Last updated: 1 April 2025

1. Who we are

MHC & Co Chartered Accountants Ltd is a firm of chartered accountants based in Bristol, United Kingdom. We are registered with the Institute of Chartered Accountants in England and Wales (ICAEW) and are authorised and regulated by them. Our registered office is 54 Gloucester Road North, Bristol, BS7 0SJ. For data protection purposes, we are the data controller. If you have any questions about this policy or how we handle your data, you can contact us at:

• Email: info@mhcandco.co.uk
• Phone: 0333 789 1010
• Post: Data Protection Officer, MHC & Co, 54 Gloucester Road North, Bristol, BS7 0SJ

2. What personal data we collect

We may collect the following types of personal information:

• Identity Data: name, title, date of birth, national insurance number, passport details, etc.
• Contact Data: postal address, email address, telephone numbers.
• Financial Data: bank account details, tax information, income, expenses, investments, property details, and other financial information necessary to provide our services.
• Technical Data: IP address, browser type, operating system, and other technical information when you visit our website (via cookies).
• Marketing and Communications Data: your preferences in receiving marketing from us and your communication preferences.

We collect this data directly from you (when you fill in forms, email us, or use our services), from third parties (e.g., HMRC, Companies House, your bank), or automatically when you use our website.

3. How we use your personal data

We only use your personal data where permitted by law. Common uses include:

• To provide our accountancy, tax, and advisory services to you (performance of a contract).
• To comply with legal and regulatory obligations (e.g., anti-money laundering checks, tax filings).
• To manage our relationship with you, including notifying you about changes to our services or policies.
• To administer and protect our business and this website (including troubleshooting, data analysis, testing).
• To deliver relevant content and marketing communications where you have consented or where we have a legitimate interest.

We do not sell your personal data to third parties.

4. Legal basis for processing

Under UK GDPR, we rely on the following legal bases:

• Performance of a contract: where processing is necessary to provide our services to you.
• Legal obligation: where we must process data to comply with the law (e.g., anti-money laundering regulations).
• Legitimate interests: for running our business, improving our services, and communicating with you where our interests do not override your rights.
• Consent: where you have given explicit consent for a specific purpose (e.g., receiving marketing emails).

5. Sharing your data

We may share your personal data with:

• Regulatory authorities such as HMRC, ICAEW, the ICO, and Companies House, where required by law.
• Third-party service providers who perform functions on our behalf (e.g., cloud storage, payroll software, IT support). These providers are contractually bound to protect your data.
• Professional advisers such as solicitors, auditors, and insurers where necessary.
• Any other party with your consent or as required by law.

We ensure that any third party processes your data in accordance with UK data protection laws and only for the purposes we specify.

6. International transfers

We primarily store and process your data within the UK and European Economic Area (EEA). Where we use cloud‑based services, your data may be transferred to countries outside the UK/EEA. We ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission, to protect your data.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Typically, we retain client records for seven years after the end of the tax year to which they relate, in line with HMRC guidance. After this period, data is securely destroyed or anonymised.

8. Your data protection rights

Under UK data protection law, you have the following rights:

• Right to access – you can request a copy of the personal data we hold about you.
• Right to rectification – you can ask us to correct inaccurate or incomplete data.
• Right to erasure – you can request deletion of your data in certain circumstances.
• Right to restrict processing – you can ask us to limit how we use your data.
• Right to data portability – you can request that your data be transferred to another service provider.
• Right to object – you can object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making – we do not use automated decision-making that has legal or significant effects on you.

To exercise any of these rights, please contact us using the details above. We will respond within one month. If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

9. Cookies and website analytics

Our website uses cookies to improve your experience and to analyse traffic. You can set your browser to refuse all or some browser cookies. For more detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

10. Security

We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. These include secure servers, encryption, access controls, and regular security reviews. While we strive to protect your data, no system can be completely secure; we encourage you to take steps to protect your own data when using the internet.

11. Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “last updated” date. Where appropriate, we will notify you by email or a notice on our website.

If you have any questions about this policy or how we handle your personal data, please contact us at info@mhcandco.co.uk.