Privacy notice

Ashton and Carrington Ltd is regulated by the Institute of Financial Accountants (IFA) and provides R&D tax relief, capital allowances, accounts and tax services.

We are registered in England and Wales under company number 14900752. Our registered office is Centenary House, Centenary Way, Manchester, England, M50 1RF. We are registered with the Information Commissioner’s Office under number ZB627190.

For most of our work we are the “data controller”, meaning we decide how and why your personal data is used. Where we run payroll or bookkeeping on a client’s instructions, we act as a “processor” for that client, and the client is the controller of that data. If you are an employee of one of our payroll clients, your employer is usually the right first point of contact.

Our Data Protection Point of Contact handles questions about this notice and requests about your personal data. You can reach them at admin@ashtonandcarrington.co.uk or on 0161 841 8714.

Depending on our relationship with you, the personal data we hold may include:

• your name, address, email address, telephone number and date of birth
• identification and verification documents collected for client due diligence, such as passports, driving licences and proof of address
• national insurance numbers and unique taxpayer references
• income, employment, property, investment and bank details needed to prepare accounts, returns and claims
• payroll data for our clients’ employees, and details of our clients’ CIS subcontractors
• details of directors, shareholders, beneficial owners and persons with significant control
• business contact details of prospective clients and referral partners
• our correspondence with you, including enquiries made through our website, and any complaints

Some of this information is more sensitive. It can include health information supporting statutory sick pay, trade union subscriptions deducted through payroll, and the results of sanctions, politically exposed person and adverse media screening, or information about tax irregularities. We process this information only where the law allows it and apply additional safeguards when we do.

We process personal data on the following lawful bases:

• Contract: to provide the services you or our client have engaged us for.
• Legal obligation: to carry out client due diligence and keep records under the Money Laundering Regulations 2017, and to make filings required by the Companies Act 2006, the Taxes Management Act 1970 and the PAYE and CIS regulations.
• Legitimate interests: for business development and marketing, practice management, credit control, and handling claims and complaints, where our interests are not overridden by your interests, rights and freedoms.
• Consent: in limited circumstances, such as marketing emails to individuals and sole traders. You can withdraw consent at any time.

Marketing

We may send marketing emails to people at limited companies and limited liability partnerships on the basis of our legitimate interests. We email sole traders and other partnerships only with their consent, or where they are an existing client and were given the chance to opt out. Every marketing email includes a way to unsubscribe, and you can object to direct marketing at any time. We will stop straight away.

Other points

If you do not provide information we request, we may be unable to perform our contract with you or to meet our legal and regulatory obligations. We may process your personal data without your knowledge or consent where the law requires or permits it.

If we need to use your personal data for a new purpose, we will do so only where that purpose is compatible with the original one, and we will tell you the legal basis before we start.

We do not make decisions about you based solely on automated processing, including profiling.

Personal data we collect to meet our obligations under the Money Laundering Regulations 2017 will be processed only for the purposes of preventing money laundering and terrorist financing, unless its use is permitted by another enactment or you have given your express consent. We will not use it for marketing.

We collect personal data:

• directly from you, when you contact us by email, telephone, post, social media or our website, or when you engage us
• from your employer, or a business you are associated with, when it is our client
• from public registers such as Companies House
• from business information and prospecting databases, when we identify businesses that may benefit from our services
• from identity verification and screening providers, as part of client due diligence

Where we obtain your details from a source other than you, we record the source and provide this notice at our first contact with you, or within one month, whichever is sooner.

We share personal data with third parties where we are required by law, where it is necessary to administer our relationship with you or our client, or where we have another legitimate interest in doing so. Recipients include:

• HM Revenue & Customs and Companies House
• the Institute of Financial Accountants and other regulatory bodies
• law enforcement agencies, including the National Crime Agency, where required by law
• providers of IT, cloud, accounting, tax and payroll software and services
• our professional indemnity insurers and professional advisers, where needed to manage a claim or incident
• other advisers, introducers and referral partners, only with your or our client’s authority

Our service providers may process your personal data only for specified purposes and on our instructions, under written contracts that meet the requirements of the UK GDPR. We do not sell personal data.

Some of our service providers store or access data outside the UK, and our team may access data from within the European Economic Area. Where personal data is transferred outside the UK, we rely on UK adequacy regulations or, where those do not apply, an International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to those employees, agents, subcontractors and other third parties who need to know, and they are subject to a duty of confidentiality.

We have procedures to deal with any suspected data security breach and will notify you and the Information Commissioner where we are legally required to do so.

We keep personal data only for as long as necessary. Our standard periods are:

• client due diligence records: five years from the end of our business relationship
• client accounting, tax and advisory files: seven years from the end of the accounting period or tax year they relate to
• payroll and CIS records: six years from the end of the tax year
• engagement letters and records of advice: seven years from the end of the engagement
• prospect and marketing data: reviewed annually, and deleted where there has been no engagement or response within two years

We may keep data for longer where the law requires it or where it is needed for legal proceedings. Deleted data may remain in backups for a short period before it is overwritten.

Under certain circumstances, you have the right to:

• request access to the personal data we hold about you
• request correction of inaccurate or incomplete data
• request erasure of your data where there is no good reason for us to keep it
• request that we restrict processing of your data
• object to processing based on our legitimate interests, and object to direct marketing at any time
• request the transfer of your data to you or another controller, where processing is based on consent or contract and carried out by automated means
• withdraw your consent, where we rely on it

To exercise any of these rights, contact our Data Protection Point of Contact at admin@ashtonandcarrington.co.uk or on 0161 841 8714. We will respond within one month. We may extend this by up to two further months for complex or numerous requests, and will tell you if we do.

There is no fee, although we may charge a reasonable fee, or refuse, where a request is manifestly unfounded or excessive. We may need to confirm your identity before acting on a request.

Please tell us if your personal data changes, so the information we hold stays accurate.

When you submit an enquiry through our website, we use the details you provide to respond to you, on the basis of our legitimate interests.

Our website does not use analytics, advertising or other tracking cookies, and does not load third-party tracking tags. Our Cookie policy has more detail.

If you have a concern about how we handle your personal data, please contact our Data Protection Point of Contact first at admin@ashtonandcarrington.co.uk or on 0161 841 8714, and we will try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at any time:

• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Telephone: 0303 123 1113
• Website: ico.org.uk/make-a-complaint

We may update this notice from time to time. The current version will always be available on this page, and we will tell clients directly about any material changes.

This notice was last updated on 23 October 2026.