Privacy Notice

Last updated: 21 August 2026

1. Who we are

Crawley Down MTD is a bookkeeping practice operated by Colin Hamer. For the purposes of UK data protection law, Crawley Down MTD is the data controller for personal information used in its own business administration, enquiries, onboarding, compliance and service delivery.

Contact:
Colin Hamer, Crawley Down MTD
30 Hophurst Drive, Crawley Down, West Sussex, RH10 4UZ
Email: colin@crawleydownmtd.co.uk
Telephone: 07928 808792

2. Personal information we may collect

Depending on your relationship with us, we may collect:

• your name, business name, postal address, email address and telephone number;
• details about your business, its structure and your bookkeeping requirements;
• information supplied in website enquiries, emails, calls and meetings;
• identity, address, ownership and control information needed for anti-money laundering checks;
• financial and bookkeeping records, including invoices, receipts, bank transactions and expense information;
• tax and business identifiers where relevant to the agreed work;
• payment, invoice and Direct Debit administration information; and
• system access records, software invitations and audit information needed to provide services securely.

3. Where personal information comes from

We may receive personal information:

• directly from you when you contact us, complete a form or become a client;
• from records and documents you provide for bookkeeping;
• from accounting or other agreed software where you have authorised access;
• from an accountant, adviser or other person authorised by you;
• from public sources, such as Companies House, where relevant; and
• from payment and service providers used for agreed business administration.

4. Why we use personal information

We may use personal information to:

• respond to enquiries and discuss or provide quotations for services;
• assess whether we can accept an engagement;
• complete client onboarding, identity and anti-money laundering checks;
• provide bookkeeping, Xero support and other agreed services;
• manage invoices, payments, records and client communications;
• meet legal, regulatory, professional and insurance obligations;
• protect our systems, records and legal rights; and
• manage and improve our business operations.

5. Lawful bases

Depending on the purpose, we may process personal information because:

• it is necessary to take steps at your request before entering into a contract;
• it is necessary to perform a contract with you;
• we must comply with a legal obligation;
• it supports our legitimate interests in operating and protecting the practice, provided your rights do not override those interests; or
• you have given consent, where consent is the appropriate lawful basis.

6. Sharing personal information

We do not sell personal information. We may share it only where necessary with organisations such as accounting software providers, secure IT and cloud service providers, payment providers, professional advisers, continuity support, regulators, law enforcement bodies or other parties where you authorise us or the law requires it.

Where a service provider processes personal information for us, we take reasonable steps to use providers that handle it securely and under appropriate contractual arrangements.

7. International transfers

Some technology or service providers may store or process information outside the United Kingdom. Where this occurs, we will use appropriate safeguards required by UK data protection law.

8. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, regulatory, professional, insurance, accounting and dispute-handling requirements.

• Enquiries that do not become client engagements are retained only while needed to deal with the enquiry and reasonable follow-up, then deleted or securely archived.
• Client and bookkeeping records are retained during the engagement and afterwards for any applicable legal, tax, regulatory, professional, insurance or dispute period.
• Anti-money laundering identity and due diligence records are retained for the period required by applicable anti-money laundering law and guidance.

9. Security

We use reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. No method of electronic transmission or storage is completely secure, but we review our safeguards and limit access to information to those who need it.

10. Your rights

Subject to legal limitations and exemptions, you may have the right to:

• be informed about how your personal information is used;
• request access to your personal information;
• ask for inaccurate or incomplete information to be corrected;
• request erasure in appropriate circumstances;
• request restriction of processing in appropriate circumstances;
• object to certain processing;
• request data portability in certain circumstances;
• withdraw consent where processing relies on consent; and
• raise a concern or complaint about how your information is handled.

To exercise a right, contact us using the details above. We may need to verify your identity before responding.

11. Complaints

Please contact Crawley Down MTD first if you have a concern about how your personal information has been handled. You also have the right to complain to the Information Commissioner's Office. Information about making a complaint is available at ico.org.uk/make-a-complaint.

12. Cookies and website data

This website should provide separate information about any cookies or similar technologies it uses. If non-essential cookies or analytics are introduced, the website will request consent where required before using them.

13. Changes to this notice

We may update this Privacy Notice when our services, systems or legal obligations change. The latest version will be published on this page with its updated date.