Privacy policy.

1. Who Finstem is

Finstem Ltd (company number 16803940), trading as Finstem Accountants (“Finstem”), is a licensed accountancy practice and the data controller for the personal data described in this policy. Its registered office is 21 Hampton Road, Oswestry, Shropshire SY11 1SJ, and it is registered with the Information Commissioner’s Office under number ZC109491. Finstem is committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data Finstem collects

Finstem collects the following personal data when you use this website or engage its services:

• Contact information: name, email address, phone number
• Business information: business name, annual turnover, entity type, services of interest
• Enquiry details: description of your needs, how you heard about Finstem
• Technical data: device type, page URL, referrer URL, UTM campaign parameters, form completion time
• Analytics data: pages visited, session duration, approximate location (city/country level), device and browser type, traffic source — collected via Google Analytics only where you have consented (see section 11)
• Financial data: when you engage Finstem’s services, it processes financial records as required to deliver those services

3. How Finstem uses your data

Finstem uses your personal data for the following purposes:

• To respond to your enquiry and provide an initial assessment
• To deliver accountancy, tax compliance, financial modelling or business valuation services
• To comply with its legal and regulatory obligations (HMRC, Companies House, its licensing body)
• To communicate with you about your account or Finstem’s services
• To collect anonymous website analytics to improve this site
• To measure whether Finstem’s advertising leads to enquiries, where you have consented to marketing cookies (see section 11)

4. Legal basis for processing

Finstem processes your data under the following lawful bases:

• Legitimate interest: to respond to enquiries submitted through the forms on this website (Article 6(1)(f) UK GDPR). Finstem’s legitimate interest is in responding to prospective clients who contact it. You can object to this processing at any time
• Contract: to deliver services you have engaged Finstem to provide (Article 6(1)(b))
• Legal obligation: to comply with tax, anti-money laundering and regulatory requirements (Article 6(1)(c))
• Legitimate interest: to collect anonymous, cookie-free page-view statistics through Finstem’s own system, to understand how visitors use this site and improve its services (Article 6(1)(f)). See section 11 for details
• Consent: to set analytics and marketing cookies (Google Analytics 4 and the Meta Pixel), which are loaded only after you choose “Accept” on the cookie banner (Article 6(1)(a) UK GDPR and the Privacy and Electronic Communications Regulations 2003). You can withdraw consent at any time — see the Cookie Policy

5. Client onboarding and AML data

When you onboard as a client, Finstem collects the following additional data as required by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017:

• Identity documents: passport or driving licence (photo or scan)
• Proof of address: utility bill, bank statement or council tax bill (dated within 3 months)
• Business verification: company name, number and registered address (verified against Companies House)
• Engagement acceptance: timestamp of your acceptance of Finstem’s terms of engagement

This data is collected under Finstem’s legal obligation to perform Customer Due Diligence (CDD) before establishing a business relationship. Identity documents are encrypted at rest (AES-256) and stored securely on AWS S3 in the UK (London region). Access is restricted to authorised personnel only.

Retention: AML/CDD records are retained for 5 years after the end of the business relationship, as required by regulation 40 of the Money Laundering Regulations 2017.

6. Data retention

• Enquiry data: retained for 12 months from submission, then deleted
• Working papers and professional records: retained for 7 years after the end of the engagement, in accordance with professional standards
• Tax records and financial data: retained for 6 years after the end of the relevant tax year, as required by HMRC under Schedule 36 of the Finance Act 2008
• AML/CDD records: retained for 5 years after the end of the business relationship, as required by the Money Laundering Regulations 2017

7. Data sharing and sub-processors

Finstem will never sell your data to third parties. Finstem may share your data with:

• HMRC, Companies House or other regulatory bodies as required by law
• The sub-processors listed in the table below, who act as data processors under appropriate data processing agreements
• Professional indemnity insurers, where required

The following third-party sub-processors may process personal data on Finstem’s behalf. Finstem has assessed each against its data protection obligations and has appropriate agreements in place.

Finstem will notify you of any material changes to its sub-processors. You may object to the addition of a new sub-processor; if Finstem is unable to provide the services without that sub-processor, either party may terminate the engagement under the terms of the engagement letter.

