1. Introduction

This Privacy Policy explains how Bella Accounting processes personal data when you use our website, contact us, or use our services.

We process personal data in accordance with the UK GDPR, the Data Protection Act 2018, and the Data Use and Access Act 2025 (DUAA 2025), as well as any other applicable UK laws.

2. Data Controller

The data controller is:

3. Person Responsible for Data Protection

The person responsible for data protection at Bella Accounting is Izabella Radwan. For data protection enquiries, please contact us at info@bellaaccounting.co.uk.

4. What Personal Data We Process

Depending on your relationship with us, we may process:

• Enquiries / potential clients: name, email, phone, message content, form data.
• Clients / contractors: identification and contact details, company and billing data, correspondence and documents necessary to deliver services.
• Website visitors: technical data (IP address, device/browser identifiers), usage data, cookies.

Special category data: We do not ask for sensitive personal data via our website as a rule. If we receive it or it is necessary for a specific matter, we process it only in accordance with Article 9 UK GDPR and with enhanced safeguards.

5. Purposes and Lawful Bases (UK GDPR)

We process personal data only where we have a lawful basis:

• Contract / pre-contract steps (Art. 6(1)(b)) – e.g. preparing a quote, delivering a service.
• Legal obligation (Art. 6(1)(c)) – e.g. obligations arising from UK law (HMRC, AML/KYC, record-keeping).
• Legitimate interests (Art. 6(1)(f)) – e.g. IT security, defending claims, improving our services, B2B marketing within permitted limits. Where we rely on legitimate interests, we document a balancing test (LIA).
• Consent (Art. 6(1)(a)) – e.g. newsletter or marketing communications where required.

Where special category data is processed, an appropriate Article 9 condition also applies.

6. Sources of Your Data

We collect data directly from you (via contact forms, email, phone, or contract), and from your organisation if you contact us on behalf of a business.

7. Who We Share Data With

We may share data with:

• IT and hosting providers (as data processors, under written contracts).
• Professional advisers where necessary.
• Public authorities and regulators (e.g. HMRC, law enforcement) only where legally required.

We do not sell personal data.

8. International Transfers

If personal data is transferred outside the UK, we apply appropriate safeguards such as adequacy decisions, Standard Contractual Clauses (SCCs), or other lawful mechanisms. Transfers are documented and assessed where required (TRA).

9. Automated Decision-Making and Profiling

We do not carry out automated decision-making or profiling within the meaning of the UK GDPR.

10. Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, and to meet legal requirements:

• Enquiries / leads (no contract): 12 months
• Client files and services: 6 years after completion
• Billing, tax and financial records: 6 years
• Recruitment applications: 6 months
• Marketing consent: until withdrawn or objected to

After the relevant retention period, data is securely deleted or anonymised.

11. Your Rights (UK GDPR)

You have the following rights in relation to your personal data:

• Right of access (Subject Access Request / SAR)
• Right to rectification
• Right to erasure (where applicable)
• Right to restriction of processing
• Right to data portability (where applicable)
• Right to object (particularly to processing based on legitimate interests)
• Right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal)
• Right to lodge a complaint with the ICO

To exercise any of these rights, please contact us at info@bellaaccounting.co.uk.

12. Data Subject Access Requests (DSARs)

DSARs can be submitted by email to info@bellaaccounting.co.uk. We respond within one month as a rule. For security, we may verify your identity and ask you to clarify the scope of your request.

Where we request clarification or additional information necessary to respond, the response deadline may be paused until we receive it.

We may refuse requests that are manifestly unfounded or excessive, in accordance with applicable law.

13. Complaints – Internal Process

If you have concerns about how we process your personal data, please contact us in the first instance at info@bellaaccounting.co.uk. We acknowledge complaints within 72 hours and aim to respond within 30 days.

If you are not satisfied with the outcome, you have the right to complain to the ICO.

14. ICO Contact Details

15. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be published on this page with the date of last update shown above.

This policy should be read together with our Cookie Policy.