Privacy policy

Milestone Accountants Ltd · Last updated 8 October 2026

This policy explains how Milestone Accountants Ltd collects, uses, shares and protects personal information when you use our services, our website or our client portal, and the rights you have. We are committed to protecting your privacy and handling your information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Milestone Accountants Ltd ("we", "us") is the controller of your personal information. We are a company registered in England and Wales (company number 11631034), of 18A Gawsworth Avenue, Didsbury, Manchester M20 5NF, and are registered with the Information Commissioner's Office (registration number ZA514752).

Our data protection lead is Imran Hafeez: imran.hafeez@milestoneaccountants.co.uk, 0161 504 2252.

2. The information we collect

• Identity and contact details: name, date of birth, home and business addresses, email address and phone numbers.
• Identity verification: copies of passports, driving licences and proof of address, and the results of electronic identity, sanctions and politically exposed person (PEP) checks.
• Tax and government references: National Insurance number, Unique Taxpayer Reference, VAT number, PAYE and Corporation Tax references, and Companies House authentication codes.
• Financial and business information: bank statements, invoices, receipts, payroll and employment details, income, pensions, property and other information needed to prepare accounts and tax returns.
• Information about other people: directors, shareholders, partners, employees and family members, where it is needed for the work (for example a company's officers, or a spouse for a tax return). If you give us someone else's information, please make sure they know.
• Our dealings with you: emails, notes of calls and meetings, documents you sign, quotes you ask for, and the fees you pay.
• Technical information: when you use our website or portal, your IP address, browser type and the pages you visit (see "Cookies" below).

3. Where it comes from

Most information comes from you, or from the business you are involved with. We also obtain information from:

• HMRC, once you have authorised us to act for you;
• Companies House (public records of companies, their officers and people with significant control);
• identity verification and anti-money laundering providers, which use sources such as credit reference agencies, the electoral roll and sanctions and PEP lists;
• banks and other organisations, through the statements and documents you send us;
• your previous accountant, with your permission.

4. Why we use it, and our lawful basis

What we do	Lawful basis
Giving you a quote and following it up	Steps before entering a contract, at your request
Providing our services: bookkeeping, accounts, tax returns, payroll, VAT, company secretarial work, and dealing with HMRC and Companies House for you	Performance of a contract
Asking HMRC to authorise us as your agent, including through HMRC's online agent services	Performance of a contract
Identity, anti-money laundering, sanctions and PEP checks, and keeping the records the law requires	Legal obligation (Money Laundering Regulations 2017, and tax law)
Reminding you of deadlines and records we need, by email and text, and sending documents for electronic signature	Performance of a contract
Invoicing and collecting our fees	Performance of a contract
Running and protecting our business: quality reviews, insurance, keeping our systems secure, and handling complaints and legal claims	Legitimate interests
Asking clients for a review after their work is finished	Legitimate interests (you can opt out at any time)

Sensitive information

Anti-money laundering screening can reveal information about criminal convictions or offences. We process this only where the law requires us to, to prevent money laundering and fraud, under the conditions in Schedule 1 of the Data Protection Act 2018. We collect health or other special category information only where it is needed for your tax affairs (for example a tax relief), with your explicit consent or where it is needed for legal claims.

5. Who we share it with

We share information only where needed for the purposes above:

• HMRC and Companies House, to file your accounts and returns and deal with your affairs;
• HMRC as our anti-money laundering supervisor, and other regulators or law enforcement where the law requires it (for example a suspicious activity report);
• our professional body, the Association of Certified Public Accountants, our professional indemnity insurer and our professional advisers;
• service providers who process information for us, under contracts that require them to keep it secure and use it only on our instructions:
  • Microsoft (Microsoft 365, SharePoint and Azure: email, document storage and our client portal, including Azure AI Document Intelligence to read scanned documents);
  • accounting and tax software: Xero, TaxCalc, QuickBooks and Sage;
  • identity verification and anti-money laundering checks: Veriphy and SmartSearch;
  • Zoho Sign (electronic signatures) and RingCentral (phone calls and text messages);
  • IWOCA and Stripe (payment of our invoices).
• anyone you ask us to deal with, such as your bank, mortgage lender or new accountant.

We do not sell your information, and we do not send newsletters or marketing.

6. Transfers outside the UK

Our client portal and its data are hosted in the United Kingdom. Some of our service providers store or process information outside the UK (for example in the European Economic Area, the United States or Australia). Where they do, the transfer is protected by UK adequacy regulations or by the UK International Data Transfer Agreement or Addendum, or equivalent safeguards. You can ask us for details.

7. How long we keep it

• Accounting and tax records: at least 6 years after the end of the tax year or accounting period they relate to, to meet HMRC's requirements and the time limits for claims.
• Identity and anti-money laundering records: 5 years after our business relationship ends, as the Money Laundering Regulations require.
• Quotes that do not lead to work: only as long as we need to follow them up, and deleted automatically after 12 months.

We may keep information longer where needed for a legal claim or where the law requires it. After that it is securely deleted.

8. Automated decisions

We do not make decisions with legal or similarly significant effects about you by automated means alone. Electronic identity checks are reviewed by a member of our team where they do not give a clear result, and automatically read documents are checked by our staff.

9. How we protect it

Access to client information is limited to our staff who need it for their role and is protected by Microsoft 365 sign-in. Sensitive details such as tax references and HMRC access tokens are encrypted, our systems are encrypted at rest, and information travels over encrypted connections. We use secure links, which expire, for clients to send us documents. If a personal data breach occurs that puts you at risk, we will tell you, and we will report it to the Information Commissioner's Office (and to HMRC where relevant) within 72 hours of becoming aware of it.

10. Your rights

You have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected;
• have your information erased, where we no longer need it or have no other lawful basis to keep it;
• restrict how we use it;
• receive it in a portable format, or have it sent to another organisation;
• object to our using it on the basis of legitimate interests;
• withdraw consent, where we rely on consent;
• not be subject to decisions based solely on automated processing.

Some rights are limited where we must keep information by law (for example anti-money laundering records). To use any of these rights, contact Imran Hafeez using the details above. We will reply within one month and will not usually charge a fee.

11. Cookies

Our website uses cookies, as explained in its cookie policy. Our client portal uses only the cookies it needs to work securely (for example to keep you signed in and protect forms); it does not use advertising or tracking cookies.

12. Complaints

If you have a concern about how we use your information, please contact us first and we will try to put it right. You can also complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, 0303 123 1113, ico.org.uk/make-a-complaint.

13. Changes to this policy

We review this policy regularly and at least once a year. The date at the top shows when it last changed. Our terms of use explain how our client portal works.