Cashtrak Limited

Privacy Notice

Last updated: August 2026

Cashtrak Limited ("Cashtrak", "we", "us" or "our") respects your privacy and is committed to protecting your personal information.

This Privacy Notice explains how we collect, use, store and protect personal information when you use our services, contact us, visit our website, or otherwise interact with us.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended from time to time.

We keep this Privacy Notice under regular review and will update it when necessary.

1. Who we are

Cashtrak Limited is a company registered in England and Wales.

Company number: 10637663
Registered office: 10 Basil Close, Earley, Reading, Berkshire, England, RG6 5GL
Email: info@cashtrak.co.uk
Telephone: 01865 522785
Website: www.cashtrak.co.uk

Cashtrak is the data controller for personal information where we determine why and how that information is processed.

When providing certain services to our business clients, such as bookkeeping and payroll, we may also process personal information on behalf of our client. In those circumstances, our client may be the data controller and Cashtrak may act as a data processor. The responsibilities of each party will depend on the services being provided and the nature of the information being processed.

2. Who is responsible for data protection?

Our Managing Director, Sue Raison, has overall responsibility for ensuring that Cashtrak handles personal information appropriately and in accordance with applicable data protection legislation.

If you have any questions about this Privacy Notice, how we use your personal information, or wish to exercise any of your data protection rights, please contact:

Sue Raison
Managing Director
Cashtrak Limited
10 Basil Close
Earley
Reading
Berkshire
England
RG6 5GL

Email: info@cashtrak.co.uk
Telephone: 01865 522785

We are not required to appoint a Data Protection Officer unless the legal requirements for doing so apply to us. Sue Raison is our main contact for data protection matters.

3. What personal information do we collect?

The information we collect will depend on our relationship with you and the services we provide.

This may include:

Personal and contact information

• name;

• postal address;

• email address;

• telephone number;

• date of birth where required;

• other contact details.

Business information

• business name and address;

• company number;

• job title or position;

• information about directors, shareholders and Persons with Significant Control (PSCs);

• business contact details;

• information relating to your business activities.

Financial and accounting information

Where we provide bookkeeping, payroll or tax-related services, we may process information such as:

• bank account details;

• income and expenditure information;

• invoices and receipts;

• accounting records;

• tax information;

• VAT information;

• Self-Assessment information;

• Corporation Tax information;

• payroll information;

• pension information;

• information relating to employees and contractors;

• National Insurance numbers;

• PAYE information;

• information required to prepare and submit tax returns.

Identity and compliance information

We may collect information required to comply with our legal and professional obligations, including:

• identity documents;

• proof of address;

• information concerning beneficial ownership;

• information required for Anti-Money Laundering checks;

• information relating to politically exposed persons (PEPs), where applicable;

• sanctions and screening information;

• information required to prevent and detect fraud and money laundering.

Website and technical information

When you use our website, we may collect information such as:

• IP address;

• browser type;

• device information;

• pages visited;

• information about how you use our website;

• information collected through cookies and similar technologies.

Further information about cookies is provided in our Cookie Notice.

4. Where do we obtain personal information from?

We may obtain personal information:

• directly from you;

• when you contact us by telephone, email, post or through our website;

• when you complete an online form;

• when you become a client;

• from your employer or business, where we are providing services to them;

• from directors, shareholders or other authorised representatives;

• from accounting, payroll or other software used by you or your business;

• from HMRC, Companies House or other government or regulatory bodies where permitted or required;

• from professional advisers or other organisations acting on your behalf;

• from publicly available sources, such as Companies House;

• from third-party service providers;

• from other lawful sources where necessary for the provision of our services or compliance with our legal obligations.

Where we obtain personal information from a source other than the individual concerned, we will provide the information required by data protection law unless an applicable exception applies.

5. Why do we use your personal information?

We only collect and use personal information where we have a lawful reason to do so.

Depending on our relationship with you, we may use your information to:

Provide our services

We use personal information to:

• provide bookkeeping services;

• process payroll;

• prepare and submit tax returns;

• prepare and submit VAT returns where agreed;

• provide Making Tax Digital services;

• provide CIS services where agreed;

• provide agreed company secretarial and Companies House services;

• communicate with you about your services;

• process payments and invoices;

• respond to queries and requests.

Meet our legal and regulatory obligations

We may process personal information where necessary to comply with legal or regulatory requirements, including requirements relating to:

• HMRC;

• Companies House;

• Anti-Money Laundering legislation;

• the Money Laundering Regulations;

• tax and accounting legislation;

• payroll and pension obligations;

• professional and regulatory requirements;

• legal requests, court orders or other lawful requirements.

