Privacy Policy.

1. Who is responsible for your information?

We generally act as a data controller for our own client relationships, practice administration, professional obligations and business development. Where we process information on another organisation’s instructions rather than for our own purposes, the relevant engagement and data-processing terms will explain our responsibilities.

2. Information we use

Depending on why you interact with us, we may process:

• Contact and business details: names, contact information, job titles, company details and correspondence.
• Accounts, tax and business information: financial records, transactions, payroll or other employment-related information, tax identifiers and supporting documents where relevant to an agreed service.
• Client due-diligence information: evidence of identity and address, ownership or control, beneficial ownership, risk assessments and information required for applicable anti-money-laundering checks.
• Practice administration information: engagement correspondence, instructions, invoices, payment records, complaints and records needed to administer our services.
• Website technical information: when you visit this website, technical details such as your IP address and the pages requested, recorded in our website host’s server logs.
• Publicly available professional information: company, director and business-contact information from public registers, business websites and professional networks.

We do not ask you to send passports, identity documents, bank statements or other sensitive records in an initial email enquiry. Where those are required, we will explain the appropriate submission process.

We may receive information directly from you or from your authorised representative, employer or company; previous accountants where professional clearance or a transfer is appropriate; public registers (including Companies House); relevant authorities; referrals; and technology providers used in delivering our services.

3. Why we use information and our lawful bases

We use personal information only where we have an applicable lawful basis under UK data-protection law.

PurposeAnswering enquiries, considering new work and communicating with prospective clients

Lawful basis, as applicableOur legitimate interests in responding to enquiries and operating our practice; or steps requested by an individual before entering a contract with that individual

PurposeProviding agreed accountancy, tax, bookkeeping, payroll or advisory services

Lawful basis, as applicablePerformance of a contract with an individual where applicable; legitimate interests in delivering services to a business client; and legal obligations where a specific law requires processing

PurposeClient identification, due diligence, AML compliance, record keeping and responding to authorities

Lawful basis, as applicableLegal obligation

PurposeBilling, payments, relationship management, professional quality control and record administration

Lawful basis, as applicableContract where applicable; legitimate interests in running the practice and protecting its legal position; or legal obligation

PurposeRelevant business-to-business outreach and respecting objections to it

Lawful basis, as applicableLegitimate interests in developing our practice and respecting marketing preferences, subject to the separate electronic-marketing rules where applicable

PurposeDelivering and securing this website

Lawful basis, as applicableOur legitimate interests in operating a secure website

PurposeResponding to data rights requests, complaints, professional oversight and legal claims

Lawful basis, as applicableLegal obligation or legitimate interests, as appropriate

Where we rely on legitimate interests, our interests include answering legitimate enquiries, delivering business services, keeping accurate records, protecting our systems, and communicating relevant services to business contacts. We take account of the interests, rights and reasonable expectations of the people involved.

Where a particular activity requires consent, we will ask for it. You can withdraw consent at any time, without affecting earlier lawful processing.

4. Enquiries and client relationships

Our website provides an email address for enquiries rather than an online contact form. If you email us, we use the details you provide to respond, assess suitability and discuss potential next steps.

For clients and their representatives, information may be needed to deliver our services and meet tax, company-law, anti-money-laundering and professional obligations. Some identification and due-diligence information is legally required. If we cannot obtain information needed to complete required checks, we may be unable to accept or continue an engagement.

Certain legal restrictions can limit what we are allowed to disclose about regulatory checks, reports or investigations.

5. Business contacts and Companies House information

We may review publicly available information about UK companies and business representatives, including information from Companies House, to identify organisations that may find our services relevant. This may include the company name and number, incorporation information, location, industry, director names and business contact details obtained from appropriate public sources.

We may use simple criteria to organise or prioritise business prospects. These processes do not determine an individual’s legal rights or produce similarly significant decisions about them without human involvement.

Being publicly available does not, by itself, remove information from data-protection law. We consider the purpose of collection and the rights and expectations of individuals, and we comply with relevant direct-marketing restrictions. We do not treat contact details of sole traders as equivalent to those of limited companies for marketing purposes.

You can object to the use of your personal information for direct marketing at any time. Email hello@nomic.uk and we will stop using your information for that purpose. Where it is necessary in order to respect your objection, we may keep the minimum information needed, such as your name and contact details, so that we do not contact you again for marketing.

6. Sharing information

Where necessary and lawful, personal information may be shared with:

• HMRC, Companies House, law-enforcement or other competent authorities, where required or permitted.
• ACCA and other professional or regulatory bodies, in connection with professional supervision or regulatory obligations.
• Financial, accounting, tax, payroll and practice-service providers used for an engagement, and the client or their authorised representatives.
• Technology and infrastructure providers supporting email, document management, security, billing and practice operations. Microsoft 365 supports business communications and administration, and Netlify hosts this website.
• Professional advisers, insurers or successor service providers, where appropriately authorised or otherwise lawful.

We do not sell personal information. We share only what is appropriate for the relevant purpose, and apply contractual and security controls where required.

7. International processing

Netlify, which hosts this website, and Microsoft 365 may process personal information outside the United Kingdom, including in the United States. Where that happens we rely on the safeguards in their data-protection terms. For transfers of UK personal information these are the European Commission’s standard contractual clauses together with the UK international data transfer addendum issued by the Information Commissioner’s Office.

If personal information is otherwise transferred outside the United Kingdom, we will only do so using a lawful mechanism, such as UK adequacy regulations, appropriate contractual safeguards or a lawful exception. You can ask about relevant arrangements using our privacy contact details.

8. How long we keep information

How long we keep personal information depends on the legal, regulatory and professional requirements that apply to it, and on the purpose for which it is held. We keep it for no longer than is necessary for that purpose, taking account of limitation periods, disputes and continuing obligations.

• Customer due-diligence records for a business relationship: kept for five years from when we know, or have reasonable grounds to believe, that the relationship has ended.
• Records of an occasional transaction: kept for five years from when we know, or have reasonable grounds to believe, that the transaction is complete.
• Supporting records of transactions within a business relationship: kept for five years from when we know, or have reasonable grounds to believe, that the business relationship has ended. The money laundering regulations provide that we are not required to keep these particular transaction records for more than ten years.
• Deletion after the period: once the relevant period ends we delete the personal information in these records, unless another law requires us to keep it, it is needed for court proceedings, we have reasonable grounds to believe it needs to be kept for legal proceedings, or the person concerned has consented to longer retention.
• Other records: including accounting, tax, engagement, billing and enquiry records, are kept for the period that the relevant legal, regulatory and professional requirements, and the purpose of the record, call for. We do not state a fixed period for these records here.

We may retain a limited record of a request, objection or complaint to show how it was handled. If a legal obligation requires retention, it may not be possible to erase the record immediately on request.

9. Cookies and website technologies

This website does not use analytics, advertising or tracking technologies. The pages of this website do not themselves set cookies or use similar storage on your device, and they do not load fonts, scripts, media or other content from third parties. For that reason the site does not show a cookie banner.

Our website host, Netlify, records technical information about each visit, such as your IP address and the pages requested, in server logs that are used to deliver the site and keep it secure. Netlify’s data-processing terms state that it keeps CDN traffic and access logs online for 30 days and in archival storage for up to 13 months. For some limited security and service data Netlify acts as an independent controller under its own privacy statement.

The website has no contact form. If you email us, we receive the information you include in your message and your email address.

If we introduce cookies or similar technologies, we will update this notice first and provide information and choices where required by applicable law.

10. Security

We use proportionate technical and organisational measures to protect information from unauthorised access, loss, alteration and disclosure. We restrict access based on business need and use appropriate service-provider safeguards. No internet-based service can be guaranteed entirely secure.

11. Your rights

Depending on the circumstances and applicable exemptions, you may have the right to request access to your personal information, correction, erasure, restriction, data portability and to object to certain uses of your information. If we rely on consent, you may withdraw it. You may also have rights concerning certain solely automated decisions.

Your right to object to direct marketing is separate and can be exercised at any time.

Requests can be sent to hello@nomic.uk. We may need to verify identity before disclosing confidential information. We respond within the applicable legal time limits, subject to any permitted extensions or exemptions.

12. Complaints

If you are concerned about how we have handled personal information, you can complain by email to hello@nomic.uk or by post to NOMIC & CO. LTD, 12 Dimmer Drive, Salisbury, Wiltshire, SP2 0FL, United Kingdom.

We will acknowledge a data-protection complaint within 30 days. We will investigate it, and tell you the outcome without undue delay.

You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

13. Updates

We may update this notice when our activities, systems or legal obligations change. The current version and its publication date will appear on this page. Where a new use of personal information requires us to notify affected people directly, we will do so.