8. International data transfers

Where personal data is transferred outside the UK, Finstem ensures appropriate safeguards are in place in compliance with Chapter V of the UK GDPR. The transfers and safeguards for each sub-processor are set out in the table in section 7 above. No data is transferred to a country without either UK adequacy regulations applying, or Standard Contractual Clauses (SCCs) and/or a UK International Data Transfer Agreement (IDTA) in place.

9. Your rights

Under UK GDPR, you have the right to:

• Access the personal data Finstem holds about you (Subject Access Request)
• Rectify inaccurate data
• Request erasure of your data (subject to legal retention requirements)
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (where consent is the lawful basis)

To exercise any of these rights, email huw@finstem.co.uk. Finstem will respond to all requests within one calendar month of receipt, as required by Article 12(3) UK GDPR.

10. Automated decision-making

Finstem does not use automated decision-making or profiling as defined by Article 22 of the UK GDPR. All decisions relating to your engagement, services or account are made by a person.

11. Cookies and tracking

This website uses cookies and similar technologies. Full details, including how to withdraw your consent, are set out in the Cookie Policy. In summary:

• Strictly necessary: your cookie choice itself is stored in your browser’s local storage (cookie-consent) so that the banner is not shown on every visit. No other strictly necessary cookies are set.
• Analytics (with your consent): Google Analytics 4 (provided by Google LLC) is loaded only after you choose “Accept” on the cookie banner. It uses first-party cookies (e.g. _ga, _ga_*) to distinguish unique visitors and track session information, and records pages visited, session duration, approximate geographic location (city/country level), device type, browser type, operating system, screen resolution, traffic source (e.g. search engine, direct, referral) and language preference. Google Analytics does not collect your name, email address or other personally identifiable information unless you submit it through a form, and Google Analytics 4 does not log or store full IP addresses. Google operates as a data processor under Finstem’s instructions, may process the data on servers outside the UK including in the United States, relies on Standard Contractual Clauses (SCCs) for international transfers, and processes data in accordance with its privacy policy.
• Marketing (with your consent): the Meta Pixel (provided by Meta Platforms) is loaded only after you choose “Accept”. It records a page view and enquiry events so that Finstem can measure whether its advertising on Meta platforms leads to enquiries. Meta processes this data in accordance with its privacy policy.

Finstem also collects anonymous page-view analytics via its own lightweight system for basic traffic monitoring. This includes: page URL, device type, browser type, country (derived from request headers), referrer URL and interaction events such as scroll depth and clicks on contact buttons. No cookies are set by this system, no personal data is stored, and no individual visitors can be identified. If your browser sends a Do Not Track (DNT) signal, no data is collected by this system. This processing is based on Finstem’s legitimate interest in understanding site usage and improving its services (Article 6(1)(f) UK GDPR).

Withdrawing consent: clear this site’s data in your browser and the cookie banner will reappear on your next visit, or block cookies from googletagmanager.com and facebook.com in your browser settings. You can also install the Google Analytics Opt-out Browser Add-on.

The only personally identifiable data collected beyond analytics is what you voluntarily submit through the forms on this site, plus the technical metadata listed in section 2 which is captured automatically when you submit a form.

12. Data security

Finstem takes appropriate technical and organisational measures to protect your data, including:

• Secure, encrypted communication channels
• Access controls limiting data access to authorised personnel only
• Regular security reviews of its systems and processes
• Identity documents encrypted at rest using AES-256 on AWS S3
• Presigned, time-limited upload URLs (documents are never transmitted through Finstem’s application servers)

13. Data breaches

In the event of a personal data breach, Finstem will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, where the breach is likely to result in a risk to your rights and freedoms (Article 33 UK GDPR). Where a breach is likely to result in a high risk to your rights, Finstem will also notify you without undue delay (Article 34 UK GDPR).

14. Complaints

If you believe Finstem has not handled your data correctly, you can contact huw@finstem.co.uk. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

15. Changes to this policy

Finstem may update this policy from time to time. Any changes will be posted on this page with an updated “Last updated” date.

See also the Cookie Policy and Terms of Business. Finstem Accountants is licensed and supervised by the Association of Accounting Technicians (licence no. 1009866).