As an ICB-supervised practice, we may also be required to maintain records and provide information to our professional or regulatory bodies where legally or professionally required.

Manage our business

We may use personal information to:

• maintain our accounting and business records;

• administer client accounts;

• manage payments and outstanding invoices;

• maintain IT systems;

• manage access to our systems;

• protect our systems and information;

• prevent fraud;

• investigate security incidents;

• manage complaints;

• establish, exercise or defend legal claims.

Communicate with you

We may use your information to respond to:

• telephone enquiries;

• emails;

• website enquiries;

• appointment requests;

• service requests;

• complaints.

Marketing

Where permitted by law, we may use contact information to send information about Cashtrak's services, news and updates that we believe may be relevant to you.

Where consent is required, we will obtain your consent before sending marketing communications.

You can opt out of marketing communications at any time by contacting us or using the unsubscribe facility provided in the communication.

6. Our lawful bases for processing

The UK GDPR requires us to have a lawful basis for processing personal information. The lawful basis we rely upon depends on why we are processing the information.

We may rely on the following lawful bases:

Contract

We may process personal information where it is necessary to enter into or perform a contract with you.

For example, this may include providing agreed bookkeeping, payroll or tax return services.

Legal obligation

We may process personal information where necessary to comply with a legal or regulatory obligation.

This may include our obligations relating to:

• taxation;

• accounting records;

• payroll;

• pensions;

• Anti-Money Laundering;

• fraud prevention;

• professional regulation;

• Companies House;

• responding to lawful requests.

Legitimate interests

We may process personal information where it is necessary for our legitimate business interests, provided that those interests are not overridden by your rights and freedoms.

Examples may include:

• administering our business;

• managing client relationships;

• maintaining and improving our services;

• IT and information security;

• fraud prevention;

• debt recovery;

• protecting our business;

• responding to enquiries;

• certain business-to-business marketing activities where permitted by law.

Where we rely on legitimate interests, we consider whether the processing is necessary and whether our interests are appropriately balanced against your rights.

Consent

Where required by law, we will ask for your consent before processing your information for a particular purpose.

Where we rely on consent, you can withdraw that consent at any time. Withdrawal of consent does not affect processing that took place before the consent was withdrawn.

7. Special category and sensitive information

Some of the information we process may be considered special category data under data protection legislation.

For example, payroll information may sometimes include information concerning an individual's health or other special category information.

Where we process special category information, we will only do so where an appropriate legal condition applies in addition to our normal lawful basis.

We will only process such information where it is necessary for the service we are providing or for another lawful purpose.

8. Criminal offence information

As part of our Anti-Money Laundering and compliance obligations, we may be required to process information relating to criminal offences, convictions or suspected criminal activity.

We will only process this information where permitted or required by applicable law and where an appropriate condition applies.

9. Who may receive your personal information?

We may share personal information where necessary to provide our services, comply with our legal obligations or operate our business.

Depending on the circumstances, this may include:

• HM Revenue & Customs;

• Companies House;

• The Pensions Regulator;

• banks and payment providers;

• professional advisers;

• external accountants or other advisers where authorised or required;

• our professional and regulatory bodies, including the Institute of Certified Bookkeepers;

• government departments and regulatory authorities;

• courts, law enforcement agencies or other authorised bodies;

• software and technology providers;

• IT and technical support providers;

• payroll and pension service providers;

• document storage and management providers;

• website and communications providers.

We will only share personal information where there is a lawful basis for doing so.

10. Software and service providers

We use specialist software and service providers to help us provide our services and operate our business.

These may include accounting, payroll, document management, payment, CRM, communication and tax software.

Depending on the services you receive, this may include providers such as:

• Xero;

• BrightPay;

• Microsoft;

• Hubdoc;

• Apron;

• Xennon;

• Tripcatcher;

• GoCardless;

• Sage;

• FreeAgent;

• QuickBooks:

• Vinyl AI:

• Briefcase;

• GoProposal;

• Engager;

• other software providers introduced or changed from time to time.

These providers may process personal information on our behalf.

We take reasonable steps to ensure that appropriate contractual and security arrangements are in place with relevant service providers.

11. International transfers

Some of our software and service providers may process or store information outside the UK.

Where personal information is transferred outside the UK, we will ensure that the transfer is made in accordance with applicable data protection legislation and that appropriate safeguards are in place where required.

This may include relying on:

• a UK adequacy regulation;

• appropriate contractual safeguards;

• the UK International Data Transfer Agreement or Addendum; or

• another lawful transfer mechanism.

 12. How we protect your personal information

We take reasonable and appropriate technical and organisational measures to protect personal information against:

• unauthorised access;

• accidental loss;

• destruction;

• alteration;

• inappropriate disclosure;

• unlawful processing.

Our measures may include:

• password protection;

• access controls;

• multi-factor authentication where available;

• secure cloud systems;

• staff training;

• confidentiality requirements;

• secure document handling;

• appropriate backup arrangements;

• malware and security protection;

• secure disposal of paper and electronic records;

• regular review of access to systems.

Access to personal information is restricted to those who need it for legitimate business purposes.

13. How long do we keep your personal information?

We do not keep personal information for longer than is reasonably necessary.

The length of time we retain information depends on:

• the type of information;

• the purpose for which it was collected;

• whether you remain a client;

• our contractual obligations;

• legal and regulatory requirements;

• Anti-Money Laundering requirements;

• tax and accounting record-keeping requirements;

• whether we need the information to establish, exercise or defend legal claims.

Some records must be retained for a specified period because of legal, regulatory and professional requirements. For example:

• Anti-Money Laundering (AML) records, including customer due diligence and identity verification records, are generally retained for five years after the end of the business relationship or completion of the transaction, as required by anti-money laundering legislation.

• Tax, accounting and business records may be retained for up to six years (and in some circumstances longer) to comply with HMRC and other statutory requirements.

• Payroll records, PAYE information, pension auto-enrolment records and related employment records may be retained for the periods required by HMRC, The Pensions Regulator and other employment legislation.

• Working papers, correspondence, engagement records and professional compliance records may be retained for as long as is necessary to meet our professional obligations and to establish, exercise or defend legal claims.

• Where an HMRC enquiry, investigation, complaint, dispute, insurance claim or legal proceeding is ongoing, we may retain relevant records until the matter has been concluded and any applicable limitation periods have expired.

Where no specific retention period applies, we determine an appropriate retention period based on the nature of the information, the reason it is held, and applicable legal, regulatory and professional requirements.

Once information is no longer required, we will securely delete, anonymise or destroy it in accordance with our data retention and disposal procedures.

14. Your data protection rights

Depending on the circumstances, you may have rights under data protection legislation, including the right to:

• access the personal information we hold about you;

• correct inaccurate or incomplete information;

• request erasure of your personal information in certain circumstances;

• restrict processing in certain circumstances;

• object to certain processing, including direct marketing;

• data portability in certain circumstances;

• withdraw consent where we rely on consent as our lawful basis.

These rights are not absolute and exceptions may apply. For example, we may be required to retain or continue processing information because of a legal or regulatory obligation.

The rights available to you will depend on the circumstances and the lawful basis on which we process your information.

15. How to exercise your rights

If you would like to exercise any of your data protection rights, please contact us:

Email: info@cashtrak.co.uk

Post:

Sue Raison
Managing Director
Cashtrak Limited
10 Basil Close
Earley
Reading
Berkshire
England
RG6 5GL

We may need to request additional information from you to verify your identity before releasing personal information or making changes to your records.

We will normally respond to a valid request within the time period required by applicable data protection legislation.

16. Direct marketing

You can ask us to stop sending you marketing communications at any time.

You can do this by:

• clicking the unsubscribe link in a marketing email;

• contacting us at info@cashtrak.co.uk; or

• contacting a member of the Cashtrak team.

Stopping marketing communications will not affect communications relating to services you are using or other necessary business or legal communications.

17. Cookies and our website

Our website may use cookies and similar technologies.

Some cookies are necessary for the website to operate. Other cookies may be used for purposes such as analysing website usage, remembering preferences or supporting marketing activities.

Where consent is required for non-essential cookies, we will ask for your consent before placing or using those cookies.

Please see our Cookie Notice for further information.

18. Automated decision-making and profiling

We do not currently make decisions about individuals based solely on automated processing, including profiling, that produce legal or similarly significant effects.

If this changes, we will update this Privacy Notice and provide the information required by applicable data protection legislation.

19. Complaints

If you have concerns about how we have handled your personal information, please contact us first so that we can investigate the matter.

Email: info@cashtrak.co.uk

Post:

Sue Raison
Managing Director
Cashtrak Limited
10 Basil Close
Earley
Reading
Berkshire
England
RG6 5GL

You also have the right to complain to the Information Commissioner's Office (ICO) if you believe that your personal information has been handled incorrectly.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

ICO – Information Commissioner's Office

20. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect:

• changes to our business;

• changes to our services;

• changes to the software and service providers we use;

• changes in data protection legislation;

• changes to regulatory or legal requirements;

• changes to how we process personal information.

The latest version will always be published on our website.

Last updated: August 2026