Privacy Policy
This policy explains how Supreme Consulting Ltd collects, uses, and looks after your personal data. It applies to clients, prospective clients, and visitors to our website. It has been written to meet our obligations under UK GDPR and the Data Protection Act 2018.
Who we are and what this covers
Supreme Consulting Ltd (company number 05427883) is an accountancy and business advisory practice based in Lymington, Hampshire. For the purposes of UK data protection law, we are the data controller for the personal information described in this policy. This policy covers data we collect from clients, prospective clients, and people who visit our website at supremeconsult.com. It does not cover the data practices of any third-party websites we may link to. This policy came into effect on 21 July 2026 and will be updated when our practices change materially.
What personal data we collect
The personal data we collect depends on your relationship with us and how you interact with our website.
Information you give us
When you enquire about or engage our services, you give us information directly. This includes your name, email address, phone number, and business details such as your company name and trading structure. Once you become a client, we also hold financial records, tax information, payroll data, and any other information needed to carry out the services you have instructed us to provide.
Information collected automatically
When you visit our website, certain data is collected automatically. This includes your IP address, browser type, device information, and pages visited. We use cookies and analytics tools to understand how visitors use the site. Some of these tools may set cookies on your device. You can find full details in our Cookies Policy at supremeconsult.com/cookies-policy/.
Information from third parties
We may receive information about you from third parties in the course of providing our services. This includes data from Companies House, HMRC, and accounting software platforms. Where you authorise us to act on your behalf, we may also receive correspondence or records from other professional advisers, banks, or government bodies relevant to your tax and financial affairs.
Why we process your data
We only process personal data where we have a lawful basis for doing so under UK GDPR.
To provide our services (Contract)
Where you are a client, we process your personal data because it is necessary to carry out the contract between us. This covers preparing accounts, filing tax returns, running payroll, submitting VAT returns, and all other services set out in your engagement letter. Without this data we could not perform those services.
To meet our legal obligations (Legal obligation)
As a UK accountancy firm, we are subject to legal requirements that require us to hold and process certain data. These include anti-money laundering record-keeping under the Money Laundering Regulations 2017, mandatory HMRC reporting, statutory company filings, and co-operating with regulatory investigations or court orders.
To run and improve our business (Legitimate interests)
We process some data on the basis of our legitimate interests as a business. This includes sending service-related communications to existing clients, monitoring website security, maintaining internal records, and analysing how our services are used. We have considered these interests against your rights and do not believe they override them.
Where you have agreed (Consent)
Where we send marketing emails to people who are not yet clients, or where we use optional analytics or marketing cookies, we rely on your consent. You can withdraw that consent at any time by emailing info@supremeconsult.com or using the unsubscribe link in any marketing email. Withdrawal of consent does not affect anything processed before that point.
Who we share your data with
We share personal data only where it is necessary to deliver our services or where we are legally required to do so.
We do not sell personal data. We do not share it for third-party marketing purposes. Any organisation that processes data on our behalf is bound by appropriate data processing agreements and required to protect your information.
HMRC and Companies House
We submit tax returns, payroll information, VAT returns, and statutory accounts to HMRC and Companies House on your behalf. This is a necessary part of the compliance services we provide and is authorised by your engagement with us.
Software providers
We use cloud accounting platforms including Xero and QuickBooks Online, as well as supporting software for email, document storage, and practice management. These providers act as data processors and hold data only as needed to deliver the relevant functionality.
Professional advisers
On occasion we may share relevant information with solicitors, auditors, insurers, or other professional advisers — for example, if you ask us to liaise with your solicitor on a business transaction or if we need to consult our professional indemnity insurer.
Regulatory and legal authorities
We may be required to disclose information to our anti-money laundering supervisory body, professional regulatory authorities, or law enforcement agencies where required by law. We will tell you when we share data in these circumstances unless we are legally prohibited from doing so.
International data transfers
Some of the software providers we use may store or process data on servers outside the United Kingdom, including within the European Economic Area and other countries. Where data is transferred outside the UK, we ensure that appropriate safeguards are in place — such as Standard Contractual Clauses approved by the UK ICO, or transfers to countries covered by UK adequacy regulations. The EEA countries are covered by the UK’s adequacy decisions, meaning they are considered to provide an equivalent level of data protection. If you have questions about specific transfer mechanisms, contact us at info@supremeconsult.com.
How long we keep your data
We keep personal data only for as long as necessary for the purpose it was collected, or as required by law.
Client records
Records relating to client engagements are kept for a minimum of six years after the engagement ends, in line with the Money Laundering Regulations 2017 and HMRC record-keeping requirements. In some cases, particularly for complex tax matters, records may be kept for up to seven years or longer where there is a legitimate reason.
