Privacy Policy
Last updated: 10 September 2026
1. Who we are
Annual-accounts.co.uk is operated by Drummond Advisory Ltd, a company registered in England and Wales (company number 15208903). Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
Andy Drummond ACA (ICAEW member 1882910) is the data controller responsible for this service. You can contact us at any time at andy@annual-accounts.co.uk.
We are committed to handling your personal data responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What data we collect
We collect the following categories of information when you use our service:
Information you provide directly:
• Your name and email address
• Your company name and company number
• Financial information about your company (income, expenses, assets, and liabilities) as entered via our onboarding form
• Your Companies House authentication code (used solely to submit filings on your behalf)
• Prior year filing details where relevant
Identity verification information, which we are required by law to collect before we can act for you:
• Your title, full name, gender, date of birth and residential address. The identity check matches these against credit reference records, and the service we use requires all of them
• Where a document-based check is used: an image of your passport, driving licence or national identity card, and a short “liveness” selfie or video used to confirm that the person presenting the document is the person shown on it
• In some cases, a document evidencing your address, such as a recent bank statement or utility bill. We ask for this only where the check cannot be completed without it, so you may not be asked for one
• The results of the identity, sanctions and politically-exposed-person checks we carry out on that information
Where a company has beneficial owners or people with significant control, we collect and screen the same information about them.
The liveness check involves biometric data — a facial image processed to confirm it matches the photograph on your identity document. This is treated as special category data and is explained at section 3.
Information collected automatically:
• Basic website analytics (pages visited, time on site) via Google Analytics
• Payment transaction data processed by Stripe (we do not store card details ourselves)
3. Why we collect your data and our legal basis
We process your data for the following purposes:
• To prepare and file your statutory accounts and CT600 corporation tax return — lawful basis: performance of a contract
• To communicate with you about your filing, including requesting missing information and confirming submission — lawful basis: performance of a contract
• To act as your agent with HMRC and Companies House — lawful basis: performance of a contract
• To verify your identity, and to screen you against sanctions, politically-exposed-person and adverse-media sources, as we are legally required to do before acting for you — lawful basis: legal obligation. We are required to carry out customer due diligence by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, and we are supervised for this purpose by the ICAEW (firm reference C011009439). Separate obligations under the UK sanctions regime apply to us whatever the money-laundering risk. If we cannot complete these checks, we are not permitted to act for you.
• To process payment via Stripe — lawful basis: performance of a contract
• To use AI-assisted tools to prepare draft accounts and tax returns as part of delivering the service — lawful basis: performance of a contract
• To improve our service and understand how the website is used — lawful basis: legitimate interests
• To send you important service updates (e.g. changes to pricing or terms) — lawful basis: legitimate interests
Sanctions, PEP and adverse-media screening. Because these checks exist to establish whether someone has been involved in an unlawful act, or in dishonesty or other seriously improper conduct, they involve processing information about criminal offences under Article 10 of the UK GDPR — and they do so on every client we screen, including where the result is clear. We process that information under the condition in Schedule 1, Part 2, paragraph 12 of the Data Protection Act 2018, which covers processing necessary to comply with a regulatory requirement of this kind. We hold an appropriate policy document, as that Schedule requires, and we will provide a copy on request.
Biometric data. Where identity is verified using a document and a liveness check, the facial image is used to confirm that you are the person shown on your identity document. Because it is used to identify you, this is “special category” data under Article 9 of the UK GDPR. We process it under Article 9(2)(g), substantial public interest, relying on the same Schedule 1 condition. It is used only to verify your identity, is never used for any other purpose, and is not used to train any automated or artificial-intelligence system.
No automated decisions. No decision about whether we can act for you is made automatically. Our checks return results; a person reviews them and decides, and records the reasons.
4. Who we share your data with
We share your data only where necessary to deliver the service. Our providers act as our processors and may only use your data on our instructions.
