- We never sell your personal data.
- Your account, case files and documents are stored in the UK, and documents are encrypted.
- Nothing goes to HMRC until you approve it, and nothing goes to ANAF without the authorisation you sign.
- AI helps us prepare your work, but a person checks every result. No decision about you is made by a machine alone.
- Analytics runs only on our public pages, and only if you say yes.
- You can ask for a copy of your data, a correction or its deletion at any time.
Who we are
Ola Accountancy Ltd ("Ola Accountancy", "we", "us") is the controller of the personal data described in this notice. It covers this website (ola-accountancy.com), the client portal and staff application, and the accountancy, tax and advisory services we provide, however you contact us.
- Registered name
- Ola Accountancy Ltd
- Company number
- 15007143, registered in England and Wales
- Registered office
- 23a George Street, Luton, England, LU1 2AF
- Birmingham office
- 22-42 Washwood Heath Road, Saltley, Birmingham, B8 1RB
- ICO registration
- ZB873069
- AML supervisor
- HM Revenue & Customs, under the Money Laundering Regulations 2017
- Data protection contact
- info@ola-accountancy.co.uk · 0330 1331 886
We are not required to appoint a Data Protection Officer. Questions about this notice, and requests to use your rights, go to the contact details above.
Information we collect
What we collect depends on the services you use. For a Self Assessment return it is mostly income and expenses. For a Romanian tax-residence case it includes your Romanian identifiers and the facts ANAF asks about.
| Category | Examples |
|---|---|
| Identity and contact | Name, date of birth, nationality, address, email address, phone number. |
| Identity documents | Passport, driving licence or national ID card, proof of address. We use these for identity and anti-money-laundering checks and, for a Romanian residence case, as part of the filing. |
| Tax and official references | National Insurance number, Unique Taxpayer Reference, company registration number, PAYE and VAT references, Companies House authentication codes, HMRC authorisation codes, and your Romanian personal numeric code (CNP). |
| Financial | Income and expenses, CIS statements, employment and pension figures, bank details and statement transactions, and payment records. Card details are entered on Stripe's own page and never reach us. |
| Romanian tax residence (Z017) | When you left Romania and arrived in the UK, days spent in each country, where you live and work, whether you keep a home in Romania, family and economic ties (including details of a spouse or partner and children where they are relevant), your HMRC Certificate of Residence and its sworn translation, the authorisation (împuternicire) you sign, and messages and decisions ANAF sends about your case. |
| Business and ownership | Directors, shareholders and beneficial owners of a company we act for. |
| Benefits | For Universal Credit or PIP support: your household and circumstances, which can include health information. See special category data. |
| Signatures and approvals | Electronic signatures on declarations, approvals and authorisations: the signature image, your name, the date and time, and the IP address it was given from. |
| Account and activity | Your login email, your password (stored only as a one-way hash), sign-in and session records, and an audit log of what is done on your file and by whom, including IP addresses. |
| HMRC fraud prevention data | When you use Making Tax Digital features, the technical details HMRC requires with every submission: a device identifier, IP address, browser and screen details, and timestamps. |
| Website | IP address, pages visited and anything you send us through a form. Google Analytics only if you agree to it. |
| Referrals | If you signed up through an affiliate's link, the referral code it carried. If you are an affiliate, your name, contact details, Stripe account and referral totals. |
| Communications | Emails, messages and notes of calls and meetings with you. |
Where it comes from
Mostly from you: through the portal, our forms, email, phone, WhatsApp or meetings. Where it is relevant to your case we also receive information from HMRC, ANAF (messages and decisions in the SPV system), Companies House, your previous accountant and identity verification sources. If you followed an affiliate's link, we receive the referral code.
