Privacy notice

Who's responsible for your data

Luke De Marco, trading as CIS Books — Garden Cottage, Woodmancote, Cirencester, Gloucestershire GL7 7ED. I'm the data controller.

Contact: luke@cisbooks.co.uk or 07375 639493.

What I collect and why

• Contact and identity details — name, address, date of birth, photo ID, contact details. Required by the Money Laundering Regulations 2017 before I can act for you (legal obligation).
• Financial and business records — bank transactions, receipts, invoices, payroll and CIS records. Needed to deliver the bookkeeping and filing services in our engagement letter (contract).
• Tax information — UTR, NI number, VAT number, HMRC correspondence. Needed to prepare and submit your filings (contract and legal obligation).
• Messages — WhatsApp, email and text messages about your business form part of my working records. If you contact us on WhatsApp — including via the button on this site — your phone number and messages are also processed by WhatsApp (Meta) under WhatsApp's own privacy policy.
• Business contact details for prospecting — if you run a trades business, I may hold your business name and business contact details taken from public sources (for example the MCS or Gas Safe registers, or your own website) and use them to send a small number of relevant business emails. I do this under UK GDPR legitimate interests (B2B marketing). Reply to any email saying no — or email luke@cisbooks.co.uk — and you come off the list permanently.

Who I share it with

Only what's needed, only with: HMRC (your filings), my software providers (Xero, Hubdoc, GoCardless, my identity-verification provider, Formspark — the calculator email form, Cal.com — bookings, and Cloudflare — website hosting), my AML supervisor (HMRC), and my professional indemnity insurer if there's a claim. I never sell your data and I don't share it with anyone else without asking you first.

Cookies and ads measurement. This site uses Google's advertising tag to measure whether our ads work. It runs without cookies: no advertising or analytics cookies are set on this site. We also use Cloudflare Web Analytics, which is cookieless and does not track you across sites.

Automated processing

Some processing uses automated tools, including AI — for example extracting data from receipt photos and drafting your monthly report. Every figure in anything I send you or file for you is checked by me before it goes out. Nothing is filed on automation alone.

How long I keep it

• Business and tax records: 6 years after our relationship ends (7 for some tax records) — HMRC requirement.
• Identity and AML records: 5 years after our relationship ends — Money Laundering Regulations requirement.
• Then deleted.

Your rights

You can ask for a copy of your data, ask me to correct it, ask me to delete what I'm not legally required to keep, and object to or restrict processing. Email luke@cisbooks.co.uk — I'll respond within one month.

To delete your data (where the law allows): email the same address with "delete my data" and I'll confirm what can go and what must stay under HMRC/AML retention rules.

Not happy with how I've handled something? Complain to the ICO at ico.org.uk or 0303 123 1113.