Privacy Policy

This Privacy Policy explains how Verdi Bookkeeping Services Ltd collects, uses, shares and protects personal data – whether you are browsing our website, getting in touch with an enquiry or working with us as a client. We have written it in plain English.

Last updated: 24 September 2026

Who we are

Verdi Bookkeeping Services Ltd ("we", "us", "our") is a bookkeeping firm based at 79 Maiden Lane, London NW1 9YN. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller of the personal data described in this policy, except where we explain below that we act as a data processor on behalf of our clients.

You can contact us about anything in this policy:

By post: Verdi Bookkeeping Services Ltd, 79 Maiden Lane, London NW1 9YN
By email: [email protected]
By phone: 020 7482 4641 (Monday to Friday, 9.00–17.30)

Details of our registration with the Information Commissioner's Office (ICO) are available on request.

Who this policy covers

This policy applies to personal data we handle about:

Website visitors – people who view pages on www.vbslimited.com.
Enquirers – people who contact us through the website form, by email, by phone or in person to ask about our services.
Clients and their representatives – sole traders, partners, company directors, company secretaries and other individuals connected with the businesses and private individuals we provide bookkeeping, payroll and VAT services to.
Individuals whose data appears in client records – for example, our clients' employees, customers and suppliers, whose details we see when we process our clients' books and payroll.
Other contacts – such as our clients' accountants and other professional advisers we liaise with.

Clients will also receive a letter of engagement which sets out the terms of our services, including data protection terms. If there is any conflict between this policy and a signed letter of engagement, the letter of engagement takes priority for that client relationship.

The personal data we collect

Website visitors

Our website is deliberately simple. We do not use analytics, advertising or tracking cookies, and we do not embed third-party content such as social media feeds, videos or maps that could track you. The only information stored in your browser is:

your cookie-consent choice, held in your browser's localStorage; and
briefly, the first name you type into our contact form, held in your browser's sessionStorage so we can greet you by name on the thank-you page. It is deleted as soon as the thank-you page has loaded.

Neither item is sent to us. Full details are in our Cookie Policy.

Like almost every website, our web hosting provider may automatically record standard technical information when your browser requests a page – such as your IP address, the date and time of the request, the page requested and your browser type – in server logs. This is used only to deliver the website, keep it secure and diagnose faults.

Enquirers

If you use our contact form we collect your name, email address, phone number (optional), the service you are interested in, your message and a record that you ticked the consent box. The form submission is sent to us by email. If you contact us by email, phone or in person, we collect whatever details you choose to give us, which is usually your name, contact details and a description of your business and what you need.

Please do not send us detailed financial information or documents through the contact form. If you become a client, we will agree a secure way to exchange records.

Clients

To provide our services and meet our legal obligations we collect and hold:

Identity and contact data – names, addresses, dates of birth, email addresses and telephone numbers of sole traders, partners, directors and other key individuals.
Verification data – copies of identity documents (such as a passport or driving licence) and proof of address, and information about beneficial owners and persons with significant control, collected for anti-money laundering checks.
Tax and official identifiers – Unique Taxpayer References, National Insurance numbers, VAT registration numbers, PAYE and Accounts Office references, and company registration numbers.
Financial records – bank and credit card statements, sales and purchase invoices, receipts, cashbooks, ledgers, loan and asset records, and access to accounting or banking software where you grant it.
Service and correspondence records – our notes, emails and letters, working papers and our own billing records.

Data about your employees, customers and suppliers

When we run payroll or keep your books, we inevitably handle personal data about other people. For payroll this typically includes employees' names, addresses, dates of birth, National Insurance numbers, tax codes, salary and hours, bank details, pension contributions, statutory payments (such as sick, maternity or paternity pay, which may reveal health or family information), student loan deductions and starter or leaver details. Your books will also contain the names and payment details of customers and suppliers.

If you give us personal data about other people, please make sure they know you are sharing it with a bookkeeper and that you have a lawful basis to do so – usually by referring to it in your own employee privacy notice.

When we are a controller and when we are a processor

Data protection law distinguishes between a controller, who decides why and how personal data is used, and a processor, who handles personal data only on a controller's instructions.