How we use your information and our legal basis
We only use personal data when the law gives us a basis to. Each use, and the basis we rely on for it:
| Purpose | What this involves | Legal basis |
|---|---|---|
| Providing our services | Preparing accounts, tax returns and Making Tax Digital reports, giving advice, managing your engagement, and running your Romanian tax-residence case: the questionnaire, guidance on your HMRC Certificate of Residence, the sworn translation, assembling and filing the case, and tracking it until ANAF decides. | Contract |
| Filing on your behalf | Acting as your agent with HMRC once you authorise us, and filing your Z017 case with ANAF through its online system (SPV) under the authorisation you sign. We send each authority what it requires. | Contract Legal obligation |
| Before you engage us | Answering enquiries, sending quotes you ask for, and the free eligibility pre-check before a Romanian residence case is charged. | Steps before a contract |
| Meeting our legal obligations | Identity checks and record keeping under the Money Laundering Regulations 2017, our obligations to HMRC and Companies House, sending HMRC its fraud prevention data, and keeping accounting and VAT records. | Legal obligation |
| Payments | Taking payment through Stripe, issuing invoices and refunds, and paying the share of a fee owed to a translator, partner or affiliate. | Contract Legal obligation |
| Service emails | Email verification, updates on your case, requests for documents, and deadline reminders. | Contract Legitimate interests |
| AI-assisted preparation | Suggesting categories for bank transactions, summarising documents you upload, and drafting the Romanian translation of your HMRC certificate for a sworn translator to correct and sign. How we use AI. | Legitimate interests |
| Running and protecting the business | Keeping the platform secure, keeping an audit trail, preventing fraud, finding and fixing faults (including analysing our own error logs), and improving our services. | Legitimate interests |
| Referral programme | Recording which affiliate's link you signed up through, so we can pay that affiliate. The affiliate sees only how many people signed up and when, never who. | Legitimate interests |
| Website analytics | Measuring how our public pages are used with Google Analytics. Never inside your account, and never for advertising. | Consent |
| Marketing | Telling you about our services where the law allows it. You can opt out at any time. | Consent Legitimate interests |
Where we rely on legitimate interests, we have weighed our interest against your rights and expectations. You can object at any time; see your rights.
How we use AI
Some preparation work is assisted by AI models (Anthropic's Claude models, which we run inside Amazon Web Services in the EU through Amazon Bedrock). The model provider does not receive your data, and your data is not used to train models.
A person always decides. Our accountants review every AI suggestion before it is used, and a sworn translator checks, corrects and signs every translation. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Special category data
We only process health information when you ask for help with Universal Credit or PIP, and only with your explicit consent or where the law otherwise permits it. We do not need special category data for tax returns or residence cases, so please do not upload it unless we ask.
Anti-money-laundering reporting
If we suspect money laundering, the law may require us to report it to the National Crime Agency and may prevent us from telling you that we have.
Who we share your information with
We do not sell your personal data. We share it only where we need to in order to provide our services, where the law requires it, or where you have asked us to.
Authorities
- HM Revenue & Customs: agent authorisation, tax returns, Making Tax Digital submissions and Certificate of Residence requests.
- ANAF (Agenția Națională de Administrare Fiscală, the Romanian tax authority): your Z017 questionnaire and supporting documents, when you engage that service.
- Companies House, and the National Crime Agency, police or other authorities where the law requires it.
People who work on your case
- Sworn translators we instruct to translate official documents into Romanian. They receive only the documents to be translated and your case reference.
- Our professional advisers, insurers and auditors, where needed.
Service providers
These companies process data for us, only on our instructions, under contracts that require them to keep it confidential and secure.
| Provider | What they do for us | Where |
|---|---|---|
| Amazon Web Services | Our servers, database, encrypted document storage, backups and secrets; AI models through Amazon Bedrock. | UK (London). AI processing in the EU. |
| Cloudflare | The secure connection to our servers, protection against attacks, and the icon library our pages load. | Global network |
| Vercel | Hosting for our web pages. | Global network, US company |
| Stripe | Card payments and refunds, and payouts to translators, partners and affiliates (Stripe Connect). | UK, EU, US |
| Resend | Sending our service emails. | US |
| Google Analytics on our public pages, only with your consent; Google Fonts. | EU, US | |
| Calendly | Appointment booking. | US |
| Accounting software and cloud storage | Software we use in our wider accountancy work. | UK, EU, US |
Channels you choose
If you contact us through WhatsApp (Meta) or find us through Google Maps, those services handle your data under their own privacy terms.
