Last updated: October 2026

1. Who we are

Anlo Financial Solutions Edinburgh Ltd (“Anlo”, “we”, “us”, “our”) is an accountancy practice. We provide accounting, bookkeeping, payroll, tax and company secretarial services, and we are a member firm of the Institute of Chartered Accountants in England and Wales (ICAEW).

Registered in Scotland, company number SC550413

Registered office: 5 South Charlotte Street, Edinburgh, EH2 4AN

ICO registration number: ZA673727

Email: contact@anlofin.com

We are the controller of the personal data described in this notice. We are not required to appoint a Data Protection Officer. Annja Louca, Director, is responsible for data protection and can be contacted using the details above.

This notice explains how we collect, use, share and protect personal data about:

our clients and prospective clients, including directors, shareholders, partners, trustees and beneficial owners of client businesses.

people whose details our clients give us so we can do our work, such as employees on a payroll, family members relevant to a tax return, and customers or suppliers who appear in bookkeeping records.

visitors to our website and people who contact us or book an appointment with us.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025.

2. Our role

For most of our work, such as preparing accounts and tax returns and carrying out anti-money laundering checks, we act as an independent controller. This is because our professional and legal duties determine how we must use the data.

For some services, such as running a payroll or bookkeeping on your instructions, we may act as your processor. In that case, the data protection terms in our engagement letter apply.

If you give us personal data about other people, such as your employees or family members, please make sure they know you are sharing it with us. You can do this by referring them to this notice.

3. The personal data we collect

Depending on the services we provide, we may collect:

Identity and contact details: name, title, address, email address, telephone number, date of birth and signature.

Identity verification (anti-money laundering): passport or driving licence, proof of address, results of electronic identity checks, beneficial ownership details, source of funds or wealth, and politically exposed person (PEP) and sanctions screening results.

Tax and government identifiers: National Insurance number, Unique Taxpayer Reference (UTR), agent authorisation details, Companies House details and, for cross-border clients, overseas tax reference numbers.

Financial information: bank statements, income, investments, pensions, property, loans, dividends, invoices, receipts and accounting records.

Employment and payroll information: employee names, addresses, National Insurance numbers, salaries, tax codes, pension and student loan details, statutory pay (such as sick, maternity or paternity pay) and bank details for payments.

Family and household information: details of a spouse, partner or children where relevant to your tax position.

Communications: emails, messages, meeting notes and meeting transcripts or recordings. We will tell you when a meeting is being transcribed or recorded.

Payment information: billing details. Card and Direct Debit payments are processed by our payment providers, and we do not store full card numbers.

Website and technical information: IP address, browser and device type, pages visited and cookie data.

Special category and criminal offence data: We do not routinely ask for this. However, we may receive health information (for example, for statutory sick pay or tax reliefs) or information about criminal convictions or sanctions through anti-money laundering checks. We only process this where the law allows, as explained in section 5.

4. Where we get your data

• directly from you
• from your business, your employer or your other advisers
• from HMRC, Companies House and other public registers
• from identity verification and screening providers
• from bank feeds and software you connect to your accounting records
• from people who refer you to us

5. How we use your data and our lawful basis

Purpose Lawful basis: Providing our services (accounts, bookkeeping, payroll, tax returns, Companies House filings and advice) Performance of our contract with you. Legal obligation, where filings are required by law. Legitimate interests, where the data relates to someone other than our client (for example, employees or family members): our interest and our client’s interest in delivering the agreed service.

Verifying your identity and carrying out anti-money laundering checks Legal obligation under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and the Proceeds of Crime Act 2002.

Quotations, onboarding, engagement letters, invoicing and collecting fees Performance of a contract. Legitimate interests (running our practice and recovering fees).

Booking appointments and taking payment for consultations Taking steps at your request before entering into a contract.

Responding to enquiries Legitimate interests (responding to people who contact us).

Professional regulation, quality reviews, insurance, complaints and legal claims Legal obligation. Legitimate interests (meeting professional standards and protecting our business).

Sending newsletters, deadline reminders and updates about our services Legitimate interests for existing clients. Consent for anyone else. You can opt out at any time.

Operating our website and analysing how it is used Consent for non-essential cookies. Legitimate interests for essential security and functionality.

Internal administration, training, IT security and record keeping Legitimate interests (running our practice securely and efficiently).

We only process special category data or criminal offence data where this is permitted by Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018. For example, we may do so for employment and social security obligations, to prevent or detect unlawful acts, to meet regulatory requirements, in connection with legal claims, or with your explicit consent.

We need certain information to provide our services and to meet our legal duties. If you do not provide it, we may be unable to act for you.

