BPC Partners Limited, registered in England and Wales under company number 04277490, is the data controller for the personal data described in this policy. Our registered office is 3 Royal Crescent, Cheltenham, Gloucestershire GL50 3DA. You can reach us on 01242 226789 or at info@bpcpartners.co.uk. We are registered with the Information Commissioner's Office under registration number Z9898307. Michael Bull is responsible for data protection at the practice, and any query about this policy or about the data we hold should be addressed to him.
What we collect through this website
If you complete the contact form, we collect your name, email address, and optionally your phone number and business name, along with the enquiry type you select and anything you write in the message field. We use this to respond to your enquiry and, if you become a client, to begin onboarding.
If you book a call through the scheduling tool on our contact page, that booking is handled by Microsoft Bookings, and the details you enter go to Microsoft as well as to us.
If you accept analytics cookies, we collect anonymised information about how the site is used through Google Analytics — which pages are visited, roughly where in the country visitors are, and how they arrived. This is off by default. Nothing in it identifies you by name, and we do not use it for advertising.
Cookies
We group cookies into four kinds. Necessary cookies make the site work and are always on. Preference cookies remember choices you make on the site. Statistics cookies tell us how the site is used, through Google Analytics. Marketing cookies are set by third-party services embedded in the site, such as the Microsoft Bookings calendar on our contact page. Everything other than necessary cookies is off unless you allow it using the banner shown on your first visit, and you can change or withdraw your consent at any time using the link below.
We use Cookiebot to ask for your consent before setting any non-essential cookie. The table below is kept up to date automatically from Cookiebot's regular scan of this site. Change your cookie settings.
Lawful basis
For responding to enquiries, our basis is legitimate interests — you have contacted us and expect a reply. For client work, it is performance of a contract, and in places legal obligation, because anti-money-laundering rules and tax law require us to hold and keep certain records. For analytics cookies, it is your consent.
Anti-money-laundering screening can return information about politically exposed persons, sanctions listings and adverse media. Where that involves data concerning criminal offences, or special category data, we rely on the substantial public interest conditions in the Data Protection Act 2018 — preventing or detecting unlawful acts, and protecting the public against dishonesty, malpractice or other seriously improper conduct. We are required to carry out these checks and cannot act for you without them.
A screening match does not mean we assume wrongdoing. Matches are reviewed by a person, not acted on automatically, and are frequently false positives caused by a similar name. We will tell you if a match affects our ability to act for you, unless the law prevents us from doing so.
We maintain an appropriate policy document covering this processing, as required by the Data Protection Act 2018.
Who we share it with
We do not sell personal data and we do not share it for marketing. We do use third-party software to run the practice, and your data sits within those systems where relevant.
The systems we use, and what each holds:
- Sodium — our practice management system and the client portal. Client and contact records, the work we are doing for you, and documents exchanged through the portal.
- Xero — the accounting ledger for clients we run on it, including transactions and contact records.
- Apron — bills, supplier payments and company card spend, including the documents captured against them.
- ApprovalMax — approval workflows for bills and purchase orders.
- Adfin — sending, chasing and collecting invoices, including customer contact details and payment information.
- TaxCalc — preparation and filing of statutory accounts and tax returns.
- Syft and Microsoft Power BI — management reporting built from ledger data.
- Microsoft 365 — email, documents and file storage.
- Microsoft Bookings — booking calls through this website.
- Webflow — hosting this website and holding contact form submissions.
- Google Analytics — website usage data, only where you have accepted analytics cookies.
- Connectorly — extracts ledger data from Xero and holds a copy of it in a dedicated PostgreSQL database it provides, which is the source for our Power BI reporting. Connectorly Limited is registered in England and Wales.
- BrightPay — payroll processing, including employee names, addresses, National Insurance numbers, pay and pension contributions.
- HubSpot — managing enquiries and prospect contact details.
- FirmCheck — identity verification and anti-money-laundering checks, including identity documents, verification results and ongoing screening.
- Engager — letters of engagement and related client records, held during migration to Sodium. This system is being retired and the data held in it will be deleted once the transfer is complete.
Each of these acts as a processor on our instructions under a written agreement. Some process data outside the UK; where they do, appropriate safeguards are in place.
We also disclose information where the law requires it, including to HMRC and, where anti-money-laundering obligations apply, to the National Crime Agency. Those disclosures can be made without telling you.
How long we keep it
Enquiries that do not become client relationships are kept for a limited period and then deleted. Client records are kept for longer, because professional and statutory obligations require it.
- Website enquiries that do not become clients — 12 months, then deleted.
- Client engagement, accounts and tax records — six years after the end of the client relationship, reflecting the periods over which HMRC can open an enquiry and over which a claim could be brought against us.
- Anti-money-laundering identification and due diligence records — five years from the end of the business relationship, as required by the Money Laundering Regulations 2017.
- Payroll records — six years after the tax year they relate to.
- Website analytics — retained by Google Analytics for 14 months, and only collected where you have accepted analytics cookies.
Where a record falls into more than one of these, the longest period applies. At the end of the period we delete it or, where deletion is not practicable, put it beyond use.
Your rights
You can ask us what personal data we hold about you and receive a copy. You can ask us to correct anything inaccurate. You can ask us to delete data, though where we are required to keep records by law we will explain why we cannot. You can object to processing based on legitimate interests, ask us to restrict processing, and ask for your data in a portable format. Where we rely on consent, you can withdraw it at any time.
To exercise any of these, email info@bpcpartners.co.uk. We will respond within one month.
Complaints
If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.
Changes
If we change this policy we will update this page and change the date below.
Last updated: 28 October 2026.
