Privacy policy
Last updated: 23 September 2026
This privacy policy explains how NDCA Ltd (“NDCA”, “we”, “us”) collects and uses personal data. This privacy policy applies to visitors to nd-ca.co.uk and to clients, prospective clients and anyone who contacts us. Please read it carefully. This privacy policy should be read alongside our Terms and Conditions, which govern your use of this website.Contents
- Who we are
- Scope
- What personal data we collect
- How we collect data
- Why we use your data and our lawful basis
- Marketing
- Who we share data with
- International transfers
- How long we keep data
- Security
- Your rights
- Cookies
- Links to other websites
- Changes of business ownership
- General
- Changes to this policy
- Contact
Who we are
NDCA Ltd is a company registered in England and Wales.- Company number: 15121110
- Registered office: Suite 100 Unit 2, 94a Wycliffe Road, Northampton, England, NN1 5JF
- ICO registration number: ZB890339
- Our principal accountant is a member of the Association of Chartered Certified Accountants (ACCA), and the practice operates under ACCA’s anti-money laundering supervision
Scope
This policy applies only to NDCA’s processing of personal data through nd-ca.co.uk and in the course of providing our services. It does not extend to other websites we may link to, including social media platforms. You should read the privacy policy of any third-party site before using it.What personal data we collect
From website visitors
- Information you submit through contact forms (name, email, phone, business name, message content)
- Cookies and similar technologies (see Cookies below)
- Server logs (IP address, browser type, pages visited)
From clients and prospective clients
- Identification and verification data required for anti-money laundering checks (passport or driving licence, proof of address, date of birth, nationality)
- Contact details and business information
- Financial records, tax information, payroll data and supporting documents needed to deliver our services
- Bank details where needed for payments or direct debits
- Information about directors, shareholders, beneficial owners and employees of corporate clients
From third parties
- Companies House and HMRC records
- Credit reference and identity verification providers (used for AML checks)
- Your previous accountant on professional clearance
- Referrals (where someone introduces you to us)
How we collect data
We collect data in two ways: information you give us directly (through the website, by email, by phone, by post, during onboarding or in the course of delivering services) and information collected automatically when you visit the site (IP address, browsing activity, cookie data).Why we use your data and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries through the website or by email | Legitimate interests (responding to your request) |
| Delivering accountancy, tax, bookkeeping and payroll services | Contract |
| Anti-money laundering and know-your-client checks | Legal obligation (Money Laundering Regulations 2017) |
| Filing returns and reports with HMRC, Companies House and other authorities | Legal obligation |
| Sending invoices and collecting payment | Contract |
| Keeping accounting and tax records | Legal obligation |
| Sending service updates and occasional marketing to existing clients | Legitimate interests (you can opt out at any time) |
| Marketing to prospective clients who have opted in | Consent |
| Website analytics and improving the site | Consent |
Marketing
We will only send you marketing emails where we have a lawful basis to do so.- Existing clients: we may send you information about our services under the “soft opt-in”. You can opt out at any time using the unsubscribe link in any email or by emailing info@nd-ca.co.uk.
- Prospective clients: we will only send marketing emails where you have explicitly opted in (for example, by ticking a consent box on a form).
Who we share data with
We share personal data only where needed:- HMRC and Companies House: for filings, returns and statutory submissions
- Cloud accounting and practice software: Xero, and QuickBooks or FreeAgent where a client uses them before moving to Xero (your data is held on their systems on our behalf)
- Apron: for capturing invoices, receipts and supporting documents
- Socket: for our online booking and enquiry form
- Identity verification providers: for AML checks
- Our professional indemnity insurer and ACCA: where required by our regulator or in connection with a claim
- Payment processors and our bank: for invoicing and payments
- IT and hosting providers: including our website host (Hostinger) and email provider
- Google: for website analytics (Google Analytics)
- Professional advisors: solicitors or specialist tax advisors, only where you have agreed
- Relevant authorities: where required by law, including for the detection of crime, anti-money laundering or collection of taxes and duties
International transfers
Some of our software providers (including Xero, QuickBooks, FreeAgent, Apron, Socket, Google and our email provider) may process data outside the UK. Where this happens, transfers are covered by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum or an adequacy decision.How long we keep data
- AML and client identification records: 5 years after the end of the client relationship
- Accounting and tax records: 7 years from the end of the relevant accounting period, which covers the HMRC minimum of 5 years after the filing deadline for individuals and 6 years for companies
- Payroll records: 6 years
- Website enquiries that do not become clients: 24 months
- Marketing data: until you opt out
- Server logs: 30 days
Security
We use technical and organisational measures to protect your data, including encrypted storage, multi-factor authentication on practice systems and access controls limited to staff who need the data. Despite this, no system is completely secure. If you suspect misuse, loss or unauthorised access to your data, email info@nd-ca.co.uk immediately. If a breach affects your data, we will notify you and the ICO where the law requires. For general advice on protecting your information online, the government-backed service Get Safe Online is a useful resource.Your rights
Under UK GDPR you have the right to:- Access: ask for a copy of the personal data we hold about you
- Rectification: ask us to correct inaccurate or incomplete data
- Erasure: ask us to delete your data, subject to legal retention requirements above
- Restriction: ask us to limit how we use your data
- Portability: ask us to transfer your data to another provider
- Object: object to our use of your data, including where we rely on legitimate interests
- Withdraw consent: where consent is the lawful basis, withdraw it at any time
Cookies
Cookies are small files stored on your device when you visit a website. This site uses:- Essential cookies set by WordPress and our hosting provider, needed for the site to work and stay secure
- Analytics cookies set by Google Analytics (including _ga and _ga_ followed by our measurement ID), which tell us how visitors use the site so we can improve it
- Cookies set by third-party features when they load or you use them, including our Google reviews widget, embedded Google Maps, the WhatsApp chat button and the Socket booking form