Privacy Notice

Last reviewed: September 2026

1. Who we are and how to contact us

Aaroha Services Ltd (“Aaroha”, “we”, “us” or “our”) is a firm of Chartered Certified Accountants registered in England and Wales under company number 17345198, with its registered office at 124 City Road, London, EC1V 2NX. For the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018, Aaroha is the controller of the personal information described in this notice.

If you have a question about this notice, want to exercise a data protection right, or wish to raise a concern about how we handle personal information, please contact us at info@aaroha.co.uk or write to us at the registered office address above.

2. Who this notice covers

This notice applies to personal information we hold about prospective clients, clients, suppliers and other business contacts, visitors to our website, and individuals connected with a client or prospective client, including directors, shareholders, beneficial owners, employees and other representatives.

Where we receive personal information about an individual connected with a client, such as a director or beneficial owner, from the client rather than from that individual directly, we ask the client to bring this notice to that individual's attention. Where it is practicable for us to do so, we will also provide this information directly.

3. The personal information we collect

The information we collect depends on the nature of our relationship with you and the services involved. It may include:

names and contact details;

identity and address evidence, including documents obtained for identity verification purposes;

dates of birth and tax reference numbers, including National Insurance and Unique Taxpayer Reference numbers;

business, company and ownership information, including details of directors, shareholders and beneficial owners;

accounting, banking and transaction records;

tax information;

payroll and employment information;

pension information, where relevant;

correspondence between us; and

any other information we reasonably need to provide our services or to meet our professional, legal and regulatory obligations.

4. Where we obtain personal information

We usually receive personal information directly from you, or from someone acting for you or connected with the work we are doing. We may also receive it through our website contact form, from HM Revenue & Customs or Companies House where appropriate to the services we provide, and from publicly available sources or professional bodies where relevant to those services or to our legal obligations, for example when verifying identity or checking a company's officers.

5. How and why we use personal information

to respond to enquiries and assess whether, and on what terms, we are able to act for you;

to carry out client onboarding, identity verification and anti-money laundering checks required by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017;

to provide accountancy, bookkeeping, payroll, tax and related advisory services;

to prepare and make submissions to HMRC, Companies House and other relevant authorities on your behalf, where authorised;

to maintain client files and business records;

to issue, collect and manage invoices;

to comply with our legal, regulatory and professional obligations, including those owed to our regulator, ACCA;

to establish, exercise or defend legal rights, including in connection with a complaint or claim;

to keep our systems, communications and business secure; and

to understand how our website and services are used and to improve them.

6. Our lawful bases for using personal information

We rely on the following lawful bases under the UK GDPR, depending on the purpose:

performance of a contract, or steps taken at your request before entering into a contract, for example when preparing a proposal or engagement letter;

compliance with a legal obligation, for example our obligations under the Money Laundering Regulations 2017, HMRC and Companies House requirements, and the rules of ACCA;

our legitimate interests, or those of a third party, provided these are not overridden by your interests or fundamental rights. We rely on this basis for purposes such as responding to general enquiries, managing our business relationships, maintaining the security of our systems, and defending or pursuing legal claims; and

consent, where consent is the appropriate basis, for example for direct marketing beyond what is permitted under the soft opt-in rule described in section 7, or for non-essential website cookies.

Where we process special category personal information, such as health information that may appear in payroll or pension records, we do so only where an additional condition permitted by data protection law applies, for example because the processing is necessary for compliance with employment or social security law, and with appropriate safeguards in place.

7. Marketing

We do not send marketing communications unless you have consented to receive them, or unless the soft opt-in exemption under the Privacy and Electronic Communications Regulations 2003 applies, for example where you are an existing client and we are contacting you about similar services. You can ask us to stop receiving marketing at any time by contacting us using the details in section 1, and there is no charge for this.

8. Who we share personal information with

We do not sell personal information, and we do not share it for other organisations' own marketing purposes. Where necessary for the work or our obligations, we may share personal information with:

HMRC, Companies House and other relevant regulators or authorities, where required by law or necessary to carry out your instructions;

banks, pension providers and other organisations relevant to the services we are providing;

our professional indemnity insurers and our regulator, ACCA, where required, for example in connection with a practice review or a claim;

other professional advisers or third parties involved in the work, where authorised or appropriate; and

trusted technology and cloud service providers who process personal information on our behalf under written agreements that require them to keep it secure and confidential, and to use it only as we instruct.

9. International transfers

Some of our technology or service providers may store or process personal information outside the United Kingdom. Where this happens, we ensure that an appropriate safeguard is in place, such as the UK's international data transfer agreement, an adequacy decision, or another lawful transfer mechanism recognised by UK data protection law.

10. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose it was collected. The period varies according to the type of record and the legal or professional requirement that applies to it. The table below sets out the minimum periods we work to.

Where a client relationship or a specific matter requires a longer period, for example because we are required to keep records for longer to defend a legal claim or to comply with a professional or contractual obligation, we will do so. We securely delete or anonymise personal information once it is no longer required.

11. Website use, analytics and cookies

When you contact us through our website, we use the information you provide to respond to your enquiry and, where relevant, to take steps towards providing our services. We may use analytics to understand how visitors use our website, but non-essential analytics or similar technologies are only used once the required consent has been given. Please see our Cookie Policy for more detail.

12. Your data protection rights

Depending on the circumstances, and subject to legal conditions and exemptions, you may have the right to:

ask for access to the personal information we hold about you;

ask us to correct inaccurate or incomplete information;

ask us to erase your information;

ask us to restrict how we use your information;

ask us to provide your information in a portable format; and

object to certain processing, including processing based on our legitimate interests.

Where we rely on your consent, you can withdraw it at any time, without affecting the lawfulness of anything we did before you withdrew it.

To exercise a right, please contact us using the details in section 1. We will normally respond within one month of receiving a valid request, although this may be extended by a further two months for complex or numerous requests, in which case we will let you know. We may need to verify your identity before we can act on a request.

13. Automated decision-making

We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

14. Keeping information secure

We use technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or misuse, and we restrict access to those who need it for legitimate business purposes. We have procedures in place to identify and investigate a personal data breach and, where required by law, to report it to the ICO and to affected individuals.

15. Children

Our website and services are directed at businesses and adults, and we do not knowingly collect personal information from children.

16. Complaints

If you are unhappy with how we have handled your personal information, please contact us first at info@aaroha.co.uk so that we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, although we would welcome the opportunity to address your concern beforehand.

17. Changes to this notice

We review this notice regularly and whenever our services, systems or legal obligations change. The version published on our website is the current version, and we encourage you to check it from time to time.