Privacy Notice

RD Accounting Limited

Last updated: 7 September 2026

1. About this notice

RD Accounting Limited (“RD Accounting”, “we”, “us” or “our”) respects your privacy and is committed to protecting personal data.

This notice explains how we collect, use, store and share personal data when:

you are a client or prospective client;
we provide accounting, tax, bookkeeping, payroll or related professional services;
you are connected with one of our clients, for example as an employee, director, shareholder, supplier or customer;
you communicate with us;
or you visit or use our website.

This notice should be read alongside our engagement letter, schedules of services and standard terms and conditions.

2. Who we are

RD Accounting Limited is normally the controller of personal data used to provide our professional services.

For certain services, such as payroll processing or bookkeeping undertaken strictly on a client’s instructions, we may act as a processor on behalf of the client. Where we act as a processor, the relevant client remains the controller and our processing is governed by an appropriate data-processing agreement or schedule.

Our contact details are:

RD Accounting Limited
12C Two Locks, Hurst Business Park, Brierley Hill, DY5 1UU
Email: info@rd-accountingltd.co.uk
Telephone: 01384 636 763
Website: www.rd-accountingltd.co.uk
ICO registration number: ZA257556
Our privacy contact is Richard Dunkley, who can be contacted using the details above.

3. Personal data we collect

Depending on the services we provide, we may collect and process:

names, addresses, dates of birth and contact details;
National Insurance numbers, Unique Taxpayer References and tax information;
identification documents and information required for anti-money-laundering checks;
accounting records, invoices, receipts and bookkeeping information; bank-account details and transaction information;
income, expenditure, assets, liabilities and investment information; payroll, employment, pension and benefits information;
company, partnership, trust, directorship and ownership information;
information about employees, customers, suppliers and other people connected with a client;
correspondence, instructions, advice and records of our work; information concerning complaints, disputes, investigations or legal claims;
website and technical information, such as IP addresses, device information and cookie preferences;
and special-category or criminal-offence data where it is relevant and lawful for us to process it.

We seek to collect only the information reasonably required for the relevant purpose.

4. Where personal data comes from

We may obtain personal data from:

you or someone acting on your behalf;
other individuals connected with a client;
previous accountants and professional advisers;
employers, employees, customers and suppliers;
HM Revenue & Customs, Companies House and other public authorities;
banks and financial institutions where appropriate authority has been given;
accounting, bookkeeping, payroll and document-management systems, including Xero;
identity-verification and anti-money-laundering service providers;
publicly available sources and registers;
and our website, communications and technology systems.

5. How and why we use personal data

We may process personal data to:

assess whether we can act for you;
verify identity and complete anti-money-laundering checks;
provide accounting, tax, bookkeeping, payroll and related professional services;
prepare and submit returns, accounts and other documents;
communicate with clients, HMRC and authorised third parties;
maintain professional and regulatory records;
manage our client relationships, invoicing and payments;
operate, secure and improve our business systems;
obtain specialist or professional assistance;
establish, exercise or defend legal claims;
prevent and detect fraud or other unlawful activity;
and provide information about our services where permitted.

Our lawful bases may include:

taking steps before entering into a contract;
performing our contract with you;
complying with legal and regulatory obligations;
pursuing our legitimate interests or those of another person, provided those interests are not overridden by individual rights;
establishing, exercising or defending legal claims;
and consent, where consent is the appropriate lawful basis.

Where we rely on consent, it may be withdrawn at any time. Withdrawal does not affect processing already undertaken lawfully.

6. Use of artificial intelligence

We use carefully selected artificial-intelligence services to assist our staff in providing and administering professional services.

These tools may be used for purposes including:

reviewing bookkeeping and accounting information;
suggesting transaction categories or potential reconciliation matches;
identifying inconsistencies or missing information;
summarising documents and correspondence;
preparing draft explanations, checklists and communications;
and supporting internal administration and quality-control work.

Our AI service providers may process information supplied to them on our behalf. This may include relevant excerpts from documents, accounting records, website or browser content, prompts, screenshots and generated outputs.

We currently use OpenAI’s business services. Depending on the circumstances:

OpenAI acts as our processor where we are the controller; or
OpenAI acts as our subprocessor where we are processing data on a client-controller’s behalf.

We use OpenAI under business terms and a data-processing agreement containing confidentiality, security, deletion, assistance and international-transfer provisions. OpenAI states that data from its business services is not used to train its models by default.

We apply data-minimisation and access controls and restrict AI use to approved business accounts and authorised staff.

AI-generated material may contain errors and is treated as a working aid. Appropriate staff remain responsible for reviewing outputs and making professional decisions. We do not use AI to make decisions based solely on automated processing that have legal or similarly significant effects on individuals.

Unless separately authorised and subject to appropriate controls, AI tools are not permitted to make payments, change bank details, approve tax filings or complete other consequential financial actions without human review.

