Wholesums Privacy Policy

Data Protection and GDPR Compliance

Wholesums ensures full compliance with all applicable Data Protection Legislation, including the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR). We collect, process, store, and share personal information only where necessary and always in accordance with these requirements.

We do not collect or retain personal data that is not required for a specific purpose. Data is used only for the purpose for which it was collected and retained only for as long as necessary.

Data Controller

Wholesums,30 Lighthouse Park, Newquay, TR8 4AR

Email: beth@wholesums.co.uk

ICO Registration Number: ZC228627

We are responsible for deciding how personal data is collected, used, and stor

The Personal Data We Collect

We collect only the information necessary to provide bookkeeping and related services. This may include:

  • Identity data: name, address, date of birth, photo identification

  • Contact data: email address, telephone number

  • Financial data: National Insurance number, UTR, bank details, payroll information, tax records, business accounts

  • Employment data: payroll information, pension details

  • Communication data: emails, messages, and correspondence

  • Website usage data: analytics, cookies, and browsing behaviour

We do not intentionally collect children’s data.

How We Collect Personal Data

We collect data directly from you when you:

  • Engage our services

  • Provide documents or information

  • Communicate with us

  • Use our website or social media channels

We may also receive data from:

  • HMRC

  • Companies House

  • Pension providers

  • Payroll software

  • Accountants or financial advisers

  • Mortgage lenders or finance providers (when you request information be shared)

Purpose for Processing Personal Data

We process personal data for the following purposes:

  • Delivering bookkeeping, accounts, payroll, VAT, CIS, and tax services

  • Meeting legal obligations (e.g., HMRC submissions, AML requirements)

  • Managing client relationships and communications

  • Responding to enquiries

  • Maintaining accurate records

  • Providing information to lenders or financial institutions at your request

  • Operating and improving our website

We do not use personal data for automated decision‑making.

Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR:

  • Contract – to provide the services you have engaged us for

  • Legal obligation – to comply with HMRC, Companies House, and AML regulations

  • Legitimate interests – for internal administration, fraud prevention, and secure operation of our services

  • Consent – for optional marketing communications (where applicable)

Sharing Personal Data

We only share personal data when necessary and lawful. This may include sharing with:

  • HMRC

  • Companies House

  • Pension providers

  • Payroll and accounting software providers

  • Professional advisers (e.g., accountants, solicitors)

  • Mortgage lenders or finance providers (at your request)

  • IT service providers

  • Website hosting and email providers

We do not sell personal data.

Subject Access Requests (SARs)

SARs may be made verbally or in writing. Wholesums will:

  • Verify identity

  • Provide requested information within one month

  • Extend the deadline by two months for complex requests (with notification)

  • Not charge a fee unless the request is manifestly unfounded or excessive

Data Breach Reporting

Wholesums maintains internal breach procedures including:

  • Identification and containment

  • Assessment of risk

  • Notification to affected individuals where required

  • Notification to the ICO within 72 hours where legally required

  • Documentation of all breaches, regardless of severity

International Transfers

Some third‑party service providers may store data outside the UK. Where this occurs, we ensure appropriate safeguards are in place to protect your data.

Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to meet legal obligations.

Typical retention periods include:

  • Financial records: 6–7 years

  • Payroll records: 6 years

  • Communications: as long as necessary to manage your account

  • Website analytics data: short‑term retention for performance monitoring

A detailed retention schedule is maintained internally within our GDPR Policy.

Third Party Processors

Wholesums use trusted third‑party processors to deliver services, including:

  • Accounting software

  • Payroll software

  • Cloud storage providers

  • Email and website hosting providers

  • CRM or AML verification tools

  • IT support providers

All processors are subject to contractual obligations ensuring compliance with UK GDPR.

A full processor list is maintained internally.

Your Rights

Under UK GDPR, you have the right to:

  • Access your personal data

  • Request correction of inaccurate data

  • Request erasure of your data (where applicable)

  • Request restriction of processing

  • Object to processing

  • Request data portability

  • Withdraw consent (where consent is the lawful basis)

To exercise your rights, contact us at: beth@wholesums.co.uk

We will respond within one month.

Website, Cookies & Analytics

Our website uses cookies and analytics tools to improve functionality and understand visitor behaviour.

Cookies may collect:

  • IP address

  • Browser type

  • Pages visited

  • Time spent on the site

You can manage or disable cookies through your browser settings.

We use analytics tools such as Google Analytics or built‑in website analytics to monitor website performance. This data does not identify individuals.

Social Media & Messaging

Engagement, messages and actions via social media platforms may be stored by those platforms according to their own privacy policies. We only retain such messages as long as necessary to respond or provide services.

Email & Telephone

We use secure email services with encryption. Caller line identification (CLI) may be used to identify incoming calls. You may disable this through your phone settings.

Any emails sent from Wholesums are confidential. If you receive an email or message in error, please delete it immediately and notify the sender immediately by return email or via a phone call.

It cannot be guaranteed that all internet communications are secure, error or virus-free. We do not accept liability for any errors or omissions

Complaints

If you have concerns about how your data is handled, please contact us:

Email: beth@wholesums.co.uk

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF www.ico.org.uk Telephone: 0303 123 1113

Changes to This Privacy Policy

We review this Privacy Policy regularly and update it when necessary. The latest version will always be available on our website.

Last updated 30/08/2026