Privacy policy.
This notice explains what personal data Sterlinx collects, why we hold it, how long we keep it and what rights you have. It applies to this website and to the services we provide.
Who we are
Sterlinx is the data controller for the personal data described in this notice. We are registered in England and Wales and our registered office is 3a Bridgewater Street, Baltic Triangle, Liverpool L1 0AR.
Controller
Sterlinx determines why and how your personal data is processed.
Data protection contact
Data protection queries go through our contact form. We do not publish direct email addresses; the form is monitored and routed to the person responsible.
Telephone
+44 (0) 203 355 5585 for urgent data matters during office hours.
Scope
This notice covers this website, enquiries, engagements and marketing. Separate notices may apply to specific services.
The personal data we collect
We collect only what we need to respond to an enquiry, act as your accountant, meet our legal obligations and run the practice. Because we are a regulated accountancy practice, some of what we must collect is prescribed by law rather than chosen by us.
Identity and contact data
Name, company name, postal address, telephone number and the details you submit through our enquiry form.
Engagement and financial data
Records needed to prepare accounts, tax returns and VAT filings, including transaction data, bank statements and marketplace reports you provide.
Anti-money-laundering data
Identity verification documents, beneficial ownership information and source-of-funds evidence, which we are legally required to obtain and retain.
Technical and usage data
IP address, device and browser type, pages visited and referral source, collected through cookies subject to your consent.
How we collect it
- Directly from you, through the enquiry form, by telephone, or in correspondence about an engagement
- From your authorised representatives, such as bookkeepers, marketplace account managers or previous advisers
- From third-party sources where verification is required, such as Companies House and identity verification providers
- Automatically, through cookies and similar technologies on this website
- From publicly available registers where we are required to verify information
Why we use it, and our lawful basis
We must have a lawful basis for each purpose. The table below sets out what we do and the basis we rely on. We do not rely on consent where the processing is necessary to perform a contract or meet a legal obligation, because consent can be withdrawn and would not then reflect our duties.
Responding to your enquiry — legitimate interests
We process your details to answer the question you asked. We keep enquiry records so we can pick up the conversation.
Providing accounting services — contract
Processing is necessary to deliver the engagement you have instructed us to carry out.
Statutory filings and AML checks — legal obligation
Company, tax and anti-money-laundering law requires us to hold and report specific information.
Marketing updates — consent or legitimate interests
Where you have subscribed, we rely on consent. For existing clients we may rely on legitimate interests for closely related updates, with an unsubscribe in every message.
Who we share it with
We share personal data only where it is necessary, and only with parties who are bound by confidentiality and data protection obligations. We do not sell personal data, and we do not share it for third-party marketing.
Tax authorities and registries
HMRC, Companies House and equivalent overseas authorities where a filing or registration requires it.
Regulators and professional bodies
Where we are required to report, or where our professional body carries out monitoring.
Service providers
Software for accounts, payroll, practice management and secure file storage, each under a data processing agreement.
Professional advisers
Legal or tax counsel, and auditors, where a matter requires specialist input.
International transfers
Some of our service providers process data outside the UK. Where that happens we rely on an adequacy regulation or the International Data Transfer Agreement, together with appropriate technical and organisational safeguards. We do not transfer data to a country without a lawful transfer mechanism in place.
How long we keep it
Retention is driven by law and by the need to defend claims. We do not keep personal data indefinitely, and we delete or anonymise it once the retention period expires.
Enquiries that do not become engagements
Retained for a limited period so we can follow up, then deleted.
Client and engagement records
Retained for the period required by tax and company law, and for a further period to cover the limitation period for claims.
Anti-money-laundering records
Retained for the statutory minimum period after the relationship ends.
Marketing preferences
Retained until you unsubscribe, plus a suppression record so we do not contact you again in error.
Your rights
You have rights over your personal data. We respond within one month, extendable where a request is complex. There is normally no charge.
- Right of access — a copy of the personal data we hold about you
- Right to rectification — correction of inaccurate or incomplete data
- Right to erasure — deletion where no legal obligation requires retention
- Right to restriction — limiting how we use your data while a query is resolved
- Right to object — to processing based on legitimate interests, and to direct marketing at any time
- Right to data portability — a machine-readable copy of data you provided, where applicable
- Right to withdraw consent — where we rely on consent, without affecting prior processing
- Right to complain — to the Information Commissioner's Office, or to us first if you prefer
Security and cookies
We use access controls, encryption in transit, least-privilege access and secure storage for client records. Staff are bound by confidentiality obligations. No system is perfectly secure, but we maintain proportionate controls and review them.
Cookies
Strictly necessary cookies are set to operate the site. Analytics and marketing cookies are set only after consent, and you can change your choice at any time. Our cookie policy lists the categories in use.
No passwords by email
We do not ask for passwords by email, and we will never ask you to confirm card details by email.
Reporting a concern
If you believe your data has been mishandled, contact us through the form and we will investigate promptly.
The things people ask before they commit.
If yours is not here, ask it directly — the answer comes from the person who would do the work.
One working day, no sales sequence afterwards.
Ask your questionDo you sell or share my data for marketing?
No. We do not sell personal data and we do not share it with third parties for their own marketing.
Do I have to provide the information you ask for?
For an enquiry, no — though we may not be able to answer fully without it. For an engagement, some information is required by law, and we cannot act without it.
How do I make a data request?
Use the contact form and state that it is a data protection request. We will acknowledge it and respond within the statutory period.
Can I complain to the regulator?
Yes. You can complain to the Information Commissioner's Office at any time, though we would appreciate the chance to resolve it first.
Does this notice cover third-party sites you link to?
No. When you follow a link away from our site, the destination site's own privacy notice applies.
Start with the number in front of you.
Registration is a one-off. Compliance is annual. No onboarding surprises, no monthly conversion of an annual fee.