Privacy Notice

Effective Date: 01/01/2026
Last Updated: 01/01/2026

1. Introduction

This Privacy Notice explains how Hills Cloud Ltd (“we”, “us” or “our”) collects, uses, stores and protects your personal information.

We are committed to protecting your privacy and processing personal data fairly, lawfully and transparently in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection legislation.

2. Who We Are

Practice Name: Hills Cloud Ltd
Principal: Narges Cyroos FCA

Hills Cloud Ltd is a firm of Chartered Accountants regulated by the Institute of Chartered Accountants in England and Wales (ICAEW).

3. Personal Information We Collect

Depending on the services we provide, we may collect:

Name
Postal address
Email address
Telephone number
Date of birth
National Insurance number
Unique Taxpayer Reference (UTR)
Company registration details
Passport or driving licence details
Proof of address
Bank account details
Accounting and financial information
Payroll information
VAT information
Tax information
Shareholding information
Beneficial ownership information
Identity verification documents
Information required for anti-money laundering checks
Information supplied during our engagement with you

Where you provide information about other individuals (for example directors, shareholders, employees, or family members), you should ensure that you are entitled to provide that information.

4. How We Collect Information

We may obtain information:

Directly from you
From Companies House
From HM Revenue & Customs
From your previous accountant (with your authority)
From banks and financial institutions where authorised
From identity verification providers
From sanctions, PEP and adverse media screening providers
From publicly available sources
During the course of providing professional services

5. Why We Process Your Information

We process personal data to:

Provide accountancy and taxation services
Prepare statutory accounts
Prepare tax returns
Provide payroll services
Provide bookkeeping services
Provide business advisory services
Meet our contractual obligations
Verify identity
Carry out client due diligence
Comply with anti-money laundering legislation
Meet legal and regulatory obligations
Detect and prevent fraud and financial crime
Defend legal claims
Manage our business effectively

6. Our Lawful Bases for Processing

Depending on the circumstances, we rely on one or more of the following lawful bases:

Performance of a contract
Compliance with a legal obligation
Legitimate interests
Consent (where specifically required)

Where we rely on consent, you may withdraw your consent at any time.

7. Anti-Money Laundering Requirements

As an ICAEW-regulated accountancy practice, we are required under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (as amended) to undertake client due diligence.

This includes verifying identity and, where appropriate:

Verifying beneficial owners
Carrying out politically exposed person (PEP) screening
Conducting sanctions screening
Performing adverse media checks
Carrying out ongoing monitoring throughout our relationship with you

We may be legally required to retain identification documents and related records for at least five years after the end of our business relationship.

Where required by law, we may make disclosures to the National Crime Agency or other competent authorities. We are prohibited from informing clients where a Suspicious Activity Report has been made if doing so would constitute “tipping off”.

8. Who We Share Information With

We may share information with:

HM Revenue & Customs
Companies House
ICAEW
Professional advisers
Accounting software providers
Cloud hosting providers
Identity verification providers
AML screening providers
Payroll providers
Banking providers where authorised
Courts, regulators and law enforcement agencies where required by law

We only disclose information where there is a lawful basis for doing so.

9. International Transfers

Some of our software providers may process information outside the United Kingdom.

Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including adequacy decisions or approved contractual safeguards where required.

10. Data Security

We maintain appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, disclosure, alteration or destruction.

These measures include secure systems, encrypted communications where appropriate, access controls, password protection, and secure backups.

11. Data Retention

We retain information only for as long as necessary to fulfil the purposes for which it was collected.

Typical retention periods include:

Client files – normally six years after the end of the engagement
Anti-money laundering identification records – at least five years after the end of the business relationship
Payroll records – in accordance with statutory requirements
Tax records – in accordance with applicable legal requirements

Longer retention periods may apply where required by law or necessary for legal claims.

12. Your Rights

Subject to legal limitations, you have the right to:

Access your personal information
Request correction of inaccurate information
Request erasure in certain circumstances
Restrict processing
Object to processing where applicable
Request data portability where applicable
Withdraw consent where processing is based on consent

Some rights may be restricted where we have legal obligations to retain information.

13. Cookies

Our website may use cookies to improve functionality and analyse website usage.

Further information is available in our Cookie Policy where applicable.

14. Changes to This Privacy Notice

We may update this Privacy Notice from time to time to reflect changes in legislation, regulation, or our working practices.

The latest version will always be available on our website.