Privacy notice for clients

This notice explains what personal information Avinat LLP collects about you and the people connected with your business, why we collect it, who we share it with, how long we keep it, and the rights you have. It applies from the moment you open our onboarding page and for as long as we act for you.

Please read it before completing the onboarding questionnaire and the identity check. The questionnaire asks you to confirm that you have read it.

If you use our Companies House identity service, section 12 explains what is different for you. If you ask us to set up a company or LLP, or to file a confirmation statement, section 13 does.

1. Who we are

Avinat LLP is a bookkeeping, payroll and Companies House services practice. Our registered office is 7 Bevendon Square, Salford, Manchester M7 4TF. We are the data controller for the information described in this notice.

We are registered with the Information Commissioner’s Office under number ZA312020. We are supervised for anti-money-laundering purposes by HM Revenue & Customs, registration XSML00000210369.

Questions about this notice or about your information go to Yisroel Guttentag, partner, at info@avinat.com or by post to the address above.

2. The information we collect

Information you give us

Through the onboarding page and in the course of our work: the name, company number and addresses of your business; how it trades; VAT, PAYE and other tax references where we need them; the name, date of birth, home address, nationality, mobile number and email address of each director, owner and person with significant control; whether any of those people holds or has held a prominent public position; what the business does and where its income comes from; who advised you before us; and the answers you give to the other questions on the page. Where the identity document a person uses does not show their home address, we also ask for a proof of address, such as a bank statement or utility bill.

Information from public sources

We take your company’s details, its officers and its people with significant control from the Companies House register and ask you to confirm them. Where a discrepancy between what you tell us and the register cannot be explained, the Money Laundering Regulations require us to report it to Companies House.

Information from the identity check

When you complete the electronic identity check: images of the identity document you present and the details read from it (name, date of birth, document number, expiry, and address where the document carries one); a short live recording of your face, from which a comparison with the document photograph is made; the results of the document authenticity checks, the face comparison and the screening against sanctions, politically exposed persons and law-enforcement lists; and technical details of the device used, including its IP address, browser and the date and time.

Information from working for you

Bank transactions, invoices, receipts, payroll and pension data, and correspondence. Where that data is about your employees or customers we usually process it on your instructions as your processor, and your own privacy notice to those people covers it. This notice covers the information about you and the people who own and run the business.

3. Why we use it, and our legal basis

UK data protection law requires us to have a lawful basis for each purpose. These are ours.

Purpose	Legal basis
Verifying the identity of the business and of the people who own and control it, assessing the risk of money laundering, and screening against sanctions and politically exposed persons lists	Legal obligation — the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended
Keeping identity and due-diligence records for the period the law requires	Legal obligation — regulation 40 of the same Regulations
Preparing, agreeing and carrying out the engagement letter: the bookkeeping, VAT, payroll and other services you have asked for	Performance of a contract with you
Acting as your agent with HMRC and, with your permission, contacting your previous adviser	Performance of a contract; and your consent for the approach to the previous adviser
Corresponding with you, running our practice, keeping accounts and defending legal claims	Our legitimate interests in running the practice properly, balanced against your interests
Using your face to confirm that the person presenting the document is its holder	Your explicit consent — see section 4

4. The face check

The identity check compares a live recording of your face with the photograph on your identity document. Data used to identify a person from their physical characteristics is biometric data, which the law treats as special category data and protects more strictly.

We rely on your explicit consent for the face check. You give it by proceeding with the check after reading this notice, and the onboarding page records when you did so.

You do not have to use the electronic check. If you prefer, we will verify your identity in person at our office from your original documents. Tell us and we will arrange it. Choosing this does not affect how we treat you as a client.

You can withdraw consent at any time by contacting us. Withdrawal does not undo processing that has already happened, and we may then need to verify your identity another way before we can continue to act.

The face recording is used only for this comparison. It is not used to identify you anywhere else, is not shared with anyone other than our identity verification provider, and is not kept once the check is complete (see section 7).

5. Automated checks and human review

The document checks, the face comparison and the list screening are carried out automatically by our identity verification provider. No decision that affects you is taken by the software alone. A partner at Avinat reviews every result that is not a clear pass, and any decision to decline to act for you is made by a person. You may ask us to explain a result and to review it.

6. Who we share it with

We use the following organisations to process information on our behalf. Each acts on our instructions under a written contract and may not use your information for its own purposes.