To prepare and file for you
• HMRC and Companies House — to submit your statutory filings on your behalf
• TinyTax — the software used to prepare and submit your accounts and corporation tax return
• Tally — the online form through which you give us your company information
• Xero — used to prepare accounts and tax computations for some clients, and to keep our own accounting records, which include your name and billing details
• Anthropic, Inc. — AI-assisted tools used to prepare your draft accounts and tax return. A chartered accountant reviews everything before it reaches you, and nothing is filed until you have approved it
To verify who you are, as the law requires
• Credas Technologies Ltd — document and biometric identity verification, where that route is used
• TaxCalc (Acorah Software Products Ltd) and Equifax — electronic identity verification against credit reference data, and sanctions, politically-exposed-person and related screening
• ICAEW, using Dow Jones Risk & Compliance data — politically-exposed-person and sanctions screening, where a document-based identity route has been used
To take payment and keep your records
• Stripe — to process your payment securely. We never see or store your card details
• Airtable — our customer records system, which holds your contact and engagement details
• Apple iCloud Drive — where your working files and draft accounts are stored
To run the business
• Our email, website and infrastructure providers — to communicate with you and to operate and protect the website
• Trustpilot — review invitations after your filing is complete
• Instantly — email outreach to prospective customers. This does not process the data of existing customers
• Google (Google Analytics) — website analytics, so we can see how the site is used and improve it. We do not use it for advertising.
We do not sell your data to third parties.
Transfers outside the UK. Some of our providers process data outside the United Kingdom, including in the United States. Where that happens we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy regulation, as applicable to that provider.
5. How long we keep your data
We retain your data for as long as necessary to fulfil the purposes for which it was collected, and to comply with our legal obligations. In practice:
• Financial and filing records are retained for a minimum of six years in line with standard UK accounting and tax requirements
• Email communications are retained for up to three years
• Identity verification and anti-money-laundering records — including identity documents, biometric check results and screening results — are retained for five years from the end of our relationship with you, as required by regulation 40 of the Money Laundering Regulations 2017. This period runs from when our relationship ends, not from when the records were created, and we are not permitted to delete them earlier even if you ask us to.
• If you request deletion and there is no overriding legal obligation to retain the data, we will delete it within 30 days. Anti-money-laundering records are subject to the mandatory retention period above and cannot be deleted on request.
6. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
• Right of access — you can request a copy of the data we hold about you
• Right to rectification — you can ask us to correct inaccurate data
• Right to erasure — you can ask us to delete your data where there is no overriding legal reason to retain it
• Right to restriction — you can ask us to restrict processing of your data in certain circumstances
• Right to portability — you can ask us to provide your data in a portable format
• Right to object — you can object to processing based on legitimate interests
To exercise any of these rights, please contact us at andy@annual-accounts.co.uk. We will respond within one month.
If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
7. Cookies and analytics
Our website uses cookies to help it function and to understand how visitors use it.
We use Google Analytics to collect statistics about how the site is used — which pages people visit, how long they stay, and how they arrived — so that we can improve it. Google Analytics sets cookies that give your browser an identifier. We do not use this information to identify you personally, we do not use it for advertising, and we do not use it to build a profile of you.
If you would rather not be included, you can block these cookies through your browser settings, or install Google’s own opt-out browser add-on. Blocking some cookies may affect how the website functions.
8. Security
We take appropriate technical and organisational measures to protect your data from unauthorised access, disclosure, or loss. Your financial information is transmitted over encrypted connections (HTTPS). Payment processing is handled entirely by Stripe and card details are never transmitted to or stored by us.
As a small service operated by a qualified chartered accountant, your data is accessed only by us and the third-party processors listed in section 4. It is not shared with anyone else.
9. Changes to this policy
We may update this privacy policy from time to time. If we make material changes, we will notify existing customers by email. The date at the top of this page indicates when it was last updated.
10. Contact us
For any questions about this privacy policy or how we handle your data, please contact:
Andy Drummond ACA
Drummond Advisory Ltd
andy@annual-accounts.co.uk
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
11. Previous versions
Previous versions of this Privacy Policy are available here: