About this policy

Nexus Tax and Accounting Solutions Ltd, company number 15540719, is the data controller for the personal data described here. We are registered in England and Wales and based in Stacey Bushes, Milton Keynes. The policy covers three groups: clients and their directors, employees and contacts; people who enquire about our services or take the quiz on this site; and anyone who visits nexustasl.co.uk. It takes effect from the last reviewed date shown above. If you engage us, the engagement letter sits alongside this policy and sets out the work we do for you.

What personal data we collect

The data we hold falls into three groups, depending on how it reaches us.

Information you give us

When you enquire, take the quiz, call or email, we collect your name, business name, email address, phone number and whatever you tell us about your company. When you become a client we also hold identification documents required by anti-money-laundering rules, bank and accounting records, payroll and pension data for your staff, National Insurance and UTR numbers, and the financial information needed to prepare accounts, VAT returns and tax returns.

Information collected automatically

When you visit the site, our hosting and analytics tools record your IP address, browser and device type, the pages you look at, the time of your visit and the site or search that sent you. Some of this is stored in cookies. Essential cookies keep the site working. Analytics and marketing cookies only run if you allow them. Our cookies policy sets out each one and how to change your choice.

Information from third parties

We receive data about you and your company from Companies House, HMRC, your previous accountant during professional clearance and handover, your bookkeeping and payroll software, your bank feeds where you connect them, and electronic identity verification services used for anti-money-laundering checks. We may also receive your details from someone who refers you to us. We check that data against what you tell us directly.

Why we process your data

Every use of your data rests on one of four lawful bases under UK GDPR.

To provide our services (Contract)

Most client work sits here. We use your data to run the set-up review, keep your books, file accounts, corporation tax returns, VAT returns, confirmation statements, payroll and the director’s self assessment, to forecast your tax bill and dividend position, and to answer your questions and invoice you.

To meet our legal obligations (Legal obligation)

We are required to verify client identity and keep those records under the Money Laundering Regulations 2017, to report suspicions where the law requires it, to retain accounting and tax records for statutory periods, and to respond to HMRC enquiries, court orders and lawful requests from our supervisory body.

To run and improve our business (Legitimate interests)

We use data to keep the site secure, understand which pages people read, keep internal records, manage debt and insurance matters, and send existing clients information about services related to work we already do for them. You can object to any of this, and we will stop unless we have a compelling reason to continue.

Where you have agreed (Consent)

Consent covers optional analytics and marketing cookies, and any marketing email we send to someone who is not already a client. Consent is a free choice and you can withdraw it at any time by emailing info@nexustasl.co.uk, using the unsubscribe link, or changing your cookie settings. Withdrawing it does not affect processing already carried out.

Who we share your data with

We do not sell your data and we do not pass it to third parties for their own marketing.

Your data is shared only where the work requires it, where the law requires it, or where you have asked us to share it. Every supplier who handles data on our behalf does so under a written agreement limiting what they can do with it.

HMRC and Companies House

We submit accounts, corporation tax returns, VAT returns, payroll submissions, confirmation statements and self assessment returns on your behalf. These filings contain personal and financial data, and we send only what the relevant return requires.

Software providers

We use cloud accounting, bookkeeping, payroll, document signing, email and file storage platforms, together with the company hosting this website. Your data sits on their systems so we can do the work. They act on our instructions under contract.

Professional advisers

Where a matter needs it, and normally after telling you, we may share data with solicitors, tax specialists, insurers, our own professional indemnity insurer, or a successor accountant during handover. We share the minimum needed for that purpose.

Regulatory and legal authorities

We may share data with the Association of Accounting Technicians as our supervisory body, the National Crime Agency where money laundering rules require a report, and law enforcement or courts where we are legally obliged to respond.

International data transfers

Some of the software and hosting we rely on stores or processes data outside the United Kingdom, including in the European Economic Area and the United States. Where data goes to a country the UK has recognised as providing adequate protection, that decision covers the transfer. Where it does not, we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted under UK GDPR. You can ask us which suppliers hold data outside the UK and what safeguard applies.

How long we keep your data

Retention is set by the type of record and by the legal minimum that applies to it.

Client records

Accounting records, tax filings and correspondence are kept for at least six years after the end of the engagement, and in practice up to seven years to cover HMRC enquiry windows. Identity and anti-money-laundering records are kept for five years after the relationship ends.

Enquiry and prospect data

If you enquire or take the quiz and do not become a client, we keep your details for up to 24 months from your last contact with us. After that we delete them or strip out anything that identifies you, keeping only anonymous figures.

Website analytics

Analytics data linked to a visit is retained for up to 26 months, in line with standard settings on the tools we use. After that it is deleted or held only in aggregate form, which cannot be traced back to an individual visitor.

Marketing consent records

Where you have consented to marketing, we keep a record of what you agreed to and when for as long as the consent is active, and for two years afterwards. That record exists so we can show our permission to contact you was valid.

Your rights over your data

These are statutory rights under UK GDPR and they apply whether you are a client, a past client or a visitor to this site. Some of them are qualified, and we will tell you plainly if an exception applies to your request.

Right to be informed

You are entitled to know what we collect, why, who sees it and how long we keep it. That is what this policy sets out. Ask us if anything here is unclear and we will explain it.

Right of access

You can make a subject access request and receive a copy of the personal data we hold about you, together with an explanation of how we use it. Email info@nexustasl.co.uk and we will respond within one month.

Right to rectification

If anything we hold about you is wrong or incomplete, tell us and we will correct it. Where we have passed that data to someone else, we will let them know about the correction where we can.

Right to erasure

You can ask us to delete your data. We will do so unless we are required to keep it, which applies to accounting, tax and anti-money-laundering records for their statutory retention periods. We will tell you what we have kept and why.

Right to restrict processing

You can ask us to pause our use of your data while a dispute about its accuracy or our lawful basis is resolved. We will store it during that time and not otherwise use it, except where the law requires.

Right to data portability

Where we process data you gave us by consent or under our contract, and we do so by automated means, you can ask for it in a common machine-readable format, or ask us to send it to another provider.

Right to object

You can object to processing based on our legitimate interests, and you can object to direct marketing at any time. If you object to marketing, we stop immediately. For other objections, we stop unless there is a compelling legal reason to continue.

Rights related to automated decision-making

We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects. The quiz on this site guides a conversation with Nasir, who reviews every result himself.

How to exercise your rights

Email info@nexustasl.co.uk or write to us at the address below, saying what you want and which right you are using. We will reply within one month, and will tell you if a complex request needs longer, up to a further two months. We may ask for identification before releasing data, which protects you as much as us. There is no charge, unless a request is clearly excessive or repetitive, in which case we will explain any fee before doing the work.

How we protect your data

Data sent to and from this website travels over an encrypted HTTPS connection, and the cloud platforms we use encrypt data at rest. Access is limited to people who need it for the work: Nexus is a small practice, so in most cases that means Nasir alone. Accounts are protected by strong passwords and multi-factor authentication where the software supports it. Devices are kept updated and locked. Paper records are kept secure and destroyed confidentially. We review our suppliers and our own arrangements regularly. If a breach happens that risks your rights, we will report it to the ICO within 72 hours and tell you where the law requires it.

Cookies on this site

This site uses essential cookies to keep pages working and forms secure. With your permission, it also uses analytics cookies so we can see which pages people read. You can accept or refuse the optional ones and change your mind later. Our cookies policy at /cookies-policy/ lists each cookie and its purpose.

Children and this service

Nexus works with established limited companies and their directors. The site and our services are aimed at adults running businesses, and we do not knowingly collect personal data from anyone under 18. If you believe a child’s data has reached us, email info@nexustasl.co.uk and we will delete it.

Changes to this policy

We update this policy when our software, suppliers or legal obligations change. The last reviewed date at the top always shows the current version. Where a change materially affects how we handle client data, we will tell existing clients by email rather than relying on you to check the page.

How to contact us

Data questions come to Nasir directly.

There is no separate data protection officer at a practice this size, so anything about your personal data goes straight to Nasir Rasheed. Put your request in writing so there is a clear record of what you asked and when.

Data queries: info@nexustasl.co.uk — Response within one month under UK GDPR. Phone 01908 040493, Monday to Friday 9am to 5pm.. Data controller: Nexus Tax and Accounting Solutions Ltd, Stacey Bushes, Milton Keynes, Buckinghamshire, United Kingdom. Companies House 15540719. ICO registration [ICO registration number — to be added].

Complaints to the ICO

If you are unhappy with how we have handled your data or your request, tell us first and we will look at it. You also have the right to complain to the Information Commissioner’s Office at any time. You can reach them at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by phone on 0303 123 1113, or online at https://ico.org.uk/make-a-complaint/. Raising a complaint with the ICO does not affect any other legal remedy available to you.