Provider	What it does for us
ID Analyzer (Evith Technology Ltd)	Electronic identity verification: document checks, the face comparison, sanctions and politically exposed persons screening, and the electronic signing of the engagement letter. We use their European Union service, so the document, the face recording and the results are processed and stored in Frankfurt, Germany.
IONOS	Hosts our website, including the onboarding page you complete.
Karbon	Our practice management system, where client records, correspondence and the identity and due-diligence file are kept.
Microsoft 365	Email, calendar and document storage.
Anthropic (the Claude API)	Reading the name, address and date on a proof of address, so we can compare them with the details you gave us. It decides nothing; a person checks the document.
Xero and QuickBooks	Accounting systems in which your books are kept, whichever applies to you.
Dext	Capturing receipts and invoices for your books.
GoCardless	Collecting our fees by direct debit.
Make	Moves the details of a payment or Direct Debit between our own systems (GoCardless, Stripe, QuickBooks and Karbon) so our records stay in step.

If you pay an invoice from us by card or with iwocaPay

The payment is taken by the provider you choose, which also keeps payment records for its own legal purposes, under its own privacy notice. We never see your card details.

Provider	What it does
Stripe	Takes a card payment when you press the card button on an invoice or an order, and pays any refund.
iwoca (iwocaPay)	Lets you pay an invoice through iwocaPay if you choose to. iwoca receives the details you give it to do that.

We also share information where our work or the law requires it:

• HMRC, when we act as your agent for VAT, PAYE or other taxes.
• Your previous adviser, to obtain the usual professional clearance and handover information, only with your permission.
• Your accountant or other professional advisers, on your instruction.
• Companies House, where we must report a discrepancy on the register.
• Our anti-money-laundering supervisor, if it inspects our records.
• The National Crime Agency, the police or a court, where the law requires us to report or disclose. In some cases the law forbids us from telling you that we have done so.

We do not sell your information and we do not share it with anyone for marketing.

7. How long we keep it

Information	How long
Identity and due-diligence records, including the identity document image, the verification report and the signed engagement letter	Seven years after our engagement ends. The law requires at least five; the longer period is set out in the engagement letter.
The identity document images, the face recording and the check results held by ID Analyzer	Until we delete them from ID Analyzer, which we do once the verification report has been filed in our own records. We keep that report, which contains the document image and a still photograph, with the due-diligence record above.
Your proof of address at Anthropic	Anthropic deletes it within 30 days, unless it must keep it longer by law or to enforce its usage policy.
Your books, payroll records and our working papers	Seven years after the end of the accounting year they relate to, or as long as the law requires for the records concerned, whichever is longer.
Onboarding information where you do not become a client	Deleted twelve months after your last contact with us.
The copy of your answers on the onboarding website	Removed once the record has been filed in our practice management system.

8. Where it is held

Your information is held in the United Kingdom and the European Union. Some of the providers in section 6 are based outside the UK or hold data outside it: in particular, ID Analyzer is operated by a company established in Taiwan, although the identity data itself stays on its servers in Germany. Where information leaves the UK, or is accessed from outside it, we rely on the UK Government’s adequacy regulations for the country concerned, or on the International Data Transfer Agreement or Addendum approved by the Information Commissioner, so that it receives protection equivalent to UK law.

9. How we protect it

The onboarding page is served over an encrypted connection and protected by a password you choose. Identity documents and reports are held in access-controlled storage that is not reachable from the public website. Only Avinat partners and staff who need the information for their work can see it, and our providers are contractually bound to keep it secure.

10. Your rights

You have the right to:

• ask for a copy of the information we hold about you;
• have inaccurate information corrected;
• have information deleted, where we no longer need it and the law does not require us to keep it;
• restrict or object to how we use it, in some circumstances;
• receive the information you gave us in a portable form;
• withdraw consent where consent is our basis, as explained in section 4; and
• not be subject to a decision based solely on automated processing, as explained in section 5.

We will respond within one month. Some rights are limited by the Money Laundering Regulations: for example, we cannot delete identity records while the law requires us to keep them, and we cannot tell you about a report we are prohibited from disclosing.

If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

11. Cookies on the onboarding page

The onboarding page sets one cookie, which keeps you signed in after you enter your password. It is deleted when you close your browser. The page uses no analytics or advertising cookies.

