Ryans Business Advisors Limited, trading as Ryans Chartered Accountants
Last updated: 29th July 2026 — replaces the notice dated 4 June 2018
1. Purpose of this notice
This notice explains how Ryans Business Advisors Limited, trading as Ryans Chartered Accountants (“Ryans”, “we”, “us”, “our”), collects, uses, shares and protects personal data, in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA 2018”), the Privacy and Electronic Communications Regulations 2003 (“PECR”), the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“MLRs”), and any other UK data protection legislation in force from time to time (together, the “Data Protection Legislation”).
This notice applies to clients, prospective clients, individuals connected with our corporate clients (such as directors, employees, subcontractors, beneficial owners and shareholders), suppliers, website visitors, job applicants and other individuals we deal with in the course of our business.
2. Who we are
Ryans Business Advisors Limited is registered in England and Wales, company number 5867784, registered office 67 Chorley Old Road, Bolton, BL1 3AJ.
We are a firm of chartered accountants regulated by the Institute of Chartered Accountants in England and Wales (“ICAEW”), and we are supervised by ICAEW for compliance with the Money Laundering Regulations 2017.
We are the data controller for the personal data described in this notice.
3. How to contact us about data protection
Our Data Protection Point of Contact is Martin Smith. You can contact Martin by email at martin.smith@ryans-uk.com or by telephone on 01204 523263.
We are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR, and Martin's role is as our internal privacy contact rather than a statutory DPO. [CONFIRM: the firm should double-check this conclusion against ICAEW's DPO decision-tree tool before publication — if the outcome changes, this paragraph needs to say so.]
4. How we collect personal data
We collect personal data:
- when you request a proposal or quote for our services;
- when you, or the business you represent, engages us and throughout the provision of our services;
- when you contact us by email, telephone, post, social media or our website;
- during client due diligence and ongoing monitoring carried out under the Money Laundering Regulations 2017, including identity verification and source-of-funds checks;
- from third parties and publicly available sources, such as Companies House, credit reference agencies, electronic identity-verification providers, HMRC, and PEP/sanctions screening services;
- from our clients, where you are an employee, director, subcontractor, beneficial owner or customer of a client;
- automatically, when you visit our website (see section 6).
5. The personal data we hold
Depending on our relationship with you, this may include:
- identity and contact details (name, address, date of birth, email, phone number);
- National Insurance number, Unique Taxpayer Reference and other tax identifiers;
- financial information relevant to the services we provide (income, assets, bank details, payroll data);
- identity verification documents and source-of-funds/source-of-wealth information collected for AML purposes;
- the outcome of politically-exposed-person (PEP) and sanctions screening checks;
- correspondence and records of our dealings with you;
- details of complaints or enquiries;
- information from research, surveys and marketing activity;
- special category or criminal offence data, only where necessary — for example, PEP status or adverse-media screening results relevant to our AML obligations (see section 8).
6. Cookies and website analytics
Our website, ryans-uk.com, uses cookies and similar technologies, including Google Tag Manager, to operate the site and to understand how it is used.
When you first visit our website, a cookie banner allows you to choose which categories of cookie you consent to. Strictly necessary cookies, which are required for the site to function, are set regardless of your choice. Analytics and any other non-essential cookies, including those delivered via Google Tag Manager, are only set if you select them in the banner.
You can change your cookie preferences at any time by clicking the Cookie Settings link available on our website. You can also control cookies through your browser settings, though this may affect how parts of the site function.
If you would like more detail on the specific cookies we use, please contact martin.smith@ryans-uk.com.
7. How we use your personal data, and our lawful basis
We only use personal data where we have a lawful basis to do so. More than one basis may apply to the same processing activity.
| Purpose | Lawful basis (UK GDPR Art. 6) | Notes |
| Delivering accountancy, tax and advisory services under an engagement letter | Performance of a contract (Art. 6(1)(b)) | Includes processing data about individuals connected with a corporate client |
| Client due diligence, identity verification, source-of-funds and ongoing monitoring | Legal obligation (Art. 6(1)(c)) — Money Laundering Regulations 2017 | PEP/sanctions screening may involve Art. 10 criminal offence data; processed under DPA 2018, Sch. 1, para 10 (compliance with legal obligation) and covered by our appropriate policy document |
| Preparing and filing tax returns, accounts and statutory returns | Legal obligation (Art. 6(1)(c)) and performance of a contract | |
| Business development, service improvement, management information | Legitimate interests (Art. 6(1)(f)) | We only rely on this where our interests do not override your rights |
| Direct marketing (newsletters, events, service updates) | Consent (Art. 6(1)(a)), or legitimate interests for existing clients under the “soft opt-in” | You can opt out or withdraw consent at any time — see section 12 |
| Responding to complaints, regulatory or legal requests | Legal obligation and legitimate interests | Includes disclosures to ICAEW — see section 9 |
We do not carry out any processing that involves solely automated decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you. [CONFIRM this remains accurate — update if any automated credit-scoring, fraud-screening or similar tool is introduced.]
