Privacy Policy
This privacy notice explains how Beansprout Consultancy Ltd collects, uses, stores and shares personal information when providing its services and running its business. It also explains your rights and how to contact us about your personal information.
This notice reflects the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
Contact details
Beansprout Consultancy Ltd is the controller of the personal information described in this notice, except where we process information solely on a client’s documented instructions and act as a processor.
Our Data Privacy Manager is Helen Christopher.
- Email: helen@bean-sprout.co.uk
- Address: Capability House, Wrest Park, Silsoe, Bedfordshire, MK45 4HR
- Telephone: 01525 306920
You can contact Helen about how we use your personal information, to exercise your data-protection rights or to make a data-protection complaint.
1. Information we collect
The personal information we collect depends on the services we provide and the nature of our relationship with you. It may include:
- your name, address, date of birth and contact details;
- information needed to verify your identity, such as passport, driving-licence or electronic identity-verification information;
- National Insurance numbers, Unique Taxpayer References and other government identifiers;
- information held by HM Revenue & Customs (HMRC) or other public bodies;
- financial information, including income, expenditure, assets, liabilities, bank details, investments, pensions and business interests;
- accounting records, tax records, payroll information and information needed to prepare accounts, returns, claims or reports;
- information about your spouse, partner, dependants, employees, directors, shareholders or other people where it is relevant to the services we provide;
- information about your employment, business activities and professional relationships;
- correspondence, meeting notes, call or meeting recordings where notified, instructions and other records relating to our work for you;
- technical and security information generated when you use our systems, website or client portal; and
- information relevant to regulatory checks, complaints, disputes, insurance matters or the prevention and detection of crime.
Some of this information may be special-category data, such as health information, or criminal-offence data. We will process this information only where it is necessary and where the additional legal requirements applying to it are met.
If you provide us with personal information about another person, you should make sure that you are permitted to do so and, where appropriate, that they have been given this privacy notice.
2. How we collect information
We may collect personal information from:
- you;
- your spouse, partner, family member or authorised representative;
- your business, employer or another organisation with which you are connected;
- HMRC, Companies House and other government departments, regulators or public registers;
- banks, pension providers, investment advisers, brokers and other financial institutions;
- previous or newly appointed professional advisers;
- electronic identity-verification, anti-money-laundering and fraud-prevention providers;
- suppliers and service providers used to deliver our services; and
- other third parties you authorise to provide information to us.
We may also create personal information during our relationship with you, such as working papers, calculations, professional opinions, risk assessments, correspondence and records of the services provided.
3. Why we use your information and our lawful bases
We use personal information only where we have a lawful basis to do so. The basis will depend on the information and the purpose for which it is used.
| Purpose | Lawful basis normally relied upon |
|---|---|
| Taking steps before entering into an engagement and providing the services set out in our engagement letter and service schedules | Contract |
| Managing our relationship with you, communicating about our work, invoicing and recovering sums due | Contract and/or legitimate interests |
| Meeting tax, accounting, anti-money-laundering, sanctions, regulatory and other legal requirements | Legal obligation |
| Maintaining professional standards, quality assurance, training, insurance and appropriate business records | Legal obligation and/or legitimate interests |
| Protecting our business, systems, staff and clients; preventing fraud; and establishing, exercising or defending legal claims | Legal obligation and/or legitimate interests |
| Improving and administering our services, systems and business operations | Legitimate interests |
| Sending relevant information about our services | Consent where required, or legitimate interests where the law permits |
| Any other purpose to which you have specifically agreed | Consent, where consent is the appropriate lawful basis |
Our legitimate interests include operating an efficient, secure and properly managed professional-services business; providing and improving our services; maintaining client and professional relationships; protecting our legal rights; and communicating relevant services to business contacts.
We consider the impact on your rights before relying on legitimate interests.
Where we process special-category information, we will also identify an applicable condition under Article 9 of the UK GDPR. This may include employment and social-protection law, substantial public interest, legal claims or your explicit consent, depending on the circumstances.
Criminal-offence information will be processed only where permitted by law and with appropriate safeguards.
Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect processing already carried out lawfully, and it will not prevent us from continuing to use information where another lawful basis applies.
4. If you do not provide information
We may need certain personal information to comply with the law, complete client-verification checks or provide the services set out in our engagement letter.
If required information is not provided, we may be unable to begin or continue acting for you. Where appropriate, we may suspend work or disengage in accordance with our engagement terms and professional obligations.
5. Sharing personal information
Where it is necessary and lawful, we may share personal information with:
- HMRC, Companies House and other government departments, regulators or public authorities;
- banks, finance providers, pension providers, investment advisers and brokers;
- software providers, cloud-service providers, client-portal providers and other technology suppliers;
- subcontractors and specialist advisers supporting the services we provide;
- electronic identity-verification, anti-money-laundering, sanctions-screening and fraud-prevention providers;
- tax-enquiry or fee-protection insurance providers;
- our professional-indemnity insurers, insurance brokers, legal advisers and other professional advisers;
- our professional body, quality-assurance reviewers or monitoring bodies;
- law-enforcement agencies, courts, tribunals and other bodies where disclosure is required or permitted by law;
- a formally appointed alternate or continuity provider where necessary to protect clients if a principal becomes incapacitated or dies;
- a purchaser, investor or adviser involved in a proposed sale, merger or reorganisation of our business, subject to appropriate confidentiality safeguards; and
- a new adviser appointed by you, where you ask or authorise us to provide information.
Service providers and processors acting on our behalf must protect personal information, follow our documented instructions where applicable and comply with their contractual and legal obligations.
You may not be able to opt out of a disclosure that is necessary for us to provide an agreed service, meet a legal or professional obligation or protect our legal rights. If you object to a necessary disclosure, we may be unable to continue acting for you.
We do not sell personal information.
6. International transfers
Some of our approved software and service providers may store or process personal information outside the United Kingdom.
Where a restricted international transfer takes place, we will ensure that it complies with UK data-protection law. Depending on the circumstances, we may rely on UK adequacy regulations or appropriate safeguards, such as approved contractual protections, supported by a transfer risk assessment where required. Our assessment will consider whether the protection available is not materially lower than that provided under UK data-protection law.
You may contact the Data Privacy Manager for further information about the safeguards relevant to your personal information.
7. Data security
We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, destruction, alteration, disclosure, misuse or unauthorised access.
These measures include access controls, approved systems, authentication controls, secure sharing methods, staff training, supplier checks and procedures for identifying and responding to personal data breaches.
Access to personal information is limited to people who need it for their role. They must handle it confidentially and in accordance with our instructions, policies and legal obligations.
No method of electronic communication is completely risk-free. We use appropriate safeguards and ask clients to use our approved secure portal or other protected methods when exchanging sensitive information.
8. How long we keep information
We keep personal information only for as long as it is reasonably needed for the purpose for which it was collected and to meet any legal, regulatory, contractual, insurance or professional requirements.
Our standard retention periods include:
- Client accounting and tax records: normally seven years from the end of the relevant accounting period, tax year or business relationship, depending on the record and engagement;
- Ad hoc advisory work: normally seven years after the work or relationship ends;
- Ongoing client relationships: information needed throughout the relationship is retained while it remains relevant and is normally deleted seven years after the relationship ends, unless a longer or shorter period applies;
- Anti-money-laundering records: normally five years after the business relationship ends or an occasional transaction is completed, subject to any lawful extension or other applicable requirement;
- Data-protection requests and complaints: normally six years after the matter is closed; and
- Marketing information: reviewed periodically and deleted or anonymised when it is no longer needed. We may retain a minimal suppression record so that we can respect an opt-out or objection.
Some records, such as capital-gains history or evidence of long-held assets, may need to be retained for longer where they remain relevant to an ongoing engagement or future tax position.
Retention periods may also be extended where information is relevant to an actual or anticipated complaint, dispute, investigation, insurance matter or legal claim.
9. Your data-protection rights
Depending on the circumstances, you may have the right to:
- ask for access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to certain uses of your information, including direct marketing;
- receive personal information you provided to us in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller where the right to data portability applies;
- withdraw consent where we rely on consent; and
- ask for safeguards in relation to certain solely automated decisions.
These rights are not absolute. We may be required or permitted to continue using or retaining information in some circumstances. If we cannot fully comply with a request, we will explain why unless the law prevents us from doing so.
You will not normally have to pay a fee to exercise your rights. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, as permitted by law.
10. Subject access requests
You may ask for access to the personal information we hold about you and for the supplementary information required by law. A subject access request can be made verbally or in writing and does not need to use a particular form of words.
Please contact the Data Privacy Manager using the details at the beginning of this notice. Using those details will help us deal with your request promptly, but a valid request does not have to be sent to a particular person or address.
We may ask for information to confirm your identity where this is reasonably necessary. We will keep any identification request proportionate to the risk. If another person makes a request for you, we will require appropriate evidence that they are authorised to act on your behalf.
We will respond without undue delay and normally within one month. The period may be extended by up to two further months where permitted because a request is complex or you have made a number of requests. If an extension is required, we will tell you within the initial one-month period and explain why.
We will carry out reasonable and proportionate searches for the personal information covered by your request. We may ask you to clarify the information you are seeking where this is reasonably required. Where the law permits, the response period may be paused while we await that clarification.
We may withhold some information or refuse all or part of a request where an exemption or restriction applies. This may include circumstances involving legal professional privilege, crime and taxation, confidential references, management information, negotiations, manifestly unfounded or excessive requests, or information about another person. Any exemption will be considered case by case and documented. Where required, we will explain our decision and tell you how to complain.
11. Automated decision-making
We do not currently use solely automated processing to make decisions about clients that produce legal or similarly significant effects.
If this changes, we will assess the proposed processing before it begins, update this notice where necessary and put in place the safeguards required by law. These may include giving you relevant information and allowing you to make representations, obtain human intervention and contest the decision.
12. Marketing communications
We may send you information about services, events or updates that we believe may be relevant to you where we have your consent or where we are otherwise permitted to do so.
You can opt out at any time by using the unsubscribe option in a message or contacting us. We may keep a minimal record of your preference to ensure that we do not send you further marketing contrary to your wishes.
Opting out of marketing will not affect service-related communications or other processing required for our engagement or legal obligations.
13. Data-protection complaints
If you are concerned or dissatisfied about how we have collected or used your personal information, you can make a complaint to us using any of the contact methods at the beginning of this notice.
You do not need to use a particular form or describe your concern as a “data-protection complaint”. Please provide enough information for us to understand the issue and, where possible, what you would like us to do.
We will:
- acknowledge your complaint within 30 days of receiving it;
- take appropriate steps to investigate it;
- keep you informed of progress where appropriate; and
- tell you the outcome without undue delay, including any action we have taken where appropriate.
We hope that you will contact us first so that we have the opportunity to resolve your concern.
You also have the right to complain to the Information Commissioner’s Office (ICO) at any time.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
- Website: www.ico.org.uk
- Telephone: 0303 123 1113
You may also be entitled to raise a matter with our professional body, as described in our engagement terms.
14. Changes to this notice
We may update this privacy notice to reflect changes in the law, regulatory guidance, our services or the way we use personal information. The latest version will be made available through our usual client communications or published channels.
Where a change would materially affect how we use your personal information, we will take reasonable steps to bring it to your attention.
Document code: BS-Q-005 | Issue: 1.1 | Date of issue: September 2026