12. Our Companies House identity service

This section is for people who use our Companies House identity verification service, which starts at avinat.co.uk/verify. The rest of this notice applies to you too, except where this section says otherwise.

What the service does

Company directors and people with significant control must verify their identity with Companies House. Avinat LLP is an authorised corporate service provider (ACSP), which means Companies House allows us to verify a person's identity and tell it the result. We check your identity to Companies House's standard and file a statement with Companies House that we have verified you. Companies House then emails you your personal code.

The information we collect

• When you pay: your name, email address and phone number, the company the check is for, and the amount and reference of your payment. Stripe takes the payment; we never see your card details.
• The online check: images of your passport or driving licence and the details read from it, and a selfie with a short liveness check, which is compared with the photograph on your document.
• If you upload your documents instead: the pictures you upload and the details read from them.
• The video call: still images from the call, of your face and of your document when you hold it up to the camera. We may take several, including retakes, and we keep them all. The call itself is not recorded.
• Your proof of address: the document, and the name, address, postcode, date and sender read from it.
• Companies House: what we file (see below), the reference Companies House gives the filing, and your personal code if you ask us to keep it for you (see section 13).
• Our emails and notes about your verification.

Why we use it, and our legal basis

Purpose	Legal basis
Verifying your identity to Companies House's standard and filing the statement that we have done so	Performance of a contract with you; and legal obligation — the rules for authorised agents under the Companies Act 2006, as amended by the Economic Crime and Corporate Transparency Act 2023, and the Money Laundering Regulations
Keeping the record of the check	Legal obligation — the same rules
Comparing your face with the photograph on your document	Your explicit consent — see below
Taking your payment, sending your receipt and keeping our accounts	Performance of a contract with you; and legal obligation to keep accounting records

Comparing your face

In the online check, ID Analyzer compares your selfie with the photograph on your document. On the video call, we take still images from the call and ID Analyzer compares them with your document in the same way. The comparison helps a person at Avinat decide; it never decides on its own (see section 5).

A comparison like this uses biometric data, and we rely on your explicit consent, as section 4 explains. You give it by starting the online check, or by joining the video call. If you would rather the still images from the call were not compared by software, tell us before or during the call and we will compare them with your document by eye instead. You can withdraw your consent at any time, but we may then be unable to complete your verification.

Who we share it with

Who	What for
Companies House	We file a statement that we have verified you, with your name, date of birth, email address and home address, the documents we checked (their type, number, expiry date and country of issue), and how we checked them. Companies House's own privacy notice covers what it does with them.
Stripe	Takes your payment and pays any refund. Stripe also keeps payment records for its own legal purposes, under its own privacy notice.
Make	Passes the details of your payment from Stripe to QuickBooks and Karbon.
ID Analyzer (Evith Technology Ltd)	The online check, and comparing your selfie, or the still images from the call, with your document. Its servers are in Frankfurt, Germany.
Whereby	Runs the video call. The call is not recorded, by us or by Whereby.
Anthropic (the Claude API)	Our proof-of-address reader. It reads the name, address, postcode, date and sender from your proof of address, so that we can compare them with the details you gave us. It decides nothing: a person at Avinat checks the document. Anthropic does not use it to train its models and deletes it within 30 days, unless it must keep it longer by law or to enforce its usage policy.
Karbon	Our practice management system, where your case, our notes and a copy of the evidence are kept.
Microsoft 365	Email, and SharePoint, where the full record of the check is kept.
QuickBooks	Our own accounts. A receipt for your payment is recorded there, with your name or company name and your email address.

How long we keep it

Information	How long
The record of the check: your document images, your selfie or the still images from the call (every one we take), your proof of address, the results and a one-page case record, kept in Karbon and SharePoint	Seven years after we complete your verification.
Small, low-resolution previews of those pictures, on our web server	Once your case is closed, the full-size files leave our web server for SharePoint. The small previews stay on our server, so that we can open your case quickly, for the same seven years.
The copies held by ID Analyzer: your document images, your selfie, the still images compared on the call, and the results	ID Analyzer keeps its copies for as long as its service terms allow, and no longer than our seven-year record. We do not delete them from ID Analyzer when your case closes, so what section 7 says about deleting them does not apply.
Your payment and receipt, in Stripe and QuickBooks	Seven years after the end of our accounting year, like our other accounting records.
Your proof of address at Anthropic	Anthropic deletes it within 30 days, unless it must keep it longer by law or to enforce its usage policy.

For this service the pictures of your face are part of the record of the check, so what section 4 says about not keeping the face recording once the check is complete does not apply to them.

Where it is held

Some of these providers hold information outside the UK, including in the United States. Section 8 explains how we protect it.

13. Setting up a company, and confirmation statements

This section is for people who order a company or LLP set-up, or a confirmation statement, on our website, and for the directors, members, owners and people with significant control named in those orders. The rest of this notice applies too, except where this section says otherwise.

What we collect

• About the company: its name, type, address, email for letters from Companies House, what it does, its shares or members, and, for a confirmation statement, its details on the Companies House register.
• About each person named in the order: name, any former names, date of birth, nationality, the country they live in, home address, correspondence address, their shares or share of the LLP, whether they control the company, and their Companies House personal code if they have one.
• About a company that owns shares: its name, company number, registered address, and the name of the person agreeing for it.
• About you, if you fill in the order: your name, email address and phone number, and whether you are setting it up for yourself or for someone else.
• For a confirmation statement: the company’s authentication code, which you give us so that we can file for it.
• Payment: the amount and reference of your payment. Stripe takes the payment; we never see your card details.
• Your description of what the company does, if you use our activity helper (see below).

If you fill in an order for other people, please make sure they have agreed and that they know about this notice.

Why we use it, and our legal basis

Purpose	Legal basis
Preparing and filing the company’s set-up or its confirmation statement with Companies House, and registering a new company for Corporation Tax with HMRC	Performance of a contract with you; and legal obligation — the Companies Act 2006, as amended by the Economic Crime and Corporate Transparency Act 2023
Checking who we are acting for, and keeping the records	Legal obligation — the Money Laundering Regulations, which apply to forming companies and to providing a registered office address
Providing our registered office address service, if you choose it, and sending on official letters	Performance of a contract with you
Reminding you when the first confirmation statement is due, if you ask us to	Your consent, which you can withdraw at any time
Taking your payment, sending your receipt and keeping our accounts	Performance of a contract; and legal obligation to keep accounting records

What goes on the public register

Companies House publishes some of what we file, and anyone can see it online: the company’s name and address; each director’s name, month and year of birth, nationality, the country they live in and correspondence address; the owners’ names and addresses; and who has significant control. Home addresses, the day of birth, personal codes and the company’s email are not published. Companies House may share home addresses with credit reference agencies and public bodies. Companies House’s own privacy notice covers what it does with the information.

Who we share it with

Who	What for
Companies House	The company’s set-up, its confirmation statements, and the other filings you ask us to make.
HMRC	Registering a new company for Corporation Tax, including its main place of work. This is not published.
Stripe	Takes your payment and pays any refund.
QuickBooks	Our own accounts: your receipt is recorded there with your name or company name and email address.
ID Analyzer	The identity check, if we check anyone’s identity for the order (see section 12).
Anthropic (the Claude API)	Our activity helper. If you describe what the company does in your own words, Anthropic suggests the matching official descriptions. Only your description is sent, not names or addresses. It decides nothing: you choose the description. Anthropic does not use it to train its models and deletes it within 30 days, unless it must keep it longer by law or to enforce its usage policy.
Karbon and Microsoft 365	Our practice management system and email, where the order and our notes are kept.

Keeping your personal code for you

Companies House emails each person their personal code. If you ask us, through the secure link in our email, we will keep your code on file so that we can tell you it if you lose it. We keep it sealed, only Avinat staff can see it, and each time it is looked at is recorded. We keep it until you ask us to delete it.

How long we keep it

Information	How long
Authentication codes and personal codes given for an order	Deleted once Companies House has accepted the filing, or 30 days after an order that was not finished or was cancelled. A personal code you ask us to keep is kept until you ask us to delete it.
Home addresses given for an order	Deleted once Companies House has accepted the filing, except where we also keep them as part of an identity check (section 12) or as a client’s records.
The order, what we filed, and the payment	Seven years after the end of our accounting year, like our other records.
Records of the checks we make for the Money Laundering Regulations	Seven years after the work ends.

14. Changes to this notice

We will update this notice when our practices or the law change. The version and date are shown at the top. If a change affects how we use information you have already given us, we will tell you.