Privacy notice

1. Who we are

DELAKAZZI ACCOUNTANTS LIMITED ("Delakazzi", "we", "us" or "our") is the controller responsible for the personal information described in this notice. We are registered in England and Wales under company number 13101830. Our registered office is 8 Walton Road, London N15 4PP. Meetings are by appointment only.

Contact us about privacy or make a data-protection complaint at aml@delakazzi.co.uk, by telephone on 020 3870 5275, or by post to the registered office. Delakazzi is registered on the Information Commissioner's Office register of data protection fee payers under reference ZB066457.

2. Who and what this notice covers

This notice covers website visitors, people who enquire about our services, prospective, current and former clients, and individuals connected with a client or matter. Connected people may include directors, shareholders, beneficial owners, trustees, beneficiaries, employees, pension members, family members, professional advisers, counterparties and other contacts. Separate information may apply to employees and job applicants.

Depending on the relationship and service, we may use:

• identity, contact, engagement and eligibility details;
• dates of birth, signatures, National Insurance numbers, Unique Taxpayer References and other tax or government identifiers;
• company, trust, ownership, control, source-of-funds and source-of-wealth information;
• accounting, banking, transaction, payroll, pension, tax, VAT and business records;
• identity-verification, sanctions, politically exposed person, fraud-prevention and anti-money-laundering records;
• communications, instructions, complaints, service history and professional working papers; and
• website, device, access, security and technical records created by the hosting, bot-protection and communications services.

3. Where information comes from

We normally obtain information from you, the client, an authorised representative or another person connected with the engagement. We may also receive it from HM Revenue & Customs, Companies House, other public registers, previous advisers, banks or platforms you authorise, identity and anti-money- laundering providers, professional or legal advisers, regulators and other lawful sources. If someone gives us information about another person, they should be authorised to do so and should direct that person to this notice where appropriate.

4. Why we use information and our lawful bases

Enquiries, quotations and acceptance checks

To respond, understand the requested service, screen conflicts, check eligibility, independence, competence and capacity, and take steps requested before a contract. We rely on steps before a contract with the individual and our legitimate interests in managing enquiries and protecting the practice and its clients.

Professional services and client administration

To provide agreed accountancy, tax and specialist services, communicate, maintain working papers, bill and collect fees and manage the engagement. We rely on contract where the individual is our client, legal obligations, and our legitimate interests in providing and evidencing services where the client is an organisation or another person.

Legal, regulatory and anti-money-laundering duties

To verify identity and ownership, assess risk, keep required records, make legally required reports and respond to regulators, courts or public authorities. We rely on legal obligations and, where relevant, the establishment, exercise or defence of legal claims.

Quality, security and business protection

To supervise work, maintain professional standards, prevent or investigate misuse and fraud, secure systems, manage complaints, insurance, debt recovery and legal claims, and maintain business continuity. We rely on legal obligations and our legitimate interests in operating a secure, accountable professional practice.

Optional communications and marketing

To send information about relevant services only where permitted. We will rely on consent or a documented legitimate-interest route, as applicable, and comply with the Privacy and Electronic Communications Regulations. You may object or opt out at any time. No marketing consent is requested by the website enquiry form.

Providing core identity, tax, engagement and anti-money- laundering information may be required by law or necessary to enter into or perform an engagement. If it is not provided, we may be unable to act. We will explain any specific consequence at the time.

5. More sensitive information

Records supplied for payroll, tax, trust, forensic or other work may sometimes reveal health, disability, racial or ethnic origin, religious or philosophical beliefs, trade-union membership, sexual orientation, or alleged or proven offences. We use this information only where it is necessary and the law permits it. In addition to an ordinary UK GDPR lawful basis, we identify and document the applicable Article 9 condition for special-category information or the applicable Article 10 and Data Protection Act 2018 condition for criminal-offence information. We maintain an appropriate policy document where the law requires one.

6. Who we may share information with

We share only what is reasonably necessary for the relevant purpose. Recipients may include authorised Delakazzi personnel and contractors; HM Revenue & Customs, Companies House, regulators and professional bodies; courts, law-enforcement or other public authorities where lawfully required; banks, payment and insurance providers; legal and other professional advisers; and providers of hosting, email, communications, accounting, tax, payroll, identity-checking, security, backup and support services.

We require processors to act on documented instructions, protect the information and meet applicable data-protection obligations. We do not sell personal information.

Our current operational systems include VT Accounts and TaxCalc for accounts and tax work; QuickBooks Online, Xero and Sage for relevant bookkeeping or accounting work; TaxCalc and QuickBooks Online for practice administration; TrustID for identity and anti-money-laundering checks; Dropbox Business for primary cloud document storage; Signable through TaxCalc for electronic signatures; and IONOS-hosted email accessed through Outlook and authorised mobile mail applications. A provider's legal role may vary by service. We maintain the more detailed supplier and processing record internally and may update this list as arrangements change.

7. International transfers

Some of the cloud, communications, identity-verification and software providers named above, Cloudflare, Postmark or their subprocessors, may store or access information outside the United Kingdom. Where restricted transfers occur, we assess the arrangement and rely on an applicable UK adequacy regulation or an approved safeguard such as the UK International Data Transfer Agreement or UK Addendum, with any required transfer-risk assessment and supplementary measures. Contact us for information about the safeguard relevant to your data.

8. How long we keep information

We keep information only for as long as needed for the purpose for which it was collected, including legal, regulatory, professional, tax, accounting, limitation, insurance and claim requirements. Periods are set by category in our retention schedule rather than by one blanket rule.

Ordinary enquiries that do not become client engagements are normally kept for 12 months after the last meaningful contact, then securely deleted or anonymised. We may retain a limited record for longer where it is reasonably necessary for conflict management, a complaint, fraud or security prevention, legal claims, or another legal or regulatory obligation.

Anti-money-laundering customer-due-diligence and relevant transaction records are generally kept for five years after the business relationship ends or an occasional transaction is completed, then deleted unless law permits or requires longer retention. Professional client and engagement records are normally kept for six years after the relevant engagement or relationship ends, subject to different statutory, regulatory, contractual or professional periods. This normally covers engagement records, tax and accounts working papers, substantive advice and correspondence, e-signature evidence, complaints and former-client files. PAYE records have a statutory minimum that may be shorter, while open tax enquiries, trusts, forensic matters, disputes, complaints, claims and other justified matters may require longer case-specific retention. Routine administrative email is deleted when no longer needed, and backups follow a documented lifecycle rather than indefinite retention. Information subject to a legal or regulatory hold is not destroyed until the hold ends. When information is no longer required, it is securely deleted or anonymised.

9. Security and document exchange

We use proportionate technical and organisational measures to protect personal information, including access controls and secure transfer arrangements appropriate to the information. No method is completely risk-free. The public form is deliberately limited to a brief, non-sensitive initial enquiry and does not accept attachments. Cloudflare Turnstile performs a security check and creates a short-lived verification token. If the submission is accepted, Postmark sends one transactional notification to Delakazzi's monitored enquiry mailbox. The website does not use a client database to retain the form entry. Ordinary enquiries that do not become clients follow the 12-month retention position in section 8. The current website does not provide a client login or secure document-upload service. Do not put identity documents, bank records, accounts, login credentials, detailed allegations or privileged material into the form or ordinary first-contact email. Existing clients should ask us for the agreed secure transfer route.

10. Your rights

Depending on the circumstances, you may have rights to be informed, obtain access, correct inaccurate information, have information erased, restrict its use, object to processing and receive information in a portable format. Where we rely on consent, you may withdraw it at any time without affecting use before withdrawal. Rights can be limited where another law requires retention, an exemption applies or the right is not available for the relevant lawful basis.

To exercise a right, email aml@delakazzi.co.uk. We may need to verify identity and clarify the request. We do not charge a fee in ordinary cases.

11. Complaints

Please contact us first if you are concerned about our use of personal information. We will acknowledge a data-protection complaint within 30 days, investigate it without undue delay, keep you informed as appropriate and tell you the outcome. You may also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by telephoning 0303 123 1113. Your right to complain to the ICO is not affected by contacting us first.

12. Automated decisions, children and changes

We do not intend to make decisions about people based solely on automated processing where the decision has a legal or similarly significant effect. This website and our professional services are not directed to children, although information about a child may be relevant to an authorised tax, payroll, trust or other engagement. We will update this notice when our processing or legal obligations change and display the current date here.

Updated: 18 August 2026. This notice reflects the active website enquiry route and the practice arrangements confirmed for this launch.