7. Who we share personal data with

Where necessary and lawful, we may share personal data with:

HM Revenue & Customs, Companies House and other public authorities;
regulators, law-enforcement agencies and courts;
our professional body and professional advisers;
professional-indemnity insurers and legal advisers;
tax, accounting and other specialists assisting with client work;
an alternate appointed to protect clients in the event of incapacity or death;
banks and financial institutions where authorised;
software, cloud-storage, communications, cybersecurity and document-management providers;
identity-verification and anti-money-laundering providers;
accounting platforms such as Xero, QuickBooks and FreeAgent;
client-management, tax and practice-management software providers;
artificial-intelligence service providers, including OpenAI OpCo, LLC and relevant OpenAI affiliates and subprocessors;
other parties whom you ask or authorise us to contact;
and a purchaser or successor if our business is reorganised, transferred or sold.

Our service providers are required to process personal data only for authorised purposes and subject to appropriate contractual, confidentiality and security obligations. We do not sell personal data.

8. International transfers

Some of our service providers and their subprocessors operate in, or may access personal data from, countries outside the United Kingdom. These countries may include the United States and other locations in which our technology providers maintain infrastructure or support operations.

Where a restricted international transfer takes place, we use an appropriate lawful transfer mechanism. Depending on the recipient, this may include:

UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the recipient is appropriately certified;
the UK International Data Transfer Agreement;
EU Standard Contractual Clauses together with the UK International Data Transfer Addendum;
contractual arrangements incorporated into the relevant supplier’s data-processing agreement;
or another safeguard or exception permitted by applicable data-protection law.

OpenAI’s current data-processing agreement provides for UK data transfers using the EU Standard Contractual Clauses as amended by the UK Addendum.

Further information about the safeguards applying to a particular service provider is available by contacting us.

9. Data security and confidentiality

We maintain proportionate technical and organisational measures intended to protect personal data against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access.

These measures may include:

access restrictions and named user accounts;
multi-factor authentication;
encryption in transit and, where supported, at rest;
approved business software and devices;
staff confidentiality obligations;
supplier due diligence and contractual protections;
backup, incident-management and recovery procedures;
and human review of AI-assisted work.

No system can be guaranteed to be completely secure. If we become aware of a personal-data breach, we will respond in accordance with our legal and contractual obligations.

10. How long we retain personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, tax, professional, insurance and regulatory requirements.

Accounting, tax and client-service records are normally retained for up to seven years after the end of the relevant accounting or tax period, completion of the relevant work or termination of the client relationship. Some records may be retained for longer where required by law, professional obligations, an ongoing enquiry, a complaint or a legal claim.

Where we act as a processor, personal data will be returned or deleted in accordance with the controller’s instructions and the applicable data-processing agreement, unless the law requires continued retention.

Website enquiries and prospective-client information that do not result in an engagement will be retained only for a reasonable period.

Different retention arrangements may apply to:

accounting and source systems;
email and document-storage systems;
AI conversations and generated outputs;
browser sessions, histories and cookies; backup systems;
regulatory and audit records;
and information retained by another controller.

Deleting information from one location may not automatically remove copies held in another system. We manage deletion across relevant systems in accordance with our retention procedures and supplier arrangements.

11. When information must be provided

Certain personal data is required so that we can comply with legal obligations or perform our engagement.

If required information is not provided, we may be unable to begin or continue acting, complete the requested work or meet relevant filing obligations.

12. Marketing

We may contact you about relevant services where you have consented or where this is otherwise permitted by law.

You can ask us to stop marketing communications at any time by using the unsubscribe option in the communication or contacting us.

13. Website cookies

Our website may use cookies or similar technologies that are necessary for security and operation.

If we use analytics, advertising or other non-essential cookies, we will provide appropriate information and obtain consent where required. Cookie choices can be changed through the website’s cookie-preference controls.

14. Your rights

Depending on the circumstances, individuals may have rights to:

be informed about processing;
request access to their personal data;
ask us to correct inaccurate or incomplete information;
ask us to erase personal data;
restrict processing;
object to processing based on legitimate interests;
receive certain information in a portable format;
withdraw consent where processing relies on consent;
and obtain safeguards relating to certain automated decisions.

These rights are subject to legal conditions and exemptions. Professional secrecy, legal obligations and record-retention requirements may affect what we can provide or delete.

Requests should be sent to richard.dunkley@rd-accountingltd.co.uk. We may need to verify the requester’s identity before responding.

15. Complaints

Please contact us first if you have questions or concerns about how we use personal data:

Richard Dunkley
Email: richard.dunkley@rd-accountingltd.co.uk
Address: 12C Two Locks, Hurst Business Park, Brierley Hill, DY5 1UU

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/

16. Changes to this notice

We review this notice regularly and may update it when our services, suppliers or legal obligations change.

Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected individuals before beginning the new processing.