Privacy policy

Red Roman Financial Services is an independent accountancy practice run by Tom Davison MAAT. For the purposes of data protection law, Red Roman Financial Services is the data controller responsible for the personal information described in this policy.

Red Roman Financial Services operates as a sole trader business based in Chartham, Canterbury. You can contact me at tom@redroman.co.uk or on 07944 022480.

To act as your accountant I need: your name, address, date of birth and contact details; your National Insurance number and Unique Taxpayer Reference; bank and payment details; income, expenditure and other financial records; details of your business, its directors, shareholders or partners; and payroll information about your employees where I run your payroll.

For anti-money-laundering purposes I also collect identity documents such as a passport or driving licence, and proof of address.

If you contact me through this website I collect the name, email address, phone number and message you submit. I use those details only to reply to you.

Where I process payroll, the personal data of your employees is included. In that arrangement you remain the controller of that data and I act as your processor.

To provide the accountancy services you have engaged me for. The lawful basis is performance of a contract.

To meet obligations placed on me by law, including filing with HMRC and Companies House, and the checks required under the Money Laundering Regulations 2017. The lawful basis is legal obligation.

To manage the practice, including raising invoices, keeping records of advice given and defending against claims. The lawful basis is my legitimate interests, which I balance against your rights.

I do not use your information for marketing, and I do not sell it or pass it to anyone for their own marketing purposes.

As an accountant I am supervised for anti-money-laundering purposes by the AAT. Before I can act for you I am required to verify your identity, and I may use an electronic verification service to do so. That check leaves a record on your file but does not affect your credit rating.

If I know or suspect that a transaction involves the proceeds of crime, I am required by law to report it to the National Crime Agency. I may be prohibited from telling you that a report has been made.

I am required to keep anti-money-laundering records for five years after our working relationship ends.

HMRC and Companies House, in order to make the filings you have engaged me to make.

Accounting and payroll software providers, where your records are held. Depending on what you use, that means Xero, Intuit QuickBooks or Sage.

My professional indemnity insurers and professional advisers, where it is necessary in connection with a claim or a professional obligation.

The AAT, where required as part of a practice review or investigation.

No part of your work is subcontracted. Everything is carried out by me personally.

I do not share your information with anyone else unless you ask me to, or unless I am required to by law.

Your records are held in the accounting software named above and in my own systems. Some of those providers process data outside the UK. Where that happens, the transfer is covered by UK adequacy regulations or by standard contractual clauses.

Accounting and tax records are kept for six years from the end of the financial year for limited companies, and five years for sole traders.

Anti-money-laundering records are kept for five years after our working relationship ends, as the regulations require.

Enquiries that do not become engagements are deleted within twelve months.

You can ask me for a copy of the personal data I hold about you, ask me to correct it if it is wrong, ask me to delete it, ask me to restrict how I use it, object to my using it, or ask for it in a portable format.

Some of these rights are limited where I am required by law to keep records, which is often the case with tax and anti-money-laundering data.

To make a request, email me at tom@redroman.co.uk. I will respond within one month.

The site stores small preferences in your browser: which theme you chose, whether you have seen the opening animation, and your answer to the cookie question. These are not shared with anyone and do not identify you.

I use Google Analytics to understand which pages are read and what people find useful. It sets cookies and processes data including your IP address, so it only runs if you accept it. If you decline, no analytics cookies are set and no measurement takes place. You can change your mind at any time using the cookie settings link in the footer.

Google Analytics data is processed by Google, which may transfer it outside the UK under standard contractual clauses. It is never used for advertising or shared for anyone else's marketing.

The site uses Plausible Analytics to count visits and see which pages are read. Plausible does not use cookies, does not collect personal data and does not track you across other websites. No individual visitor can be identified from it.

Anonymous performance measurements are collected by Vercel, which hosts the site, so that slow pages can be found and fixed. These record loading speed only. They use no cookies and cannot identify you.

If you are unhappy with how I have handled your information, please tell me first so I have the chance to put it right.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.

This policy was last updated on 31 August 2026. If it changes materially I will tell existing clients directly.