Who we are and what this covers

Ardein is the trading name of In Depth Accounting Ltd, company number 13726011, registered in England and Wales. The company is the data controller for the personal data described here. That means we decide what is collected and why. This policy covers clients, people who enquire, contacts at supplier and funder organisations, and visitors to ardein.co. It also covers personal data held inside client records we process, such as payroll and director details. It applies from 26 September 2026 and was last reviewed on that date. Gavin Jardine deals with data questions personally.

What personal data we collect

We collect data in three ways: you give it to us, our website records it, or another organisation passes it on.

Information you give us

When you enquire, begin the review on the site or become a client, you give us your name, business name, email address and phone number. You tell us what the business does and how its finances are run. Once we are engaged, we receive accounting records, bank statements, payroll and pension details, sales and purchase invoices, tax references, and the identity documents needed for anti-money-laundering checks.

Information collected automatically

When you visit ardein.co, our hosting and analytics tools record your IP address, browser and device type, the pages you view and the site you arrived from. Some of this is stored in cookies. Essential cookies keep the site working. Analytics cookies are used only where you agree to them. Our cookies policy at /cookies-policy/ lists what is set and how to change your choice.

Information from third parties

We obtain company and director details from Companies House. We receive agent authorisation data and correspondence from HMRC. During a managed handover, your previous accountant or bookkeeper passes us records and background papers. Accounting software such as Xero, bank feeds you authorise, and identity verification and sanctions screening tools used for anti-money-laundering checks also supply data about you or your business.

Why we process your data

Each thing we do with personal data rests on one of four lawful bases under UK GDPR.

To provide our services (Contract)

Most client work sits here. We process your data to keep the bookkeeping, reconcile bank accounts, prepare and file VAT returns, run payroll and pension duties, produce management accounts, and prepare year-end accounts, corporation tax computations and Self Assessment returns. Without this data we cannot perform the engagement you have signed.

To meet our legal obligations (Legal obligation)

We are registered for anti-money-laundering supervision. The Money Laundering Regulations 2017 require us to verify identity, keep due diligence records and report suspicions to the National Crime Agency. We also file with HMRC, Companies House and The Pensions Regulator, and retain records that support tax filings and any later enquiry.

To run and improve our business (Legitimate interests)

We use contact details to answer enquiries, manage the client relationship and send practice updates to existing clients about services close to the work we already do. We also use analytics to see how the site is used, keep systems secure, manage billing and credit control, and take professional advice. You can object at any time.

Where you have agreed (Consent)

Consent covers marketing emails to people who are not clients, analytics and any non-essential cookies, and references or case material that identifies you. You can withdraw consent whenever you like by emailing hello@ardein.co, using the unsubscribe link, or changing your cookie choice. Withdrawal does not affect processing carried out before that point.

Who we share your data with

We do not sell personal data and we do not pass it to anyone for their own marketing.

Data is shared only where the work requires it, where the law requires it, or where you have asked us to deal with someone on your behalf. Suppliers who process data for us do so under written terms and only on our instructions.

HMRC and Companies House

We file VAT returns, payroll submissions, corporation tax computations, Self Assessment returns and statutory accounts. We also correspond with HMRC on your behalf where you have authorised us as agent, including during an enquiry.

Software providers

Client records sit in accounting, payroll, document storage, email and practice management platforms, including Xero. These suppliers host and process data for us under contract. Bank feeds operate only where you have authorised the connection yourself.

Professional advisers

Where a matter calls for it, we share relevant data with your solicitor, lender, funder, insurer or incoming accountant, and with our own insurers and advisers. Outside a managed handover, we ask you before doing so.

Regulatory and legal authorities

We share data with the Institute of Accountants and Bookkeepers and our anti-money-laundering supervisor on request, and with law enforcement, the National Crime Agency or a court where the law obliges us. Suspicion reports are made without notifying you.

When data leaves the UK

Most of the data we hold is stored in the United Kingdom or the European Economic Area. Some of our cloud hosting, email and software suppliers operate servers or support teams outside the UK, so limited data can be accessed from other countries. Where data goes to the EEA, the UK adequacy regulations apply. Where it goes further afield, we rely on the International Data Transfer Agreement or the UK addendum to the Standard Contractual Clauses, together with the supplier’s own safeguards. You can ask us which suppliers are involved.

How long we keep your data

We keep records for as long as the work, the law or a possible enquiry requires, then delete or anonymise them.

Client records

Engagement files, accounting records, payroll data and anti-money-laundering evidence are kept for at least six years after the engagement ends, in line with the Money Laundering Regulations 2017. Tax-related records may be held longer where an enquiry is open or expected.

Enquiry and prospect data

If you enquire or complete the review and we do not go on to work together, we keep your details for up to twenty four months from our last contact. After that they are deleted or reduced to anonymous figures.

Website analytics

Analytics data linked to a browser or device is retained for up to twenty six months, then deleted. Aggregate figures about traffic and page performance carry no identifiers and may be kept for longer so we can compare years.

Marketing consent records

We keep a record of when and how you agreed to marketing, and of any withdrawal, for as long as the consent is active and for two years afterwards. This gives us an audit trail if a complaint is made.

Your rights over your data

UK GDPR gives you the following statutory rights. Some are qualified, because we also have record-keeping duties under tax and anti-money-laundering law.

Right to be informed

You are entitled to know what we collect, why, who sees it and how long we hold it. This policy is how we tell you. Ask us if anything here is unclear.

Right of access

You can ask for a copy of the personal data we hold about you. Send a subject access request to hello@ardein.co. We reply within one month, usually without charge.

Right to rectification

If something we hold about you is wrong or incomplete, tell us and we will correct it. Where we have passed the data to someone else, we let them know as well.

Right to erasure

You can ask us to delete your data. We will, unless we still need it for the engagement, for a tax filing, or for the six year anti-money-laundering retention period.

Right to restrict processing

You can ask us to pause processing while a dispute about accuracy or lawful basis is sorted out. We keep the data during that time but do not use it further.

Right to data portability

Where we process data by consent or under contract using automated systems, you can ask for it in a common machine readable format, or ask us to send it to another provider.

Right to object

You can object to processing based on our legitimate interests, and we will stop unless there are compelling grounds to continue. If you object to direct marketing, we stop straight away.

Rights on automated decision-making

We make no decisions about you by automated means alone, and we do not profile you. The review on our site is scored to guide a conversation, and Gavin reads every response.

How to exercise your rights

Email hello@ardein.co with what you want us to do, or call 07783 846909 between 9am and 5pm, Monday to Friday. We answer within one month and tell you sooner if a request is complex enough to need longer. We may ask for identification first, so that data is not released to the wrong person. There is no charge unless a request is repetitive or clearly excessive, and we will say so before doing any work.

How we protect your data

Client records are held in cloud systems that encrypt data in transit and at rest. The website runs over HTTPS. Access is limited to Gavin and to any subcontractor working under written confidentiality terms, with multi factor authentication on the accounts that hold client data. Devices are encrypted, password protected and kept up to date. Paper documents are scanned, then stored securely or destroyed. We review software suppliers before appointing them and again when the terms change. If a breach occurs that risks your rights, we tell the ICO within seventy two hours and tell you without undue delay. No system is entirely free of risk, so we keep these controls under review.

Cookies on this website

Cookies are small files placed on your device by a website. We use essential cookies so pages load and forms work, and analytics cookies so we can see which pages are read. Analytics cookies are set only with your agreement. Our cookies policy at /cookies-policy/ lists each one and explains how to change your choice.

Data about children

Ardein works with businesses and organisations, so this site and our services are aimed at adults. We do not knowingly collect personal data from anyone under 18 through the website. Payroll work may involve data about employees under 18, and that is handled under our contract with the employer.

Changes to this policy

We update this policy when our systems, suppliers or legal duties change, and we review it at least once a year. The last reviewed date at the top of the page always shows the current version. Where a change materially affects clients, we tell them by email before it takes effect.

How to contact us about data

Data questions come straight to Gavin.

Email or call with any question about this policy, any request to see, correct or delete your data, or any concern about how we have handled it. We would rather hear from you first, so we can put something right quickly.

Data queries: hello@ardein.co — Response within one month under UK GDPR. Data controller: In Depth Accounting Ltd, 27 Old Gloucester Street, London WC1N 3AX (registered office). Companies House 13726011. ICO registration [ICO registration number to be added].

Complaints to the ICO

If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner’s Office. You can do that whether or not you have raised it with us first, although we would like the chance to sort it out. The ICO is at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The helpline is 0303 123 1113, and complaints can be made online at https://ico.org.uk/make-a-complaint/. Complaining to the ICO does not affect your right to take a claim to court.