BACKGROUND:
IB&Co Accountants understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of everyone who visits this website, www.ibandco.co.uk Our Site and will only collect and use personal data in ways that are described here, and in a way that is consistent with our obligations and your rights under the law.
Please read this Privacy Policy carefully and ensure that you understand it. Your acceptance of this Privacy Policy is requested.
Information About Us
Our Site is owned by us and designed and operated by TS Designs (registered as Pege UK Ltd). We are registered as IB&Co Accountants Ltd, a limited company registered in England and Wales under company number 11221117.
Registered address: Level 37, 1 Canada Square, Canary Wharf, London E14 5AA.
Main trading address: Level 37, 1 Canada Square, Canary Wharf, London E14 5AA.
Email address: info@ibandco.co.uk
Telephone number: 020 7164 0225.
We are regulated by ICO (Information Commissioner Office) for data protection purposes.
What Does This Policy Cover?
This Privacy Policy applies only to your use of Our Site. Our Site may contain links to other websites. Please note that we have no control over how your data is collected, stored, or used by other websites and we advise you to check the privacy policies of any such websites before providing any data to them.
What Is Personal Data?
Personal data is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”) and the Data Protection Act 2018 (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.
Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
What Are My Rights?
Under the Data Protection Legislation, you have the following rights, which we will always work to uphold:
The right to be informed about our collection and use of your personal data. This Privacy Policy should tell you everything you need to know, but you can always contact us to find out more or to ask any questions using the details in Part 10.
The right to access the personal data we hold about you. Part 9 will tell you how to do this.
The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. Please contact us using the details in Part 10 to find out more.
The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we hold. Please contact us me using the details in Part 10 to find out more.
The right to restrict (i.e. prevent) the processing of your personal data.
The right to object to us using your personal data for a particular purpose or purposes.
The right to withdraw consent. This means that, if we are relying on your consent as the legal basis for using your personal data, you are free to withdraw that consent at any time.
The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract, and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
Rights relating to automated decision-making and profiling. We do not use your personal data in this way.
For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided above.
It is important that your personal data is kept accurate and up-to-date. If any of the personal data we hold about you changes, please keep us informed as long as we have that data.
Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.
If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves, however, so please contact us first, using the details above.
What Personal Data Do You Collect and How?
Subject to the following, we do not collect any personal data from you. We do not place cookies on your computer or device, nor do we use any other means of data collection.
Our Site does collects certain information automatically, your IP address, the type of browser you are using, and certain other non- personal data about your computer or device such as your operating system type or version, and display resolution.
If you send us an email, we may collect your name, your email address, and any other information which you choose to give us. For the purposes of the Data Protection Legislation, We are the data controller responsible for such personal data.
The lawful basis under the Data Protection Legislation that allows us to use such information is article 6(1)(f) of the GDPR which allows us to process personal data when it is necessary for the purposes of our legitimate interests, in this case, the proper operation and functionality of Our Site. If you contact us as described above, you will be required to consent to our use of your personal data to contact you. In this case, our lawful basis for using your personal data will be article 6(1)(a) of the GDPR, which allows us to use your personal data with your consent for a particular purpose or purposes.
How Do You Use My Personal Data?
Where we collect any personal data, it will be processed and stored securely, for no longer than is necessary in light of the reason(s) for which it was first collected. We will comply with our obligations and safeguard your rights under the Data Protection Legislation at all times. For more details on security see Part 7, below.
As stated above, we do not generally collect any personal data directly from you, but if you contact us me and we obtain your personal details from your email, we may use them to respond to your email. The other technical data referred to above is necessary for the technical operation of Our Site and will not normally be used in any way to personally identify you.
Any and all emails containing your personal data will be deleted no later than 3 weeks and no other personal data will be retained for any longer than is necessary.
We will not share any of your personal data with any third parties for any purposes other than storage on an email and/or web hosting server.
How and Where Do You Store My Data?
We will only store your personal data in the UK. This means that it will be fully protected under the Data Protection Legislation.
Please contact us using the details below in Part 10 for further information about the particular data protection mechanisms used by us when transferring your personal data to a third country.
