1. Who we are

Item	Details
Controller	Kingsleybusiness Online Limited trading as EcoOffice
Company number	05128840
Registered office	Fairlight View, Udimore Road, Udimore, East Sussex, TN31 6BG, United Kingdom
Website	https://ecooffice.tax
Privacy enquiries	privacy@ecooffice.tax
Supervisory authority	Information Commissioner’s Office (ICO), United Kingdom

We have not appointed a statutory Data Protection Officer. Privacy enquiries should be directed to the email address above.

2. Information we collect

Identity and contact details, including names, addresses, dates of birth, signatures and identification documents.
Business information, directorships, shareholdings, beneficial ownership and company records.
Financial, accounting, tax, banking, transaction and payment information.
Employment, payroll, pension, benefits, National Insurance and student-loan information.
Information about health, disability, family circumstances or other special-category information where relevant to tax, payroll or professional services.
Information relevant to fraud prevention, sanctions, politically exposed person and anti-money-laundering checks.
Communications, instructions, meeting recordings where agreed, complaints and service history.
Technical and security information, including account activity, device, access and audit-log information.

3. Where information comes from

We obtain information directly from individuals and clients and, where relevant, from employers, employees, directors, shareholders, HMRC, Companies House, banks, pension providers, previous advisers, identity-verification services, accounting platforms, public registers and other parties authorised by the client or permitted by law.

4. Why we use information and our lawful bases

Purpose	Typical UK GDPR basis
Provide accountancy, tax, bookkeeping, payroll, company secretarial and advisory services	Contract; legitimate interests; legal obligation
Meet tax, AML, professional and regulatory duties	Legal obligation; legitimate interests
Administer fees, client relationships, quality control and complaints	Contract; legitimate interests
Protect systems, prevent fraud and investigate incidents	Legitimate interests; legal obligation
Communicate relevant service or regulatory updates	Legitimate interests; consent where required
Establish, exercise or defend legal claims	Legitimate interests; applicable Article 9/Schedule 1 condition where required

Where we process special-category information, we also identify an applicable Article 9 condition. Where criminal-offence information is processed, we identify an applicable condition under the Data Protection Act 2018. We do not rely on consent where the processing is necessary to provide services or meet legal obligations.

5. Our role

For most accountancy and tax services, we act as an independent controller because we determine aspects of the processing and have our own professional and legal obligations. For some services, particularly routine payroll processing, we may act as a processor on the client’s documented instructions. The applicable engagement terms explain the position.

6. Who receives information

HMRC, Companies House, courts, regulators, law-enforcement bodies and our professional body where required or authorised.
Banks, pension providers, legal advisers, insurers, auditors and other professional advisers where relevant.
Providers of accounting, payroll, document management, communications, hosting, security, identity verification and practice-management systems.
EcoOffices, Inc. in the Philippines, as described below.
A buyer, successor or adviser involved in a proposed or completed business reorganisation, subject to appropriate safeguards.

7. Processing in the Philippines

We use EcoOffices, Inc., of Block 7, Lot 6, Jose Abad Santos Avenue, Mangoville, Salitran IV, Dasmarinas City, Cavite, Philippines, to provide staffing and operational support for our accountancy, tax, payroll, bookkeeping, administration and technology services. Its personnel may access information in EcoOffice, Xero, Asana, ESM, Dext, Hubdoc, Google Docs, Zoom, BTC and approved storage systems and may process temporary working copies under our instructions.

EcoOffices, Inc. is contractually required to maintain confidentiality, data-protection and information-security measures. Personnel use a mixture of company desktops and approved personal laptops subject to security rules. Permanent business records must be stored in approved central systems; local working copies are restricted and must be removed when no longer required.

8. International transfers

Information may be accessed or stored outside the United Kingdom, including in the Philippines and in an AWS region in Singapore. Other cloud suppliers may process information in additional countries. Where a destination is not covered by UK adequacy regulations, we use an appropriate safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with a transfer risk assessment and additional measures where appropriate.

You may contact privacy@ecooffice.tax for further information about the safeguard relevant to a particular transfer. Commercially confidential information and information that would prejudice security may be withheld or redacted where legally permitted.

9. Security

We use proportionate technical and organisational controls, including access restrictions, individual accounts, authentication controls, encrypted transmission, central storage, device requirements, confidentiality obligations, training, incident procedures and access reviews. No system is completely secure, but we regularly review our controls and identified exceptions.

10. Retention

We retain information only for as long as needed for the purposes described, including professional, tax, AML, contractual and legal requirements. Typical periods are set out below and may be extended where litigation, an enquiry, a regulatory hold or another legal reason applies.

Record	Typical approach
Client and engagement records	Engagement plus at least 6 years, subject to professional and legal requirements
Accounting and tax working papers	Normally at least 6 years after the relevant period or engagement
AML records	Normally 5 years after the business relationship ends or the relevant transaction
Payroll working records	According to the engagement, statutory requirements and documented retention schedule
Prospective-client information	Deleted when no longer required unless needed to document a compliance decision
Companies House verification records	Normally 7 years after verification
Security and incident records	According to risk, legal requirements and the internal retention schedule

11. Your rights

Depending on the circumstances, individuals may have rights of access, rectification, erasure, restriction, objection and data portability, and rights concerning automated decision-making. Some rights are limited where information must be retained for tax, AML, professional or legal reasons. Requests should be sent to privacy@ecooffice.tax. We may need to verify identity before acting.

12. Complaints

Please contact privacy@ecooffice.tax first so that we can investigate. You may also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.

13. Automated decision-making and AI

We may use carefully selected AI-assisted tools for analysis, drafting, summarisation and workflow support. Outputs are subject to appropriate human review. We do not make decisions producing legal or similarly significant effects about individuals solely by automated means unless we have informed the affected person and established a lawful basis.

14. Changes to this notice

Effective date: 2 September 2026. Version: Published 1.0. We may update this notice to reflect changes in our services, suppliers, processing or legal obligations. The current version will be published at https://ecooffice.tax/privacy-notice.