We do not make decisions about you based solely on automated processing.

6. Who we share your data with

We only share personal data where necessary, and never sell it. We may share it with:

HMRC, Companies House and, where relevant to your affairs, other tax authorities such as the South African Revenue Service (SARS).

Service providers who support our practice, including Xero, Hubdoc, TaxCalc, Microsoft 365, Monday.com, Harvest, Stripe, GoCardless, Calendly, our website host and analytics provider, and our identity verification and e-signature providers. These providers act on our instructions and must keep your data secure.

Anlo Financial Solutions (Pty) Ltd, our associated firm in South Africa, whose team supports our work

Your bank, lender, pension provider, solicitor or other advisers, at your request or with your agreement.

ICAEW and its Quality Assurance Department, and our professional indemnity and cyber insurers and brokers.

Our own legal and professional advisers.

Law enforcement agencies and regulators, including the National Crime Agency, where the law requires it. In some cases the law does not allow us to tell you that we have done so.

A buyer or successor of our practice, if all or part of our business is sold or merged, under strict confidentiality

7. International transfers

Some of our service providers store or access data outside the UK. In addition, staff at our associated firm in South Africa may access client records.

Where data is transferred to a country that does not have UK adequacy regulations, we put appropriate safeguards in place. This is normally the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. We also assess the risks of the transfer. Transfers to the European Economic Area, and to US organisations certified under the UK Extension to the EU-US Data Privacy Framework, are covered by UK adequacy regulations.

You can contact us for more information about these safeguards.

8. How long we keep your data

Type of data Retention period: Client files, working papers and tax records At least seven years from the date the relevant return or accounts were submitted, or longer if there is an HMRC enquiry or dispute

Anti-money laundering records: Five years after our business relationship ends, as required by law

Engagement letters, fee and complaint records: Seven years after our relationship ends

Enquiries from people who do not become clients: Up to 12 months

Marketing contact details: Until you unsubscribe

Website analytics data: As set out in our Cookie Policy

After these periods, we securely delete or destroy the data.

9. How we protect your data

We use appropriate technical and organisational measures to protect your data, including:

• access restricted to staff who need it, using strong passwords and multi-factor authentication where available
• encryption in transit (TLS) and through our cloud providers
• confidentiality obligations in staff and supplier contracts
• regular staff training on data protection and information security
• a policy that client information must not be stored on personal devices

If a personal data breach occurs, we will report it to the ICO within 72 hours where required. We will tell you without undue delay if it is likely to pose a high risk to you.

10. Your rights

You have the right to:

• access the personal data we hold about you
• correct inaccurate or incomplete data
• ask us to delete your data
• restrict how we use your data
• object to us processing your data based on legitimate interests, and to object at any time to direct marketing
• receive your data in a portable format, or have it transferred to another organisation
• withdraw your consent at any time, where we rely on consent

To exercise any of these rights, email contact@anlofin.com. There is normally no charge.

We will respond within one month. This can be extended by up to two further months for complex requests. We may need to verify your identity or ask you to clarify your request, and the time limit is paused until we receive this. We will carry out reasonable and proportionate searches.

Some rights are limited where the law requires us to keep information, for example for tax or anti-money laundering purposes.

11. Data protection complaints

If you are unhappy with how we have handled your personal data, please contact us first:

Email: contact@anlofin.com (subject: “Data protection complaint”)

Post: Data Protection, Anlo Financial Solutions Edinburgh Ltd, 5 South Charlotte Street, Edinburgh, EH2 4AN

We will acknowledge your complaint within 30 days. We will then investigate without undue delay, keep you updated and tell you the outcome.

If you remain unhappy, you can complain to the Information Commissioner’s Office (ICO):

Website: ico.org.uk

Telephone: 0303 123 1113

Post: Wycliffe House, Water Lane, Wilmslow, SK9 5AF

Complaints about our professional services are dealt with under our Standard Terms of Engagement.

12. Cookies

Our website uses strictly necessary cookies. With your consent, it also uses analytics cookies, such as Google Analytics, to help us understand how the site is used. You can change your choices at any time using the “Cookie Preferences” link in the website footer or your browser settings. Our Cookie Policy gives more detail.

13. Children

Our services and website are not aimed at children. We only hold information about children where it is relevant to a client’s tax affairs or a payroll we run, and we handle it with extra care.

14. Changes to this notice

We review this notice at least once a year. The latest version is always available on our website, and we will tell clients about any significant changes.

15. Contact us

For any questions about this notice or how we handle your personal data, email contact@anlofin.com or write to us at our registered office.