Last updated: 14 September 2026
1. Who we are
JF Accountax Ltd(“we”, “us”) is the controller of the personal information described in this policy. We're a firm of accountants registered in England & Wales, based at Regus, Churchill Court, 3 Manor Royal, Crawley RH10 9LU.
For any question about your information, email Info@jfaccountax.co.uk or call +44 7535 737127.
2. The information we collect
When you contact us or ask for a quote
Your name, email address, phone number, company name, business type, the services you're interested in and your message. If you use our instant quote tool, we also record the answers you give it, such as your turnover band and the services you need. To protect the form from spam we record the IP address and browser details it was sent from.
When you become a client
- Identity and contact details, including information we must collect to verify your identity under anti-money-laundering law.
- Business details and tax references — for example UTRs, company numbers, VAT and PAYE references.
- Login details for HMRC or Companies House that you choose to share so we can act on your behalf.
- Financial records, bank statements and other documents you upload or send us.
- Answers to our onboarding forms, and your signature when you sign a form or contract online. When you submit or sign, we record the date, time, IP address and browser, and — only if you allow it — your approximate location, as evidence of the submission.
- Meeting bookings, and the notes we keep of our work for you.
- Payment information. Direct Debits are set up and held by GoCardless; we receive confirmation of your mandate and payments, not your full bank details.
3. How we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Replying to your enquiry and preparing a quote | Our legitimate interest in responding to people who contact us, or steps you ask us to take before entering a contract |
| Providing our accountancy services and running your client portal | Performance of our contract with you |
| Verifying your identity and keeping records required by law | Legal obligation (including the Money Laundering Regulations 2017 and HMRC record-keeping rules) |
| Collecting fees | Performance of our contract with you |
| Recording evidence when you submit or sign a document online | Our legitimate interest in being able to show what was agreed; your location only with your consent |
| Protecting our website and portal from spam, fraud and misuse | Our legitimate interest in keeping our systems and clients safe |
We don't sell your information, and we don't use it for automated decision-making.
4. Who we share it with
- HMRC, Companies House and other authorities — when we act on your behalf, or where the law requires it.
- Google Cloud (Firebase) — which hosts our database, file storage and portal sign-in.
- Vercel — which hosts our website.
- GoCardless — which processes Direct Debit payments.
- Our email provider — which delivers the emails we send you.
- WhatsApp (Meta) — only if you choose to contact us, or ask us to send you links, that way.
- Professional advisers and insurers — where needed to run our business properly.
Some of these providers process information outside the UK. Where they do, we rely on appropriate safeguards, such as UK adequacy regulations or the International Data Transfer Agreement.
5. How long we keep it
- Enquiries and quotes that don't lead to working together — up to two years.
- Client records — for as long as we act for you, then six years, in line with HMRC record-keeping rules and legal time limits for claims.
- Identity-verification records — five years after our relationship ends, as anti-money-laundering law requires.
When records are no longer needed we delete them. Invoices and payment records are financial records we're required to keep, so when a client's account is deleted those are retained with their personal details removed.
6. Keeping it safe
Information is encrypted in transit, access to client records is limited to our staff, and documents are only downloadable through short-lived secure links. Accounts that are suspended or closed lose access straight away, and any links we've shared stop working.
7. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct anything that's wrong or incomplete;
- ask us to delete your information, where we don't have to keep it by law;
- object to, or ask us to restrict, how we use it;
- ask for information you gave us in a portable format;
- withdraw consent at any time, where we rely on it.
To use any of these rights, contact us using the details above. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.ukor on 0303 123 1113 — though we'd appreciate the chance to put things right first.
8. Cookies
We keep cookies to a minimum. We don't use analytics or advertising cookies, and we don't track you across other websites.
| Name | What it does | How long |
|---|---|---|
__session | Keeps you signed in to the client portal. Strictly necessary — the portal can't work without it. | 14 days, or until you sign out |
| Firebase sign-in storage | Browser storage used by Google Firebase to keep your portal sign-in active. Strictly necessary. | Until you sign out |
| Popup preference | Browser storage remembering that you've closed the website popup, so it isn't shown again. | Your browsing session, or until you clear your browser |
| Google Maps | The map on our Contact page is provided by Google, which may set its own cookies when it loads. See Google's privacy policy. | Set by Google |
You can block or delete cookies in your browser settings. Blocking the session cookie will stop the client portal working.
9. Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed.