The short version
We are a small advisory firm. We use personal data to answer enquiries, to do the work our clients engage us for, to carry out the identity checks the law requires, and to keep in touch with people we work with. We do not sell personal data, we do not use it for advertising, and we do not let anyone train public AI models on it.
Who is responsible for your data
DJWB & Co Business Advisors Ltd (company number 12810701, registered office 1 The Magpies, Bedford, Bedfordshire, MK45 2EG) is the controller of the personal data described in this notice. We are registered with the Information Commissioner's Office (ICO), reference ZA792630.
Our data protection contact is our Director, David Bailey. Email enquiries@djwbandco.uk with "Data protection" in the subject line, or write to our registered office.
Sometimes a client asks us to process personal data on its behalf, for example to check a payroll or to review customer records. In that work the client is the controller and we are its processor, under a data processing schedule in our engagement letter. The client's own privacy notice covers that data. Questions about it should go to the client first.
What we collect, why, and our lawful basis
| Who you are | What we hold | Why | Lawful basis |
|---|---|---|---|
| Someone who contacts us | Name, email, phone, organisation, role, what you tell us | To reply, and to decide whether we can help | Legitimate interests (answering you); contract, where you ask us to take steps before an engagement |
| A client, or a director, owner or staff member of a client | Contact details, role, correspondence, meeting notes, information in documents you give us, invoices and payments | To deliver and manage the engagement, to bill, and to keep proper records | Contract; legitimate interests; legal obligation (accounting and tax records) |
| A director, owner or person with significant control of a client | Identity documents, date of birth, address, source of funds, sanctions and politically exposed person screening results | Identity and anti-money-laundering checks | Legal obligation (Money Laundering Regulations 2017). Any criminal offence data is processed under the conditions in Schedule 1 to the Data Protection Act 2018 |
| An investor, lender, funder, adviser or other business contact | Name, organisation, role, business contact details, investment focus, notes of our dealings, and information you or your organisation have made public | To build and keep professional relationships, and to make introductions you would expect from an adviser in our field | Legitimate interests. You may object at any time |
| A supplier, subcontractor or associate | Contact and payment details, contract terms, qualifications | To manage our relationship and pay you | Contract; legal obligation |
| Someone who receives our updates | Name and email | To send occasional news about our work | Consent, or for existing clients, the "soft opt-in". Every email lets you unsubscribe |
| A visitor to this website | The technical data your browser sends (for example IP address, browser type and pages requested), held briefly in our host's server logs | To deliver the website and keep it secure | Legitimate interests |
Where we hold information about you that you did not give us yourself, it usually comes from you, your organisation, our clients, Companies House and other public registers, your organisation's website, professional networks, or identity and screening services.
We do not make decisions about you by automated means alone.
Cloud services and AI tools
We store and work on information in business cloud services, and we use AI tools under business terms to help analyse and draft. Those providers act as our processors. They may not use your information to train public AI models. A person at the firm checks AI-assisted work before it goes to anyone, and we stay responsible for it. Clients can tell us in writing if any information must not go into those tools.
Who we share it with
We share personal data only where we need to:
- with our Senior Business Partners, consultants and subcontractors who work on an engagement, all bound by confidentiality;
- with our processors, including our email, file storage and productivity provider (Microsoft), our AI drafting tools provider (Anthropic), our accounting software provider (Xero), our website host (Fasthosts) and our identity-checking service [provider to confirm];
- with our professional advisers, insurers and bank, where needed;
- with the ICAEW, the ICO, HMRC, law enforcement or a court, where the law or our professional rules require it; and
- with a successor practice if our Director can no longer work, so that your engagement can be completed or closed.
We make introductions between clients and third parties only with the client's agreement.
Transfers outside the UK
Some of our processors store or access data outside the UK, mainly in the European Economic Area and the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework for certified US companies) or on the ICO's International Data Transfer Agreement or Addendum. Ask us for a copy of the safeguard that applies.
How long we keep it
| Record | How long |
|---|---|
| Enquiries that do not become an engagement | Up to 2 years from our last contact |
| Engagement files, working papers and correspondence | At least 7 years after the engagement ends, or longer where the law or our professional bodies require |
| Identity and anti-money-laundering records | At least 5 years after the business relationship ends, as the Money Laundering Regulations 2017 require; we hold them with the engagement file for 7 years |
| Accounting and tax records | 6 years after the end of the financial year they relate to |
| Business contact records | While the relationship is active, and reviewed at least every 2 years. We delete them sooner if you object |
| Mailing list | Until you unsubscribe |
How we protect it
We use business-grade cloud services with multi-factor authentication and encryption, limit access to the people who need it, and do not keep client data on personal devices. Everyone who works on our engagements is bound by confidentiality.
Your rights
You have the right to ask us for a copy of your personal data, to correct it, to delete it, to restrict how we use it, to object to how we use it (including an absolute right to object to direct marketing), and to receive data you gave us in a portable form. Where we rely on consent, you can withdraw it at any time. Some rights have limits; for example, we must keep anti-money-laundering records for the period the law sets.
To use any of these rights, email enquiries@djwbandco.uk. We may need to check your identity. We reply within one month, and tell you if we need longer.
Complaints
If you are unhappy with how we have used your personal data, please complain to us first, by email to enquiries@djwbandco.uk with "Data protection complaint" in the subject line. We acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You can also use the form below. It opens an email to us in your own email app with your details filled in, so nothing is stored by this website.
You can also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, or at ico.org.uk/make-a-complaint.
Changes to this notice
We update this notice when our practices change. The date at the top of the page shows the latest version.