International transfers
Your account, case files and documents are stored in the United Kingdom, in Amazon Web Services' London region. Some processing happens elsewhere:
- EU and EEA: AI processing, ANAF and Romanian translators. The UK recognises these countries as adequate, so no extra safeguard is needed.
- United States: Stripe, Resend, Vercel, Google and Calendly may process data there. We rely on the UK–US data bridge where the provider is certified under it, and otherwise on the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
You can ask us for details of the safeguard that applies to any transfer.
How long we keep your information
We keep personal data only as long as we need it, and for at least as long as the law requires:
| Information | How long | Why |
|---|---|---|
| Anti-money-laundering records, including identity documents | 5 years after our business relationship ends | Money Laundering Regulations 2017 |
| Accounting and tax records: returns, figures, supporting documents and Romanian residence case files | At least 6 years after the end of the tax year they relate to, or after the case closes | HMRC record-keeping rules, and so we can answer questions about past filings |
| Invoices and payment records | 6 years | Company and tax law |
| Security and audit logs | Up to 6 years | Accountability, fraud prevention and resolving disputes |
| Portal page-view records | 90 days | Support and service improvement |
| Enquiries that do not lead to an engagement | Deleted within 2 years | No longer needed |
| Login sessions | 8 hours | Expire automatically |
When a period ends we delete or anonymise the data. If you ask us to erase your data while the law still requires us to keep some of it, we anonymise your account and keep only what we must until the period ends.
How we protect your information
We use technical and organisational measures in line with the ICO's security guidance and the NCSC cloud security principles. Our staff are bound by confidentiality.
Encryption
- Uploaded documents are encrypted with AES-256-GCM, each under its own key.
- HMRC access tokens are encrypted before storage; passwords are bcrypt-hashed, never stored.
- All connections use TLS 1.2 or higher, including to our database.
Separation
- Clients can see only their own data, and every request is checked for ownership.
- Accountants see only the clients in the branches they are assigned to.
Access control
- Three roles: admin, accountant and client.
- Staff accounts are by invitation only; client accounts need a verified email.
- Every access and change is written to an audit log with who, when and from which IP address.
Sign-in
- Sessions end automatically after 8 hours.
- Accounts lock for 15 minutes after 5 failed attempts.
- Password reset links are single-use, expire, and sign out every session.
If a breach puts your rights at risk, we will tell you and the ICO where the law requires it.
Your rights
Under the UK GDPR you have the right to:
- Access: get a copy of your data. We can give you a full export in a machine-readable format.
- Rectification: correct anything inaccurate, in the portal or by asking us.
- Erasure in certain circumstances.
- Restriction of processing while a concern is resolved.
- Objection to processing based on legitimate interests, and to marketing at any time.
- Portability: receive your data in a structured, machine-readable format.
- Withdraw consent where consent is our basis, without affecting what we did before.
Some rights are limited where the law requires us to keep data, for example anti-money-laundering and tax records. To use any right, email info@ola-accountancy.co.uk. We reply within one month, and will tell you if a complex request needs up to two months more.
Complaints
Please raise any concern with us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Cookies
We use essential cookies to keep you signed in and secure. With your consent, and only on our public pages, we also use Google Analytics. Nothing non-essential is set until you choose. Our Cookie Policy lists every cookie and browser setting we use, and you can change your cookie choice at any time.
Changes to this notice
We update this notice when our services or the law change. The latest version is always on this page with its date. We tell you about material changes through the portal or by email.
Contact us
Ola Accountancy Ltd
23a George Street, Luton, England, LU1 2AF
Company number 15007143
ICO registration ZB873069