Privacy Policy

Who we are

This notice explains how Keystone Tax Consultants uses personal data. We are the controller of the personal data described here. That means we decide how and why it is used, and we are responsible for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have a question about this notice or about your data, contact us using the details on our contact page.

What we collect

We collect only what we need to answer your enquiry, carry out our work and meet our legal obligations.

Contact details. Your name, email address, telephone number, postal address and, where relevant, the name of your business and your role in it.
Project documents. Documents you upload through this site or send to us, such as builders' quotes, tenders, bills of quantities, specifications, drawings, plans and planning consents. These describe a property and a project. They often include names and contact details of other people, such as your builder or architect.
Evidence about a property. Where a VAT relief depends on the history of a building, we may receive records such as council tax records, utility records and dated photographs.
Identity documents. Before we begin work for a client we are required to verify their identity, and where applicable the identity of beneficial owners, for anti-money laundering purposes. We ask for the documents needed to do that.
Correspondence. Emails, messages sent through the site and notes of telephone calls.
Engagement and payment records. The services you instructed, our engagement letter, invoices and payments.
Website usage data. Technical information about how the site is used, described under cookies and analytics below.

If you send us documents that contain other people's personal data, please make sure you are entitled to share them with us.

How we use it and our lawful bases

We must have a lawful basis for each use of personal data. These are the ones we rely on.

To respond to your enquiry and review a quote you send us. This is necessary to take steps at your request before entering into a contract, and it is in our legitimate interests to answer people who contact us.
To provide our services. This is necessary to perform our contract with you, which is set out in our engagement letter and terms of business.
To carry out identity and anti-money laundering checks, and to keep the records of them. This is necessary to comply with our legal obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
To keep business, accounting and tax records. This is necessary to comply with our legal obligations.
To manage our business, keep a record of the work we have done and deal with complaints or claims. This is in our legitimate interests in running the firm properly and being able to explain and defend our work.
To understand how the website is used and improve it. This is in our legitimate interests. Where it involves cookies that are not strictly necessary, we rely on your consent.

We do not sell personal data, and we do not share it with anyone for marketing purposes.

We keep the information you give us confidential. We share personal data only where one of the following applies.

IT and email providers. Companies that host our email, website, document storage and other systems process data for us, on our instructions.
Professional advisers. Our own advisers, such as lawyers, accountants and insurers, where we need their advice or have to notify them.
Regulators and authorities. Our anti-money laundering supervisor, law enforcement agencies and other public bodies, where the law requires it. In some circumstances the law requires us to make a report to the National Crime Agency, and we may be prohibited from telling you that we have done so.
People you ask us to share with. For example, your building contractor, where you instruct us to send our analysis to them.

We do not act as agent with HMRC and we do not send your information to HMRC on your behalf.

How long we keep it

We keep personal data for no longer than we need it for the purposes described above.

Client engagements. The period for which we keep engagement records is set out in your engagement letter. After that period the records are securely destroyed.
Anti-money laundering records. We keep the records of our identity checks for the period the anti-money laundering regulations require.
Enquiries that do not lead to an engagement. We keep your details and any documents you sent for as long as we need to deal with the enquiry, and then delete them.

Your rights

Under UK data protection law you have the right to:

ask for a copy of the personal data we hold about you
ask us to correct data that is inaccurate or incomplete
ask us to erase your data in certain circumstances
ask us to restrict how we use your data in certain circumstances
object to our use of your data where we rely on legitimate interests
ask for data you gave us to be provided to you, or to someone else, in a commonly used electronic format, where the law gives you that right
withdraw consent at any time, where we rely on consent

Some of these rights are limited by law. For example, we cannot erase records we are legally required to keep. To use any of your rights, contact us using the details on our contact page. There is normally no charge. We will respond within the time the law allows, which is usually one month.

Cookies and analytics

Cookies are small files that a website stores on your device. Some are strictly necessary for a site to work, for example to keep a form working while you complete it or to protect the site from misuse. We do not need your consent for those.

We may also use analytics to count visits and see which pages are read, so that we can improve the site. Where analytics or any other feature relies on cookies that are not strictly necessary, we ask for your consent first, and you can change your choice at any time. You can also block or delete cookies in your browser settings. The site's main content will still work if you do.

How to complain

If you are unhappy with how we have used your personal data, please tell us first using the details on our contact page. We will look into it and reply.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. You can do that at any time. The ICO's website explains how to make a complaint and gives its current contact details.

Changes to this notice

We review this notice from time to time and update it when the way we handle personal data changes. The current version is always the one on this page. This notice was last updated in October 2026.