8. Anti-money laundering processing
As a firm supervised by ICAEW under the Money Laundering Regulations 2017, we are legally required to carry out client due diligence before, and ongoing monitoring during, an engagement. This includes verifying your identity, understanding the source of funds involved in a transaction, and screening you against sanctions and PEP lists using software.
We are required to retain the personal data obtained for these purposes for a minimum of five years after the end of our business relationship with you, and in some cases for up to ten years where we are required to do so by a competent authority (MLR 2017, regulation 40).
Where our AML checks identify or process information about criminal conduct or offences (for example, adverse media or PEP screening results), we process this under condition 10 (compliance with a legal obligation) of Schedule 1 to the DPA 2018, and we maintain an appropriate policy document governing this processing as required by section 42 DPA 2018.
9. Our regulator
As a firm regulated by ICAEW, we may be required to disclose personal data, including client engagement information, to ICAEW:
- during practice assurance or monitoring visits;
- in connection with a complaint made about us;
- where ICAEW is investigating compliance with professional or AML obligations;
- where otherwise required by our regulatory obligations as members and a firm of ICAEW.
ICAEW acts as an independent data controller for any personal data it receives from us in this way. ICAEW's own privacy notice is available at icaew.com.
10. Change of purpose
If we need to use your personal data for a purpose unrelated to the one for which it was collected, we will only do so where the new purpose is compatible with the original one, or where we are otherwise permitted by law. Where required, we will tell you about the new purpose and the lawful basis for it before we begin that processing.
11. Data retention
We keep personal data for no longer than necessary. Our standard retention periods are:
- Client engagement and accounting records: 6 years from the end of the relevant tax year or the end of the engagement, in line with HMRC record-keeping requirements and the Limitation Act 1980.
- AML/client due diligence records: at least 5 years from the end of the business relationship, in accordance with regulation 40 MLR 2017.
- Marketing data: until you unsubscribe or object, or 24 months of inactivity, whichever is sooner.
- Job applicant data (unsuccessful applications): 18 months, unless you consent to us keeping it longer.
- Website enquiry data that does not lead to an engagement: 12 months.
12. Sharing your personal data
We share personal data with:
- IT, cloud software and hosting providers who support our accounting and practice management systems;
- our professional indemnity insurers, in the event of a claim or potential claim;
- ICAEW, as our regulator and AML supervisor (see section 9);
- HMRC and other government bodies, where required to do so;
- other professional advisers instructed jointly with us, such as solicitors or independent financial advisers, with your knowledge;
- a successor practice, in the event of a sale, merger or restructuring of our business;
- any other third party where we are required to do so by law or court order.
All third-party service providers who process personal data on our behalf are subject to a written contract requiring them to protect that data and to use it only for the purposes we specify.
13. International transfers
Some of our service providers store or process personal data outside the UK. e.g. cloud accounting software, backup/hosting, email.
Where we transfer personal data outside the UK, we only do so where one of the following safeguards is in place:
- the destination country is covered by UK adequacy regulations; or
- we have entered into the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses with the recipient; or
- another Article 46 UK GDPR transfer mechanism applies.
You can ask us for further information about the safeguards used for a specific transfer by contacting martin.smith@ryans-uk.com.
14. Data security
We maintain appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration or disclosure. Access is limited to those who need it, and our staff and contractors are subject to confidentiality obligations.
We have procedures in place to detect, investigate and respond to a suspected personal data breach, and we will notify the ICO and affected individuals where the law requires us to do so.
15. Your rights
Subject to certain conditions and exemptions, you have the right to:
- request access to the personal data we hold about you;
- request correction of inaccurate personal data;
- request erasure of personal data, where there is no good reason for us to continue processing it;
- object to processing based on our legitimate interests, or to direct marketing at any time;
- request that we restrict our processing of your personal data;
- request a portable copy of personal data you have provided to us, where processing is based on consent or contract and carried out by automated means;
- withdraw consent at any time, where we rely on consent as our lawful basis.
To exercise any of these rights, contact martin.smith@ryans-uk.com. There is no charge for most requests, though we may charge a reasonable fee, or decline to act, if a request is manifestly unfounded or excessive. We may ask you to verify your identity before responding.
Some rights do not apply, or apply differently, to data we process to comply with our AML obligations — for example, we cannot erase client due diligence records before the statutory retention period in section 8 has expired, and in some cases we cannot tell you whether we hold information about you (see MLR 2017, regulation 44).
16. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at martin.smith@ryans-uk.com so we can try to resolve it.
You also have the right to complain to:
- the Information Commissioner's Office (ICO) — Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; 0303 123 1113; ico.org.uk/concerns; and/or
- ICAEW, as our professional regulator, in relation to our conduct as a firm — icaew.com/complaints
- 17. Changes to this notice
We may update this notice from time to time. The current version will always be available at ryans-uk.com/privacy-policy. This notice was last updated on 29th July 2026.