals afterwards. We limit what we input to what the task reasonably requires, and we anonymise or redact identifying details where it is practical to do so. We keep a record of the tools we have approved and the basis on which each is used.

We rely on the provider's published terms and contractual commitments for how it handles data. We cannot independently monitor a provider's internal practices, and we cannot guarantee that a provider will always act in line with its stated policies.

What risks remain?

Some risk cannot be removed entirely.

A provider could fail to follow its own policies, could change them, or could suffer a data breach. The security of data held by a third-party provider is ultimately outside our control.

Data may be processed outside the United Kingdom, where data protection law may differ from UK law, although we use the safeguards described above.

AI can produce output that is inaccurate or incomplete. We manage that through professional review, but no review removes every risk.

Liability

We are not liable for loss arising from the acts, omissions, data handling, security failures or policy changes of a third-party AI provider, or from unauthorised access to data held by such a provider, provided we have taken reasonable care in selecting and using the tool and have followed the safeguards set out here.

Our liability for the use of AI is otherwise subject to the limits set out in the engagement letter and our standard terms and conditions of business.

Nothing here excludes or limits our liability for fraud, for death or personal injury caused by our negligence, or for anything else that cannot be excluded or limited by law. Nothing here limits your rights under data protection law.

Can I opt out?

Yes. If you do not want us to use AI tools in your work, tell us in writing before we begin. Opting out may affect the scope, timing and cost of our services.

We may adopt new AI tools or stop using existing ones. Where a change materially affects how client data is processed, we will take reasonable steps to say so.

11. Your rights

Your duty to tell us about changes

The personal data we hold about you needs to be accurate and current. If your details change, tell us, using the contact details in section 14.

What rights do I have?

In certain circumstances the law gives you the right to:

• ask for access to your personal data, so that you can receive a copy of what we hold and check that we are processing it lawfully;
• ask us to correct personal data that is wrong, and to complete personal data that is incomplete;
• ask us to erase your personal data, where there is no good reason for us to carry on processing it, or where you have objected to the processing;
• object to the processing where we are relying on a legitimate interest and there is something about your situation that makes you want to object, and to object at any time where we are processing your data for direct marketing;
• ask us to restrict the processing, suspending it while the accuracy or the reason for it is established, for example; and
• ask us to transfer your personal data to you or to another controller, where the processing is based on consent, is automated, and the transfer is technically feasible.

How do I exercise them?

Email or write to Abbas Gulamhusein, using the details in section 14. Requests for access should be in writing.

To help us find the right information and deal with the request quickly, tell us your date of birth, any other names you have used, your addresses over the past five years, any reference that identifies you, such as your national insurance number, tax reference or VAT registration number, and what you are looking for. If you do not have a national insurance number, send a copy of your passport or driving licence with a recent utility bill.

We may need to ask for further information to confirm who you are. That is a security measure, to make sure personal data is not disclosed to someone with no right to it.

We will respond promptly and in any event within one month. We can extend that by a further two months where the request is complex or where we receive several at once, but we will tell you within the first month if we are doing so and why.

There is no fee. We may charge a reasonable fee, or refuse the request, where it is clearly unfounded or excessive, for instance where you have made a similar request recently and little has changed since we answered it.

You can ask someone else to make the request for you, a friend, a relative or a solicitor. We need your authority first, which you can give by signing a letter authorising that person to write to us about you and to receive our reply.

Where you are a controller and we act as your processor, on a payroll for example, we will help you with these requests on the same basis.

Withdrawing your consent

Where you have consented to our processing of your personal data for a particular purpose, you can withdraw that consent at any time. Tell us and we will act on it.

Withdrawing consent does not affect the lawfulness of processing that has already happened. If you withdraw it we may not be able to carry on providing services to you. And it may still be lawful for us to process your data on a different basis, because we have a legal obligation to keep it for example.

12. Visitors to this website

If you fill in an enquiry form or email us through this site, we use the details you give to respond and to decide whether we are able to act for you. If nothing comes of it, we delete the enquiry after 12 months.

This notice also covers our specialist sites at tax.saymur.co.uk, pharmacy.saymur.co.uk and carehomes.saymur.co.uk.

Our sites use cookies that are strictly necessary for them to work, which do not need your consent.

With your consent, we also use Google Analytics cookies to understand how visitors use our sites, such as which pages are visited and how people find us. These cookies are only set if you accept them through our cookie banner, and you can change your choice at any time using the Cookie settings link at the bottom of each page. Google may process this information outside the United Kingdom, under the safeguards described in section 8. We do not use advertising cookies.

13. Changes to this notice

We may amend this notice from time to time. Any changes will be published on this page at www.saymur.co.uk, and the version on this page is always the current one. Clients will be sent a copy of any amended version.

This notice was last updated on 3 November 2026.

14. Contact us

If you have a question about this notice, or about the way we process your personal data, contact Abbas Gulamhusein at info@saymur.co.uk, or write to us at Metroline House 4th Floor, 118-122 College Road, Harrow, HA1 1BQ.

If you have asked us for something and you are not satisfied with our response, or you think we have not complied with the UK GDPR or the Data Protection Act 2018 in some other way, tell us and we will look at it.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at any time. Their details are:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Telephone 0303 123 1113

Website https://ico.org.uk/concerns