Personal data security is essential to us, and to protect personal data, we take the following measures:
• limiting access to your personal data to those employees, agents, contractors, and other third parties with a legitimate need to know and ensuring that they are
• subject to duties of confidentiality;
• procedures for dealing with data breaches (the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your
• personal data) including notifying you and/or the Information Commissioner’s
Office where we are legally required to do so;
Do You Share My Personal Data?
We will not share any of your personal data with any third parties for any purposes, subject to the following exceptions.
If we sell, transfer, or merge parts of our business or assets, your personal data may be transferred to a third party. Any new owner of our business may continue to use your personal data in the same way that we have used it, as specified in this Privacy
Policy (i.e. to communicate with you).
In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.
If any of your personal data is transferred to a third party, as described above, we will take steps to ensure that your personal data is handled safely, securely, and in accordance with your rights, our obligations, and the third party’s obligations under the law, as described above in Part 7.
If any personal data is transferred outside of the EEA, we will take suitable steps in order to ensure that your personal data is treated just as safely and securely as it would be within the UK and under the Data Protection Legislation, as explained above.
If we sell, transfer, or merge parts of our business or assets, your personal data may be transferred to a third party. Any new owner of our business may continue to use your personal data in the same way(s) that we have used it, as specified in this Privacy Policy (i.e. to communicate with you).
In some limited circumstances, we may be legally required to share certain personal data, which might include yours, if we are involved in legal proceedings or complying with legal obligations, a court order, or the instructions of a government authority.
How Can I Access My Personal Data?
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.
All subject access requests should be made in writing and sent to the email or postal addresses shown in Part 10. To make this as easy as possible for you, a Subject Access Request Form is available for you to use. You do not have to use this form, but it is the easiest way to tell us everything we need to know to respond to your request as quickly as possible.
There is not normally any charge for a subject access request. If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs in responding.
We will respond to your subject access request within 10 working days and, in any case, not more than one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of our progress.
How Do I Contact You?
To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details for the attention of Data Protection Officer:
Email address: info@ibandco.co.uk.
Telephone number: 020 7164 0225.
Postal Address: Same as above.
Changes to this Privacy Policy
We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.
Any changes will be immediately posted on Our Site and you will be deemed to have accepted the terms of the Privacy Policy on your first use of Our Site following the alterations. We recommend that you check this page regularly to keep up-to-date. This
Privacy Policy was last updated on 23/12/2018.
In short: we use the details you give us through this website to reply to your enquiry, send you anything you asked for and, only if you have opted in, email you our monthly tax update and event invitations. We do not sell your information. Our website uses advertising cookies only if you allow them in our cookie banner, and you can change your mind at any time. You can ask to see, correct or delete your information at any time by emailing info@ibandco.co.uk.
- Who we are
- What we collect
- How we use it and our lawful bases
- The IB&Co tax update and unsubscribing
- Who we share it with
- Cookies, the cookie banner and advertising tags
- International transfers
- How long we keep it
- Security
- Your rights
- Complaints and the ICO
- Changes to this policy
1. Who we are
This policy explains how IB&Co Accountants Ltd (“IB&Co”, “we”, “us”) uses personal information collected through ibandco.co.uk and when you contact us. We are the controller of that information.
- IB&Co Accountants Ltd, a company registered in England and Wales, company number 11221117
- Registered and trading address: Level 37, 1 Canada Square, Canary Wharf, London E14 5AA
- Telephone: 020 7164 0225
- Email: info@ibandco.co.uk
- Registered with the Information Commissioner’s Office (ICO) as a data controller, registration number ZA483435
We have not appointed a statutory Data Protection Officer, as we are not required to. Ishmael Bangura, Managing Partner, is responsible for data protection at IB&Co. Questions about this policy or your information should go to him using the details above.
If you become a client, our engagement letter and terms of business explain how we use your information to provide accountancy and tax services, including the identity checks we must carry out under anti-money-laundering law. This policy covers the website and enquiries.
2. What we collect
Information you give us through our forms
Depending on the form you use (contact, quote request, call-back, tax advisory, tax health check, tax update sign-up or guide download), we collect:
- Contact details: your name, email address and, where asked, phone number and preferred time or method of contact.
- About your enquiry: your message, the services or topics you are interested in, and business details you choose to give, such as your business or trading name, type of client, turnover band, VAT status, number of staff or properties, and timing.
- Tax health check answers: your answers about your circumstances (for example income sources, salary and dividends, rental property or overseas interests), used to prepare your result and our follow-up.
- Guide downloads: which guide you requested, so we can email it to you.
- Your choices: whether you ticked the box to receive our tax update, with the date and time and the wording you agreed to.
- Where you came from: the page you used and, if you arrived from one of our campaigns, the campaign tags in the link (for example “utm_source”). We use these to see which of our campaigns work. They do not identify you on their own.
Please do not send us sensitive information (such as health details) or documents through the website forms. If we need documents, we will tell you how to send them securely.
Information you give us in other ways
If you email, phone, message us on WhatsApp or book a call through our online booking page, we receive the details you provide, such as your name, contact details and what you tell us.
Information collected automatically
Like all websites, our web server records basic technical information when pages are requested: your IP address, browser type, the pages requested, and the date and time. Our hosting provider uses this to keep the website running and secure. We do not use it to identify you. We do not use analytics on the website. Advertising tags (the Meta Pixel and, from when we add it, the LinkedIn Insight Tag) run only if you allow marketing cookies; see section 6.
3. How we use it and our lawful bases
Data protection law requires us to have a lawful basis for each use of your information. Ours are:
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry, prepare a quote, arrange a call or consultation, and follow up on it | Taking steps at your request before entering into a contract. Where you enquire on behalf of a business, or no contract follows, our legitimate interest in responding to people who contact us. |
| Email you the guide you requested and, once, ask whether it helped | Our legitimate interest in providing what you asked for and checking it was useful. If you do not want the follow-up, reply to tell us and we will not send it. |
| Keep a record of enquiries in our email platform, so we can manage follow-up and avoid duplicates. Enquiry records are not used for marketing. | Our legitimate interest in running our business efficiently. |
| Send the monthly IB&Co tax update and event invitations by email | Your consent, which you give by ticking the opt-in box and confirming by email. You can withdraw it at any time. |
| Measure whether our tax update emails are opened and which links are clicked | Your consent, given when you subscribe (see section 4). |
| Measure whether our Facebook, Instagram and LinkedIn adverts lead to visits and enquiries, show our adverts to people who have visited our website, and avoid showing them to people who have already enquired (Meta Pixel; LinkedIn Insight Tag once added) | Your consent, which you give by allowing marketing cookies in our cookie banner. You can withdraw it at any time with “Manage consent”. |
| Keep the website secure, prevent spam and fix faults | Our legitimate interest in protecting our website and our visitors. |
| Keep records we need for legal, regulatory or insurance purposes, and deal with any claims | Legal obligation, or our legitimate interest in defending our position. |
Where we rely on legitimate interests, we have considered your interests and expect these uses to be what you would reasonably anticipate when you contact an accountancy firm. You can object at any time (see section 10). Ticking “I have read the privacy policy” on a form confirms you have seen this policy. It is not the legal basis for answering your enquiry.
We do not make decisions about you based solely on automated processing, and we do not sell your information.
4. The IB&Co tax update and unsubscribing
We only send our monthly tax update and event invitations to people who have opted in. After you tick the box, we send one email asking you to confirm. If you do not confirm, you will not be added, and your sign-up is deleted after 30 days.
Our emails are sent using Transpond. Like most email newsletters, they contain standard tracking that tells us whether an email was opened and which links were clicked. We use this to improve the content and to stop emailing people who no longer read it. If you prefer not to be tracked, you can block images in your email program or unsubscribe.
To unsubscribe, use the “unsubscribe” link at the bottom of any tax update, or email info@ibandco.co.uk. We will stop straight away. We keep your email address on a suppression list so that we do not add you again by mistake. Unsubscribing does not affect any enquiry or client work.
5. Who we share it with
We use the following service providers (“processors”) to run our business. They act only on our instructions and must keep your information secure.
| Provider | What they do for us | Where |
|---|---|---|
| TS Designs, our web developer, and the cloud hosting provider it uses | TS Designs builds and manages our website and its hosting on our behalf. The site is hosted by a cloud hosting provider on servers in the UK, which hold the website and its database (including copies of form submissions), server logs and the email service that sends form notifications to us. | UK |
| Google Workspace (Google) | Our business email, which receives your enquiries and our replies | UK, EU and US (see section 7) |
| Transpond (MPZMail Limited, Manchester) | Our email platform: our record of website enquiries, the tax update mailing list, and sending the tax update | UK, with some suppliers outside the UK (see section 7) |
| Calendly | Our online booking page, if you choose to book a call through it | US (see section 7) |
Some services are provided by companies that decide for themselves how to use your information (they are separate controllers). Their own privacy policies apply:
- WhatsApp (Meta): if you choose to message us on WhatsApp, WhatsApp processes your number and messages under its own terms. We see your messages on our business phone and treat them like any other enquiry.
- YouTube (Google): where we show one of our videos, its preview image loads from YouTube, and the video itself loads only if you click play (see section 6).
- Meta (Facebook and Instagram adverts): only if you allow marketing cookies, the Meta Pixel sends Meta Platforms Ireland Limited the pages you visit on our site, technical details of your browser and device, your IP address and, when you send one of our forms, the fact that you did and which guide or form it was. It does not send your name, email address or phone number. We and Meta are joint controllers for collecting and sending this information; what Meta then does with it is covered by Meta’s own privacy policy.
- Google Fonts (Google): our website loads its typefaces from Google’s servers, so your browser sends your IP address to Google to fetch them. Google states that it does not use this to build profiles or for advertising.
- Social networks and review sites: our links to LinkedIn, Facebook, Instagram, X and Bark only take you to those sites. Nothing from them loads on our pages until you click.
We may also share information with our professional advisers or insurers, where the law requires it (for example HMRC, a regulator, the police or a court), or with a buyer if our business is sold or merged, who would have to use it in line with this policy.
6. Cookies, the cookie banner and advertising tags
Cookies are small files that a website stores on your device; similar technologies such as tracking pixels work in the same way. When you first visit our website, a banner asks whether you allow marketing cookies. Reject and Accept are equally easy, and nothing non-essential runs until you choose. If you close the banner or do nothing, nothing non-essential runs.
Strictly necessary (always on)
- Your cookie choice: our consent tool (Complianz) stores your choice in cookies whose names start
cmplz_, for 12 months, so we do not ask on every page. - Website and forms: WordPress sets cookies only for staff who log in to manage the site, and our forms use short-lived security checks to block spam without tracking you.
The law does not require consent for these.
Marketing (only if you allow them)
| Tool and provider | What it does | Cookies (typical lifetime) |
|---|---|---|
| Meta Pixel (Meta Platforms Ireland Limited) | Tells us whether our Facebook and Instagram adverts lead to visits and enquiries, lets us show adverts to people who have visited our site, and lets us avoid showing them to people who have already enquired. Records page views and when a form is sent (including which guide), but no names, email addresses or phone numbers. | _fbp (3 months) on our site; fr and other cookies set by Meta on facebook.com if you are logged in to Facebook or Instagram (up to 3 months) |
We do not use analytics cookies. The full, current list of cookies, from the latest scan of our site, is in our Cookie Policy.
Changing your mind
You can change or withdraw your choice at any time with the Manage consent button at the bottom of every page, or on our Cookie Policy page. Withdrawing stops the tags from the next page you open. You can also delete cookies in your browser settings. To control how Meta and LinkedIn use information for adverts, see your Facebook ad preferences and LinkedIn advertising settings.
Videos: where we show one of our videos on a page, its preview image is loaded from YouTube’s image servers when the page opens, so Google receives your IP address and basic browser information; no cookies are set at that stage. The video player itself loads only when you click play, using YouTube’s privacy-enhanced mode (youtube-nocookie.com). Once you click play, YouTube may store information on your device and collect data under Google’s privacy policy. If you prefer, you can watch on our YouTube channel instead.
7. International transfers
Our website is hosted in the UK. Some of our providers, mainly Google (Workspace and YouTube), Meta (WhatsApp and, if you allow marketing cookies, the Meta Pixel), LinkedIn (if you allow marketing cookies, once we add its Insight Tag), Calendly and some of Transpond’s suppliers, may store or access information outside the UK, including in the US. Where they do, the transfer is protected by one of the safeguards UK law allows:
- a UK government finding that the country provides adequate protection (this covers the EU/EEA, and certified US companies under the UK Extension to the EU–US Data Privacy Framework, the “UK–US data bridge”); or
- contract terms approved for UK transfers (the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).
You can ask us for more detail about the safeguard used for a particular provider.
8. How long we keep it
We keep information only as long as we need it for the purpose we collected it for, or as long as the law requires, then delete or anonymise it securely. If an enquiry turns into client work, the client periods below apply instead.
| Information | How long |
|---|---|
| Enquiries, quote and call-back requests, tax health check answers, booking details and related emails, call notes or WhatsApp messages, where you do not become a client | 2 years from our last contact with you, then deleted |
| Copies of form submissions stored on the website | 12 months, then deleted (the enquiry record in our email and Transpond is kept as above) |
| Guide download requests (where you have not made an enquiry or subscribed) | 12 months from the request |
| Tax update subscribers | Until you unsubscribe. If you have not opened or clicked any of our emails for 2 years, we will ask whether you still want them and remove you if you do not reply. |
| Unconfirmed sign-ups | 30 days |
| Suppression list (email address only, after you unsubscribe or ask us not to contact you) | For as long as we send marketing emails, so that we respect your choice |
| Website server logs | A short period set by our hosting provider for security and troubleshooting, normally no more than a few weeks |
| Clients | As set out in our engagement letter. Client records are normally kept for 6 years after our relationship ends, the period in which legal claims can be brought. Identity and anti-money-laundering records are kept for 5 years after the relationship ends, as the Money Laundering Regulations 2017 require, and then deleted unless the law requires us to keep them longer. |
9. Security
We protect your information with measures that suit the size of our firm and the information we hold, including:
- encrypted connections (HTTPS) for the whole website, so form details are encrypted in transit;
- restricting access to people at IB&Co and our providers who need it, under a duty of confidentiality;
- strong passwords and two-step verification where available;
- keeping the website software up to date and using spam protection that does not track visitors; and
- a procedure for dealing with any data breach, including telling you and the ICO when the law requires.
No website or email system can be guaranteed completely secure, so please do not send sensitive documents or bank details through the website forms.
10. Your rights
You have the right to:
- be informed about how we use your information (this policy);
- access the information we hold about you and receive a copy (a “subject access request”);
- rectification: have inaccurate or incomplete information corrected;
- erasure: ask us to delete your information where we no longer have a good reason to keep it;
- restriction: ask us to limit how we use your information, for example while we check its accuracy;
- object to our use of your information based on legitimate interests. You have an absolute right to object to direct marketing;
- withdraw consent at any time where we rely on it, for example to the tax update. This does not affect what we did before you withdrew it;
- data portability: receive information you gave us in a commonly used electronic format, or have it sent to another organisation, where we use it on the basis of consent or contract; and
- not be subject to decisions based solely on automated processing that significantly affect you. We do not make such decisions.
How to use your rights: email info@ibandco.co.uk, call 020 7164 0225, or write to us at the address in section 1. You do not need to use a form. We may ask you to confirm your identity before we act on a request, so that we do not disclose information to the wrong person.
There is normally no charge. We will respond within one month of receiving your request (or of confirming your identity, if we need to). If a request is complex or you make several, we may extend this by up to two further months, and we will tell you within the first month if so. Some rights have legal exceptions, for example where we must keep records for tax or anti-money-laundering purposes; if one applies, we will explain why.
Please tell us if your details change, so that our records stay accurate.
11. Complaints and the ICO
If you are unhappy with how we have used your information, please contact us first using the details in section 1, so that we can try to put it right. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator:
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
12. Changes to this policy
We will update this policy when the way we use personal information changes, for example if we add analytics, a chat service or a new provider. The date at the top shows when it was last changed. If a change significantly affects how we use information we already hold about you, we will tell you directly where we can.
Children: our website and services are aimed at adults and businesses. We do not knowingly collect information from children under 18.