Privacy Policy

At a Glance

This summary is provided for convenience. The full policy below governs our practices.

1. Introduction

Cura Accounting Limited ('we', 'us', 'our') is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect personal data in connection with the accountancy, bookkeeping, and management accounts services we provide.

We are registered as a data controller with the Information Commissioner's Office. Our processing of personal data is governed by the UK General Data Protection Regulation ('UK GDPR') and the Data Protection Act 2018 ('DPA 2018'). Where we also process data on behalf of clients, we act as a data processor and our obligations in that capacity are set out in the relevant engagement documentation.

We are members of the Chartered Institute of Management Accountants (CIMA) and comply with CIMA's ethical and professional obligations in relation to the handling of client information.

We may update this policy from time to time. The current version will always be available on our website. Where changes are material, we will notify affected individuals directly.

2. Who We Are

3. Personal Data We Collect

We collect and process personal data in the following categories:

3.1 Data you provide to us

• Names, contact details, and role information for directors, owners, and authorised contacts
• Identity and address verification documents (required for anti-money laundering compliance)
• Financial records, transaction data, bank statements, and supporting documentation
• Information about business ownership, shareholdings, and corporate structure
• Communications you send to us

3.2 Data we receive from third parties

• Information from HMRC, Companies House, and other regulatory authorities
• Data received from your other professional advisers where you authorise this
• Information from credit reference agencies
• Data from cloud accounting platforms you connect to our practice systems

4. Why We Process Your Personal Data

We process personal data for the following purposes:

• To provide bookkeeping, management accounts, and related professional services to you
• To fulfil our obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 ('MLR 2017') and related legislation
• To comply with our professional obligations as members of CIMA
• To invoice you for services and administer our client relationship
• To investigate and defend complaints, disciplinary proceedings, or legal claims
• To contact you about services we provide that may be of interest to you, where you have consented to this
• To comply with any other legal or regulatory obligation to which we are subject

5. Legal Basis for Processing

We rely on the following legal bases under UK GDPR Article 6 for our processing:

• Consent — where you have given clear and freely given consent to specific processing
• Contract — processing necessary for the performance of our engagement with you or your employer
• Legal obligation — processing necessary for compliance with legal requirements, including MLR 2017
• Legitimate interests — processing necessary for our legitimate interests or those of third parties, where these are not overridden by your rights and interests

It is a condition of our engagement that you provide us with the personal data we request. If you are unable to provide required information, we may not be able to commence or continue to act.

6. Who We Share Personal Data With

We may share your personal data with the following categories of recipient:

6.1 Routine sharing

• HMRC and other UK tax and regulatory authorities
• Your other professional advisers, where you authorise or require this
• Our professional indemnity insurers and their legal advisers
• Our professional body (CIMA) and the Office of Professional Body Anti-Money Laundering Supervisors (OPBAS)
• Subcontractors and specialist service providers engaged to support our services
• An alternate appointed by us in the event of our incapacity

6.2 Cloud-based systems and software providers

We use cloud-based software to deliver and manage our services. These include, but are not limited to:

• Accounting software (e.g. Xero, QuickBooks, Sage)
• Practice management and CRM systems (e.g. Engager.app)
• Document management and communication tools (e.g. Office 365, Outlook)
• Payment and banking tools (e.g. Apron, Crezco)
• Anti-money laundering platforms (e.g. Xama AML, Dext)

This list is not exhaustive. For a full list of current software providers, please contact our Data Protection Officer.

6.3 Sharing required by law

• The police, law enforcement agencies, and other government bodies
• Courts, tribunals, and regulatory bodies
• The Information Commissioner's Office (ICO)

7. Use of Artificial Intelligence Tools

We may use closed, enterprise-grade artificial intelligence (AI) tools to support the delivery of our services. These may assist with tasks such as drafting documents, summarising information, identifying anomalies, or improving efficiency in our work.

7.1 Our commitments regarding AI

• We only use AI tools that operate under enterprise or business-grade agreements with strict data privacy and security controls
• Client data processed through AI tools is not used to train, fine-tune, or improve underlying AI models
• AI tools are used to support our professional judgement, not to replace it — all outputs are reviewed by a qualified member of our team
• We do not use AI tools to make automated decisions that have legal or similarly significant effects on you

7.2 Data security with AI tools

Where AI tools are used in connection with your personal data, we ensure that:

• Data is processed in accordance with UK GDPR and our obligations as data controller
• Appropriate contractual safeguards are in place with AI tool providers
• Processing is limited to what is strictly necessary for the task

If you have concerns about the use of AI tools in connection with your data, or wish to opt out of specific AI-assisted processing, please contact our Data Protection Officer.

8. How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purposes for which it was collected. Our standard retention periods are as follows:

Where you have engaged us on an ongoing basis, data which is relevant across multiple periods will be retained throughout the engagement and for 7 years after the relationship ends, unless you ask us to retain it for longer or there is a legal hold on the data.

Your own statutory record retention obligations are separate from ours. For companies and LLPs, records must generally be retained for 6 years from the end of the relevant accounting period.

9. International Transfers of Personal Data

We primarily process personal data using servers and systems located in the UK and the European Economic Area (EEA). Where any third-party supplier processes personal data outside the UK or EEA, we ensure that:

• The transfer is to a country recognised by the UK as providing an adequate level of protection; or
• Appropriate safeguards are in place, such as UK-approved standard contractual clauses or binding corporate rules; and
• The supplier has undergone appropriate due diligence and meets our information security requirements

For more information about international transfers and the safeguards in place, please contact our Data Protection Officer.

10. Your Rights

Under UK GDPR you have the following rights in relation to your personal data:

Right of access (Subject Access Request)

You have the right to request a copy of the personal data we hold about you. Requests should be submitted in writing to Chelsea Ridings at office@cura-accounting.co.uk. We will respond within one month of receipt. We may ask you to verify your identity before processing a request.

Right to rectification

You have the right to have inaccurate or incomplete personal data corrected. Please notify us promptly if any data we hold about you is inaccurate.

Right to erasure

In certain circumstances you have the right to request the deletion of your personal data. We will consider all such requests and notify you of our decision, including any reasons why erasure is not possible (for example, where we are required to retain data for legal or regulatory purposes).

Right to restrict processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, for example while the accuracy of data is disputed.

Right to data portability

Where processing is based on consent or contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format.

Right to object

You have the right to object to processing based on legitimate interests. We will consider your objection and cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. We may not be able to continue to provide services if consent is withdrawn for processing that is necessary to the engagement.

Automated decision-making

We do not use solely automated decision-making processes that produce legal or similarly significant effects in relation to your personal data.

11. How We Keep Your Data Secure

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, or disclosure. These include:

• Encrypted storage and secure transmission of data
• Access controls limiting data access to authorised personnel
• Regular staff training on data protection and information security
• Due diligence on third-party suppliers and software providers
• Incident response procedures for identifying and addressing potential data breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

12. Complaints and Contact

If you have any questions about this Privacy Policy, wish to exercise any of your data rights, or have a complaint about how we have handled your personal data, please contact:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: www.ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF