Privacy notice

Last updated: 9 October 2026.

Who we are

RM Accountancy is the trading name of R M Accountancy Services Ltd, company number 04446545. Our address is The Old Post Office, 137-139 Long Street, Dordon, Tamworth, B78 1SH.

This notice explains how we use personal information about website visitors, people who enquire about our services, clients and people connected with our clients. It does not cover recruitment or our own employees.

For privacy questions or requests, contact Richard Morrall at enquiries@rmaccountancy.com, call 01827 896300, or write to our address above, marking your correspondence “Privacy”.

Our role

We are a data controller where we decide why and how personal information is used, including managing enquiries and client relationships, providing professional advice and meeting our legal obligations. For some work, such as processing payroll solely on an employer’s instructions, we may act as a data processor. The role depends on the particular service and is set out in our engagement arrangements. Where we act as a processor, the client’s own privacy notice also applies.

The information we use

Depending on the services involved, we use names, addresses, contact details, dates of birth, signatures, identity documents, tax and National Insurance references, company and ownership details, financial records, bank and payment information, correspondence and records of advice.

Payroll and pension work may involve pay, deductions, benefits, employment details, absences and pension information. Some records may contain sensitive information, such as health details or trade-union deductions. We only need information relevant to the work we undertake.

We receive information from you, your business or employer, authorised representatives, previous accountants, HMRC, Companies House, pension providers and accounting or payroll systems used for the agreed services. Public registers may also help us check company and ownership information.

Why we use information and our lawful bases

Enquiries and appointments: to answer questions, discuss services and arrange meetings. We rely on steps towards a contract where you are the prospective contracting individual, or our legitimate interest in responding to business enquiries.
Providing services: to prepare accounts, tax returns, bookkeeping, payroll, pensions and financial advice. We rely on our contract with you where you are the contracting individual; otherwise, our legitimate interests in delivering the agreed service to our business client. Processing undertaken solely on a client’s instructions is governed by the relevant processing agreement.
Legal and regulatory duties: to carry out identity and anti-money-laundering checks, keep required records and make disclosures where the law requires us to do so. We rely on legal obligations.
Running and protecting the practice: to manage fees and payments, maintain records, secure systems, resolve complaints and establish or defend legal claims. We rely on applicable legal obligations and our legitimate interests in operating a reliable practice and protecting our rights.
Service communications: to send information relevant to the work we provide, relying on the same basis as that work. Optional promotional communications are separate; where consent is required, we will ask for it. You can opt out of marketing at any time.

Legitimate interests do not override your rights. Where sensitive or criminal-offence information is involved, an additional legal condition or authority is required; an ordinary contract or legitimate interest alone is not enough. For employer-controlled payroll processing, we process such information only under the employer’s lawful instructions and the agreed safeguards.

If you do not provide information required for identity checks or for the agreed work, we may be unable to accept instructions, continue acting or complete the relevant filing. We will explain what is needed.

Who we share information with

Where necessary for the agreed work or required by law, recipients include HMRC, Companies House, pension providers, authorised advisers, your nominated contacts, regulators and law-enforcement bodies. Information filed on public registers may become publicly available.

We also use providers of accounting, tax, payroll, document storage, email, appointment booking, payment collection, IT support and website hosting. Relevant systems include Microsoft 365 and SharePoint, Microsoft Outlook booking, Xero, QuickBooks, Sage, IRIS Elements, BrightPay and Fasthosts. Only the providers needed for the particular service receive the relevant information. Professional advisers and insurers may receive information where necessary to advise us or handle a claim.

We do not sell personal information. Access within the practice and by service providers is limited to what is needed for their work, with appropriate confidentiality and contractual arrangements.

Use of business AI services

We use business AI services to assist with client work, including processing identifiable client information, subject to the providers’ contractual data-protection and retention arrangements. Retention and other protections depend on the service, business plan and settings used.

International processing

Cloud services may involve storage or access outside the UK. Before making a restricted international transfer, we require an applicable UK adequacy regulation or appropriate safeguards, such as approved contractual protections, and any necessary assessment. Contact us for details of the arrangements and relevant safeguards applying to your information.

How long we keep information

We retain information for as long as it is needed for the purpose for which it was collected, taking account of the following criteria:

Enquiries and appointments: whether the enquiry remains active, any agreed follow-up, and whether a record is needed to resolve a complaint or dispute. If you become a client, relevant information becomes part of the client record.
Accounts, tax, payroll and advice: applicable record-keeping duties, the periods covered by our work, ongoing client needs, HMRC enquiries and the period during which a claim may arise. We do not apply one period indiscriminately to every type of record.
Anti-money-laundering records: generally five years after the business relationship ends or the relevant occasional transaction is completed, subject to the applicable legal requirements and exceptions.
Technical and security records: the time needed to operate and protect systems, investigate incidents and meet the hosting provider’s applicable retention arrangements.

A legal hold, investigation or unresolved dispute may require relevant records to be retained longer. Once information is no longer required, it is securely deleted or anonymised. Backup copies are removed through the applicable backup-retention cycle.

Website, bookings and external services

You can contact us using the email and telephone links on this website. Appointment links open Microsoft Outlook booking. Links to Google Maps, LinkedIn and what3words open external services with their own privacy information.

The website loads fonts from Google Fonts, so your browser connects to Google to retrieve them and sends technical information needed for that connection, including your IP address. Website hosting also involves technical information used to deliver pages and protect the service.

WordPress uses cookies for functions such as administrator sign-in. If we introduce optional tracking or other non-essential cookies, we will provide the required information and obtain consent where required before using them. Browser settings allow you to manage cookies, although blocking necessary cookies can affect functionality.

Your rights

Depending on the circumstances, you can request access to your information, correction of inaccurate information, deletion, restriction of processing and a portable copy of information you provided. These rights are subject to legal conditions and exemptions; for example, we may need to keep records required by law.

You have the right to object to processing based on legitimate interests because of your particular circumstances, and an absolute right to object to the use of your information for direct marketing.

Where processing relies on consent, you can withdraw it at any time by contacting us. This does not affect processing carried out lawfully before withdrawal.

Contact us using the details above. We may need proportionate information to confirm your identity. We normally respond within one month, subject to any lawful extension or applicable pause, which we will explain. If we hold information solely as a processor, we will assist the relevant controller with your request.

Questions and complaints

Please contact Richard Morrall using the details above if you are concerned about our use of your information. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or call 0303 123 1113.

Changes to this notice

We will review this notice when our services or use of personal information change and update the date shown on the published version. Where required, we will tell affected people about a material change.