Privacy Policy

AML Consultancy Solutions Ltd (company number 12747461) is the data controller for the personal information described in this policy. Our registered office is First Floor, Unit D2, 4 Neptune Park, Plymouth, PL4 0SJ. We are part of AML Finance Group, which also includes our sister firm AML Accountancy Solutions.

If you have any questions about this policy or how we handle your information, please contact our data protection lead:

Depending on how you deal with us, we may collect and use the following information:

• Identity and contact details such as your name, job title, business name, email address, telephone number and postal address.
• Enquiry information that you give us through our contact forms, by email, by phone or in meetings, including details of your business and what you need help with.
• Project information that you share with us so we can deliver consultancy or build a custom spreadsheet, such as business processes, figures and sample data. Where possible we ask you to remove personal information about other people before sharing data with us.
• Purchase information such as the spreadsheets you buy, the amount paid, invoice details and order history. Card payments are handled by our payment provider and we never see or store your full card details.
• Client portal information if you create a client portal account: your email address, your password (stored only in scrambled form that cannot be read, not even by us), any recovery email address and contact details you save, your recent downloads, the version of our Terms and Conditions and Disclaimer you agreed to for each order, and security records such as failed sign-in attempts.
• Download records: each time a file is downloaded through our website, we record the date and time, the file, the email address of the person who downloaded it and the IP address used, against the order it belongs to.
• Team member information if someone in your organisation adds you to their client portal account: your email address, the date you were added and your own sign-in details. The person who added you is responsible for telling you about this.
• Call recordings and notes of telephone calls with our team (see section 7).
• Website usage information such as your IP address, browser and device type, pages visited and how you arrived at our website, collected through cookies and similar technologies (see our Cookie Policy).
• Marketing preferences such as whether you have asked to receive updates from us.

• Directly from you when you fill in a form on our website, email or call us, buy a spreadsheet, or work with us on a project.
• From the account holder in your organisation, if they add you as a team member in their client portal.
• Automatically when you use our website, through cookies and similar technologies.
• From our sister firm AML Accountancy Solutions, where you have asked to be introduced to us or where you are a shared client.
• From publicly available sources such as Companies House.

UK data protection law says we must have a lawful basis for using your personal information. The table below explains what we use your information for and the basis we rely on.

Where we rely on legitimate interests, we have considered your rights and interests and are satisfied that they are not overridden. You can ask us for more information about this balancing test.

We never sell your personal information. We only share it where it is necessary for the purposes set out in this policy:

• AML Accountancy Solutions, our sister firm within AML Finance Group, where you ask us to introduce you or where you use both firms' services.
• Service providers who help us run our business, including website hosting (Webflow), email (Zoho Mail), file storage (Microsoft 365), website analytics (Google Analytics, only if you accept analytics cookies), our payment provider and our IT support. They may only use your information on our instructions.
• Online shop and client portal providers: Stripe, which processes card payments; Cloudflare, which runs our download service and client portal and stores portal account information and download records; Resend, which sends our order, sign-in and reminder emails; and Xero, our accounting system, which creates and emails your invoices and keeps a note of downloads against each invoice. They may only use your information on our instructions.
• Professional advisers such as lawyers, insurers and auditors where needed.
• Authorities and regulators such as HMRC or the National Crime Agency, where the law requires us to share information.
• A buyer or successor if our business, or part of it, is ever sold or restructured.

Some of our service providers, such as Webflow, Microsoft, Zoho, Google, Stripe, Cloudflare, Resend and Xero, may store or process information outside the UK, including in the United States and the European Union. Where this happens, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge, so that your information receives an equivalent level of protection.

We may record telephone calls to and from our team. We do this to:

• check and improve the quality of our service;
• train our team;
• keep an accurate record of what was agreed; and
• help resolve complaints and disputes.

Where a call is recorded you will be told at the start of the call. Recordings are stored securely, access is limited to authorised members of our team on a need-to-know basis, and they are kept for up to 12 months unless we need them longer to deal with a complaint, dispute or legal requirement. You can ask for a copy of a recording, or ask us to delete it, using the contact details in section 1.

We only keep personal information for as long as we need it. Typical periods are:

When information is no longer needed it is securely deleted or anonymised.

We use appropriate technical and organisational measures to protect your information, including encrypted connections (HTTPS) on our website, secure cloud systems with multi-factor authentication, access controls so that only people who need information can see it, and staff confidentiality obligations. Client portal passwords are stored only in scrambled (hashed) form, sign-in is blocked for 15 minutes after repeated wrong attempts, download links are personal to you and expire, and you can sign out of all your devices at any time. If a data breach occurs that is likely to put your rights at risk, we will tell you and the Information Commissioner's Office where the law requires.

Under UK data protection law you have the right to:

• Access the personal information we hold about you and receive a copy.
• Rectification of information that is inaccurate or incomplete.
• Erasure of your information in certain circumstances.
• Restrict how we use your information in certain circumstances.
• Object to our use of your information where we rely on legitimate interests, and to direct marketing at any time.
• Data portability, meaning you can ask for information you gave us in a commonly used electronic format.
• Withdraw consent at any time where we rely on consent. This does not affect anything we did before you withdrew it.

We will only send you marketing emails if you have agreed to receive them, or if you are an existing customer and we are telling you about similar products or services and you have not opted out. Every marketing email includes a link to unsubscribe, or you can contact us at any time.

Our website and services are intended for businesses and adults. We do not knowingly collect personal information from anyone under 18.

If you are unhappy with how we have handled your personal information, please contact us first so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection:

We review this policy regularly and will update it if the way we use personal information changes. The date at the top shows when it was last updated. This version replaces our previous Privacy and Call Recording Policy dated September 2022.