Privacy Policy
Last updated 19 October 2026
This policy explains what personal data REMEZ & PARTNERS LTD collects, why we collect it, how long we keep it and what rights you have. It covers this website and our work as your accountants.
1. Who we are
REMEZ & PARTNERS LTD is the data controller for the personal data described here. We are registered in England & Wales, company number 17328543, registered office 21 Royal Engineers Way, London NW7 1TU.
Data protection contact: Alex Remez, Director (data protection contact) — hello@remezpartners.co.uk.
2. What we collect and why
If you use this website
| Data | Why |
|---|---|
| The answers you type into the "Start now" form: name, situation, company name, turnover band, and your description of the problem | To understand your situation and reply. This form stores nothing on the website. The button opens WhatsApp or your own email app with the message already written — the data reaches us only when you press send, and only through the channel you chose. |
| What you type into the calculators, the letter checker and the filing quiz | Nothing is transmitted or stored. The answer is calculated in your browser and disappears when you close the page. |
| Analytics: pages viewed, which situation cards and tools were used, device and browser type, approximate location from your IP address, and session replays | Only if you accept analytics cookies. We use this to see which parts of the site help people and which don't. See the Cookie Policy. |
| Technical logs kept by our hosting provider | Security and availability of the site. |
If you contact us
We keep the message you send and our correspondence with you — by WhatsApp, email or telephone — so we can answer, and so there is a record of what was said and agreed.
If you become a client
| Data | Why |
|---|---|
| Identity and address data: full name, date of birth, address, nationality, photograph of an identity document, and where relevant National Insurance number and Unique Taxpayer Reference | We are legally required to identify and verify our clients under the Money Laundering Regulations 2017 before we begin work. |
| Results of electronic identity verification and of sanctions and politically-exposed-person screening | Legal obligation. An electronic identity check is a record of an identity verification search — it is not a credit application and does not affect your credit rating. |
| Financial information: income, expenses, bank statements, invoices, property and company records | To prepare and file the returns and accounts you have engaged us for. |
| Beneficial ownership and control information for companies | Legal obligation under the Money Laundering Regulations 2017. |
| Correspondence, notes of advice, engagement letters and invoices | To perform the contract and keep the records the law requires. |
We do not seek special category data (such as health data). Where it appears incidentally in documents you send us, we hold it only as part of that record and do not use it for any other purpose.
3. Our lawful bases
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Providing the accountancy and tax services you engaged us for | Performance of a contract |
| Client verification, sanctions screening, record keeping, and reporting where the law requires it | Legal obligation — Money Laundering Regulations 2017, tax and companies legislation |
| Replying to your enquiry before any engagement exists | Legitimate interests — answering someone who has asked us a question, and taking steps at your request before entering a contract |
| Keeping the website secure and working | Legitimate interests — running a safe, functioning service |
| Analytics cookies and any marketing email | Consent, which you can withdraw at any time |
4. Who we share it with
We do not sell personal data and we never share it for anyone else's marketing. We share it only where necessary:
- HMRC and Companies House — filings we make on your behalf, and correspondence we conduct for you.
- Service providers who process data on our instructions under written contracts: our website host, our business email and calendar provider, and — where you use them to reach us — messaging platforms such as WhatsApp. If you accept analytics cookies, our analytics provider. Each is bound to use the data only as we instruct.
- The National Crime Agency, where the law requires us to make a report. Where we are required to report, we are prohibited by law from telling you, and we may have to stop work without explanation.
- Professional advisers, insurers and, if we ever sell or restructure the business, a purchaser — under confidentiality.
- Anyone you ask us to share with, such as your bank, your solicitor or your regulated immigration adviser, on your written instruction.
The providers in use today are Railway (website hosting, servers in the Netherlands), Cloudflare (domain name service — it directs browsers to the site and does not see what you do on it), Google Workspace (email and calendar) and, where you message us there, WhatsApp. Any new tool — a client portal, e-signature or payments — is named here, with what it processes, before it handles any client data.
5. Transfers outside the UK
Some of our providers are based in, or store data in, the United States or the European Economic Area. Where data is transferred outside the UK we rely on UK adequacy regulations or on the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), together with any additional safeguards the transfer requires. You can ask us which mechanism applies to a particular provider.
6. How long we keep it
| Record | Retention |
|---|---|
| Client records, including identity verification records, engagement letters, working papers and correspondence | Five years from the end of our business relationship, then securely deleted — the period required by the Money Laundering Regulations 2017 |
| Enquiries that do not become engagements | Twelve months, so we can pick up a conversation you return to, then deleted |
| Anti-money-laundering records: risk assessments, internal reports, screening results, training records | At least five years |
| Invoices and accounting records of our own business | Six years, as required by tax and companies legislation |
| Analytics data | As set out in the Cookie Policy; you can withdraw consent at any time |
7. How we protect it
Records are held in encrypted, access-controlled electronic storage with multi-factor authentication and backups. Access is limited to those who need it to do the work. We will never notify a change of our bank details by email — if you receive such a message, telephone us on the number we have given you before making any payment.
8. Your rights
Under UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- ask us to delete data, or to restrict or object to how we use it;
- receive data you gave us in a portable format;
- withdraw consent at any time, where we rely on consent.
Some of these rights are limited where we are legally required to keep a record — we cannot delete anti-money-laundering records before the five years are up, for example. We will always tell you if that is the case and why.
To exercise any right, email hello@remezpartners.co.uk. We respond within one month.
9. Automated decision-making
We do not make decisions about you by automated means alone, and we do not profile you. Electronic identity verification is checked by a person before it affects anything.
10. Complaints
If you are unhappy with how we have handled your data, tell us first — see our complaints procedure. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.
11. Changes to this policy
We update this policy when what we do changes — in particular as new tools go live. The date at the top shows the current version.