Prospect and enquiry data
If you enquire about our services but do not become a client, we will hold your contact details for up to 24 months from the date of last contact. After that point, your data will be deleted or anonymised unless you have given consent for ongoing marketing communications.
Website analytics
Data collected through website analytics tools is retained in accordance with the default settings of those platforms, typically up to 26 months, after which it is aggregated or deleted. We review these settings periodically and adjust them in line with our retention principles.
Marketing consent records
Where we hold personal data on the basis of your consent to receive marketing, we keep a record of that consent for as long as the consent is active and for two years after it is withdrawn or lapses, to maintain an audit trail of our marketing practices.
Your rights under UK GDPR
UK GDPR gives you a set of statutory rights in relation to your personal data. These rights apply to all personal data we hold about you, subject to certain legal exemptions.
Right to be informed
You have the right to receive clear, transparent information about how we use your personal data. This privacy policy is how we fulfil that obligation, and we will update it whenever our practices change materially.
Right of access
You have the right to request a copy of the personal data we hold about you. This is called a Subject Access Request (SAR). You can make a request by emailing info@supremeconsult.com. We will respond within one calendar month.
Right to rectification
If any personal data we hold about you is inaccurate or incomplete, you have the right to ask us to correct it. Please contact us at info@supremeconsult.com and we will update our records promptly.
Right to erasure
You can ask us to delete personal data we hold about you in certain circumstances. Please note that we may be unable to erase data we are legally required to retain, for example under the Money Laundering Regulations 2017 or HMRC record-keeping rules.
Right to restrict processing
You can ask us to pause processing of your personal data in certain situations — for example, if you contest its accuracy, or if you have objected to processing and we are considering whether our legitimate interests override your rights.
Right to data portability
Where we process your data on the basis of contract or consent, and by automated means, you have the right to receive that data in a structured, commonly used, machine-readable format, or to ask us to transfer it to another provider where technically feasible.
Right to object
You have the right to object to processing carried out on the basis of legitimate interests or for direct marketing purposes. If you object to direct marketing, we will stop immediately. For other legitimate-interests processing, we will assess whether our grounds override your rights.
Rights related to automated decision-making
You have the right not to be subject to decisions made solely by automated processing that have a legal or similarly significant effect on you. Supreme Consulting does not currently use automated decision-making of this kind in the delivery of its services.
How to exercise your rights
To exercise any of these rights, email info@supremeconsult.com with your name, contact details, and a description of your request. We will respond within one calendar month. We may ask you to verify your identity before we act on a request, to protect your data from unauthorised access. There is no charge for most requests unless they are manifestly unfounded or excessive.
How we protect your data
We use a range of technical and organisational measures to protect personal data against accidental loss, unauthorised access, and misuse. Data transmitted to and from our website is encrypted using HTTPS. Access to client records and accounting systems is restricted to authorised staff and protected by secure authentication. Our cloud accounting platforms are reputable providers with their own security programmes, and we review their credentials before use. Staff who handle personal data are made aware of their responsibilities. In the event of a data breach that is likely to affect your rights or freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.
Cookies
Our website uses cookies to make the site function correctly and to understand how visitors use it. Some cookies are essential; others are used for analytics and, where you have consented, marketing. Full details of the cookies we use and how to manage your preferences are set out in our Cookies Policy at supremeconsult.com/cookies-policy/.
Children’s data
Our services are aimed at business owners, company directors, sole traders, and professional advisers. We do not knowingly collect or process personal data relating to anyone under the age of 18. If you believe we have inadvertently received such data, please contact us at info@supremeconsult.com and we will delete it promptly.
Changes to this policy
We may update this policy from time to time to reflect changes in how we operate or in our legal obligations. When we do, we will update the last reviewed date at the top of this page. Where changes are material, we will notify existing clients directly by email.
How to contact us
All data-related queries should be directed to us using the contact details below.
If you have questions about how we handle your personal data, wish to exercise any of your rights, or have a concern about our data practices, please contact us by email. We will acknowledge your message promptly and respond in full within one calendar month.
- Data queries
- info@supremeconsult.com — Response within one calendar month under UK GDPR
- Data controller
- Supreme Consulting Ltd
- Registered address
- The Piggery, Cowley Farm, Cowley Road, Lymington, Hampshire SO41 9JQ
- Companies House
- 05427883
- ICO registration
- [ICO registration number — to be added]
Complaints to the ICO
If you are unhappy with how we have handled your personal data and we have not been able to resolve the matter to your satisfaction, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection supervisory authority. You can contact the ICO at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or online at https://ico.org.uk/make-a-complaint/. We would always prefer to hear from you first so we have the opportunity to address your concern directly.