Privacy Policy

Last updated: 11 July 2026. This policy explains how City Solution (UK) Ltd collects, uses and protects personal data, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the requirements applicable to firms licensed by the Association of Accounting Technicians (AAT).

1. Who we are

City Solution (UK) Ltd ("we", "us", "our") is an accounting practice registered in England and Wales (company number 09145699), with its registered office at 3rd Floor 86–90 Paul Street, London EC2A 4NE, United Kingdom. We are licensed and regulated by the Association of Accounting Technicians (AAT), registered as a tax agent with HM Revenue & Customs (HMRC), supervised for anti-money laundering purposes, and registered with the Information Commissioner's Office (ICO) under registration number ZA171285.

City Solution (UK) Ltd is the data controller for personal data described in this policy. For any privacy matter, contact us at hello@citysolution.co.uk or by post at the address above.

2. What personal data we collect

Depending on your relationship with us, we may collect:

• Contact and identity data — name, email address, phone number, job title, business name, and correspondence you send us via forms, email or calls.
• Client engagement data — information needed to deliver accounting, bookkeeping, payroll, VAT and tax services, which may include financial records, bank statements, payroll data (including employee details you provide to us as your processor), tax references, and Companies House filings.
• Identity verification and AML data — passports, driving licences, proof of address, and the results of electronic identity and sanctions checks we are required by law to carry out under the Money Laundering Regulations 2017.
• Website data — limited, privacy-respecting analytics about how visitors use this site (see section 8).

We never sell personal data.

3. Why we use it and our lawful bases

• To respond to enquiries and provide proposals — legitimate interests (running and promoting our practice).
• To deliver our services under an engagement letter — performance of a contract.
• To carry out identity, AML and sanctions checks, file returns with HMRC, and meet our record-keeping duties — legal obligation.
• To meet our professional and regulatory obligations as an AAT-licensed firm, including practice assurance reviews and our continuity of practice arrangements — legal obligation and legitimate interests.
• To send occasional founder briefings and updates — consent, which you can withdraw at any time using the unsubscribe link or by emailing us.

4. Who we share data with

We only share personal data where necessary to deliver our services or where required by law:

• HMRC, Companies House and other authorities when filing on your behalf or where disclosure is required by law.
• Software providers we use to run the practice, such as cloud accounting, payroll, document-exchange and identity-verification platforms, acting as our processors under contract.
• Our team members and vetted subcontractors, who work under confidentiality obligations.
• Our nominated continuity of practice partner, an AAT requirement, who would access client records only in the event that the practice is unable to continue serving you (for example, through the death or incapacity of the licensed member), and only to ensure an orderly continuation or handover of your work.
• Professional bodies, insurers and legal advisers where required for regulation, professional indemnity or the defence of legal claims.

5. International transfers

Some members of our direct team are based outside the UK (currently South Africa), and some software providers may store data outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place — such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses — and that data remains protected to UK GDPR standards.

6. How long we keep data

• Enquiries that do not become engagements — up to 12 months.
• Client engagement records — at least 6 years from the end of the tax or accounting year to which they relate, in line with HMRC and statutory requirements.
• AML identity records — 5 years after the end of the business relationship, as required by the Money Laundering Regulations 2017.
• Marketing consents — until you unsubscribe or withdraw consent.

After these periods, data is securely deleted or anonymised.

7. How we protect data

We use reputable, access-controlled cloud systems with encryption in transit and at rest, restrict access to those who need it, use multi-factor authentication, and require confidentiality from every team member and subcontractor. We exchange sensitive documents through secure portals rather than plain email wherever practicable.

8. Cookies and analytics

This site uses privacy-respecting, cookieless analytics to understand aggregate visitor behaviour. We do not use advertising trackers, and this site does not set cookies that require consent.

9. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where there is no lawful reason for us to keep it (note that statutory retention duties may override this);
• restrict or object to certain processing, including direct marketing;
• receive data you provided to us in a portable format; and
• withdraw consent at any time where consent is our lawful basis.

To exercise any of these rights, email hello@citysolution.co.uk. We respond within one month.

10. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

11. Changes to this policy

We may update this policy from time to time. The version published on this page is the current version, and material changes will be flagged to active clients.