Activity	Our role	What this means
Running our website and handling enquiries	Controller	We are responsible for your data and for answering your requests.
Client onboarding, anti-money laundering checks, our client file and billing	Controller	We decide what we must collect and keep to meet our own legal and professional duties.
Processing your employees' payroll data, and customer and supplier data in your books	Usually processor	You, as the employer or business owner, are the controller. We act on your written instructions under our letter of engagement.

Where we act as a processor, we will only process the data to provide the services you have asked for, keep it confidential and secure, assist you with data subject requests and breaches, and return or delete it at the end of our engagement unless the law requires us to keep it. If one of your employees asks us about their data, we will normally refer them to you as their employer.

How we use personal data and our lawful bases

We must have a lawful basis under Article 6 of the UK GDPR for each use of personal data. The table below summarises our main purposes, the lawful basis we rely on and how long we keep the data.

Purpose	Data involved	Lawful basis	Retention
Responding to website, email and phone enquiries	Name, contact details, service of interest, message	Legitimate interests (answering people who contact us); steps before entering into a contract at your request	Up to 2 years after the last contact if you do not become a client
Delivering and securing the website	Technical log data held by our host	Legitimate interests (running a secure website)	Short-term, according to our host's log rotation
Client identity checks and anti-money laundering due diligence	Identity, verification and ownership data	Legal obligation (Money Laundering Regulations 2017)	5 years after the business relationship ends
Providing bookkeeping, VAT, payroll and trial balance services	Financial records, identifiers, correspondence	Performance of a contract; legal obligation where we submit returns on your behalf	Normally 6 years after the end of the relevant financial year or engagement
Processing payroll for your employees (as your processor)	Employee payroll data	Your lawful basis as employer; our processing is under your instructions	As instructed by you, and at least as long as HMRC requires for payroll records (3 years from the end of the tax year)
Billing, recovering fees and keeping our own accounts	Client contact and billing data	Performance of a contract; legal obligation (tax and company law)	6 years from the end of our financial year
Handling complaints and legal claims	Relevant correspondence and records	Legitimate interests (defending our position); legal obligation	For the duration of the matter and applicable limitation periods
Occasional updates to existing clients about relevant deadlines or service changes	Name and email	Legitimate interests; PECR "soft opt-in" for existing clients	Until you opt out or the relationship ends

Where we rely on legitimate interests we have considered whether our interests are overridden by yours, and we are confident they are not for the uses described. You can ask us for more detail about this assessment.

Special category and criminal offence data

Payroll records can include information about health (for example, statutory sick pay) or trade union membership (union subscriptions). Where we process this on your behalf as an employer, the relevant condition is the employment law condition in Article 9(2)(b) UK GDPR and Schedule 1 of the Data Protection Act 2018, which you as controller rely on. Our anti-money laundering checks may occasionally reveal information about criminal offences; we process this only as required by the Money Laundering Regulations and in line with Schedule 1 of the Data Protection Act 2018.

Marketing

We do not buy mailing lists or share your details with others for their marketing. Under the Privacy and Electronic Communications Regulations 2003 (PECR), we may send existing clients occasional emails about similar services or important deadlines. Every such email will give you a simple way to opt out, and you can also tell us at any time.

Anti-money laundering obligations

As a business providing bookkeeping services, we are covered by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Before we take on a new client, and periodically afterwards, we must carry out customer due diligence: verifying the identity of the client and, for companies and partnerships, identifying beneficial owners.

The law requires us to keep due diligence records and supporting records of transactions for 5 years after the business relationship ends. We may also be legally required to report suspicions of money laundering or terrorist financing to the National Crime Agency, and in those circumstances the law may prevent us from telling you that we have done so. Information collected for anti-money laundering purposes is used only for those purposes, or as otherwise permitted by law.

We do not sell personal data. We share it only where necessary, and only with:

Your accountant – we prepare accounts to trial balance so that your accountant can finalise them. We will share your records, schedules and working papers with the accountant you nominate, when you instruct us to.
HMRC – when you instruct us to submit VAT returns or payroll (RTI) submissions, or to correspond with HMRC on your behalf, and where the law requires us to provide information.
Companies House – where you instruct us to file information on your behalf.
Pension providers – where we operate payroll and you instruct us to submit auto-enrolment contribution data.
Software and IT providers – such as accounting, payroll, email and secure file-sharing services, and our web hosting provider (a data processor based in the UK/EEA). These providers act on our instructions under written contracts.
Identity verification services – if we use an electronic service to help carry out anti-money laundering checks.
Our own professional advisers and insurers, where needed.
Law enforcement and regulators – including the National Crime Agency, our anti-money laundering supervisory body and the courts, where we are legally required to.

International transfers

We aim to keep personal data within the UK and the European Economic Area (EEA). The UK recognises EEA countries as providing adequate protection. Some software and email providers may store or access data outside the UK and EEA. Where this happens, we make sure the transfer is protected by an appropriate safeguard, such as a UK adequacy regulation, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information about the safeguards used.

How we keep data secure

Financial and payroll records are sensitive, and we take their security seriously. Our measures include:

restricting access to client files to the team members who need it, with each client looked after by a named member of staff;
password-protected and, where available, multi-factor protected accounts for software and email;
securely storing paper records at our office and returning or securely shredding them when no longer needed;
using reputable accounting and payroll software providers with strong security standards;
serving our website over an encrypted HTTPS connection;
confidentiality obligations for everyone who works with us.

No internet transmission is completely secure, so please use any secure method we agree for sensitive documents. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the ICO within 72 hours where required, and tell you without undue delay if the risk is high.

How long we keep personal data

We keep personal data only as long as we need it for the purposes above, including meeting legal, tax, regulatory and insurance requirements. The key periods are:

Enquiries that do not lead to an engagement – up to 2 years after our last contact.
Anti-money laundering records – 5 years after the business relationship ends, as required by the Money Laundering Regulations 2017.
Client working papers and records – normally 6 years after the end of the relevant financial year or the end of our engagement, reflecting HMRC record-keeping periods and legal limitation periods.
Payroll records held as processor – as instructed by you, and at least as long as HMRC requires (3 years from the end of the tax year to which they relate).

Original records belong to you and will be returned to you. Please remember that as a business owner you have your own obligations to keep records; see our article on how long to keep business records. When data is no longer required it is securely deleted or destroyed.

Your rights

Under the UK GDPR you have the following rights, subject to certain conditions and exemptions:

Right of access – to receive a copy of the personal data we hold about you.
Right to rectification – to have inaccurate or incomplete data corrected.
Right to erasure – to have your data deleted where there is no good reason for us to keep it. This right does not apply where we must keep records by law, for example anti-money laundering or tax records.
Right to restrict processing – to ask us to pause using your data, for example while we check its accuracy.
Right to object – to processing based on legitimate interests, and an absolute right to object to direct marketing.
Right to data portability – to receive data you gave us in a structured, commonly used format, where processing is based on contract or consent and carried out by automated means.
Right to withdraw consent – where we rely on consent, at any time, without affecting processing already carried out.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

How to exercise your rights

Contact us Email [email protected], write to our office or call 020 7482 4641. You do not need to use any particular form of words.
Confirm your identity We may ask for reasonable proof of identity so that we do not disclose personal data to the wrong person.
Receive our response We will respond within one month. For complex or multiple requests we may extend this by up to two further months, and we will tell you if so. There is normally no fee.

If your request relates to payroll or other data we process on behalf of your employer or another business, we will pass it to that business (as controller) and help them respond.

Children

Our website and services are aimed at businesses and adults. We do not knowingly collect personal data from children through our website. We may process data about under-18s only where it appears in client records, for example where a client employs a young person and we run their payroll; in that case we act on the employer's instructions.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:

Website: https://ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this policy

We review this policy regularly and may update it to reflect changes in the law, our services or the way we work. The "Last updated" date at the top of this page shows when it was last revised. Where changes are significant, we will let existing clients know directly.

Contact us

Data protection questions: Verdi Bookkeeping Services Ltd, 79 Maiden Lane, London NW1 9YN. Email [email protected] or call 020 7482 4641, Monday to Friday, 9.00–17.30. You can also use our contact page.

See also our Cookie Policy, Website Terms of Use and Legal Notice.