Privacy Policy

1. Who we are

Accountaire (SMC-Private) Limited ("Accountaire", "we", "us", "our") is a company registered in Pakistan with Registration No. 0210374. Our registered office is 5 Davis Road, G-8, Shimla Tower, Lahore, Pakistan. Background on the firm and how it operates is on our about Accountaire page.

For the purposes of UK GDPR, EU GDPR and equivalent data-protection laws, we are the data controller in respect of personal data we collect about prospective clients, website visitors and individuals we engage with for marketing or administrative purposes. Where we process personal data on behalf of clients in the course of providing accounting services, we act as a data processor. See our Data Processing Agreement.

2. Scope of this policy

This Privacy Policy describes how we handle personal data when you:

• Visit accountaire.com or any subdomain or affiliated website.
• Contact us by email, phone, WhatsApp, web form or social media.
• Book a discovery call or other meeting with us.
• Sign an Engagement Letter, which incorporates our standard engagement terms, as an individual, director, partner or authorised representative of a client.
• Receive our newsletter or other marketing communications.
• Interact with us as a supplier, contractor or job applicant.

3. Personal data we collect

The categories of personal data we collect depend on how you interact with us.

3.1 Information you provide

• Contact details: name, email address, phone number, job title, company name.
• Business information: entity name, registration number, sector, size, location, financial-service requirements.
• Identification & verification, for client onboarding under anti-money-laundering rules: passport or national ID number, proof of address, source-of-funds information, beneficial-ownership disclosures.
• Correspondence: content of emails, WhatsApp messages, call notes, meeting records and other communications.
• Payment information: bank account or card details for fee collection (processed by our payment processors; we do not store full card numbers).

3.2 Information collected automatically

• Website usage: IP address, browser type, device information, pages visited, time on site, referring URL.
• Cookie data: see section 11.

3.3 Information from third parties

• Public registries (Companies House, SECP) for entity verification.
• LinkedIn or professional networks where you have engaged with our content.
• Referrals: where another client introduces you to us, basic contact information.

4. How we use your data

4. How we use your data

Purpose	Categories
Respond to enquiries & deliver discovery calls	Contact details, correspondence
Prepare engagement proposals	Business information, contact details
Client onboarding & KYC/AML compliance	Identification, verification, beneficial-ownership data
Engagement administration & billing	Contact details, payment information
Marketing & newsletters (with consent)	Contact details, correspondence preferences
Website analytics & product improvement	Website usage, cookie data
Recruitment	Application materials, references
Legal compliance & defence of legal claims	As required by applicable law

5. Lawful bases for processing

We rely on the following lawful bases under Article 6 UK GDPR:

• Contract: to perform our engagement with you or take steps before entering an engagement.
• Legal obligation: for anti-money-laundering checks, tax-record retention and other statutory requirements.
• Legitimate interests: for direct B2B marketing to prospective clients (you may opt out at any time), website analytics, fraud prevention and defence of legal claims.
• Consent: for newsletters and marketing communications to individuals where consent is required.

6. Who we share data with

We share personal data only with:

• Service providers we engage to deliver our services: cloud accounting platforms (Xero, QuickBooks Online), document capture (Dext), practice management (Karbon), payment processors (Wise, Stripe), communication tools (Slack, Zoom, Loom, email providers), CRM and analytics tools. All are bound by data-processing agreements.
• Tax authorities and regulators where required to file returns, respond to enquiries or comply with anti-money-laundering obligations (HMRC, IRS, FTA, CRA, ATO and others as applicable).
• Professional advisors: our own lawyers, auditors and insurers, under confidentiality.
• Successors in connection with a merger, acquisition or sale of our business.
• Law enforcement where required by law or to defend legal rights.

We do not sell personal data to third parties. We do not share personal data with advertisers.

7. International transfers

We operate from Pakistan and serve clients in the UK, EU, US, UAE, Canada, Australia and other jurisdictions. Personal data may therefore be transferred internationally in the course of delivering services.

Where personal data is transferred from the UK or EEA to countries that do not have an adequacy decision, we rely on appropriate safeguards under Article 46 UK GDPR, typically Standard Contractual Clauses incorporating the UK International Data Transfer Addendum where applicable.

Cloud platforms we use (Xero, QuickBooks Online, Dext, etc.) store client data in regional data centres consistent with the applicable adequacy regime. Where you require data residency in a specific jurisdiction, we configure tooling accordingly during onboarding.

8. Data retention

We retain personal data for the periods required by law and reasonable for the purpose:

• Active engagement: for the duration of the engagement.
• Tax and accounting records: six years from the end of the relevant tax year (UK), seven years (US), as required in other jurisdictions.
• KYC/AML records: five years from the end of the engagement (UK MLR 2017).
• Marketing data: until you withdraw consent or opt out.
• Job applications: twelve months from application (with consent for talent pool retention beyond).

9. Data security

We protect personal data through a combination of organisational and technical measures:

• SOC 2 Type II certified cloud platforms for all client-data storage.
• Multi-factor authentication enforced on every tool, every team member.
• Role-based access: staff access only the data needed for their role.
• Encrypted data transmission (TLS 1.2+) and encrypted storage.
• Regular security training for all team members.
• Cyber liability insurance covering data incidents.
• Incident response procedures with notification to affected clients and regulators where applicable.

10. Your rights

Under UK GDPR (and equivalent regimes in other jurisdictions) you have rights to:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion where the lawful basis no longer applies (subject to retention obligations under section 8).
• Restriction: request that we limit processing in certain circumstances.
• Portability: receive data in a structured, commonly-used format.
• Object: to processing based on legitimate interests, including direct marketing.
• Withdraw consent: where processing relies on consent.

To exercise any of these rights, contact [email protected]. We respond to verified requests within one calendar month.

11. Cookies & analytics

Our website uses minimal cookies. Strictly necessary cookies support site functionality. Analytics cookies (where deployed) measure aggregate site usage to improve content. We do not use advertising or cross-site tracking cookies.

Where cookies are not strictly necessary, we obtain consent before deployment. You can manage cookie preferences in your browser settings.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified to active clients by email; minor revisions are published on this page with the updated effective date.

13. Complaints

If you have concerns about how we handle personal data, please contact us first at [email protected]. You also have the right to complain to a supervisory authority, for UK data subjects, the Information Commissioner's Office. For EU data subjects, your local supervisory authority. For other jurisdictions, the relevant data-protection regulator.

Questions about this privacy policy

Questions about this document should be directed to the addresses below, or raised through our contact page:

Accountaire (SMC-Private) Limited
Reg. 0210374
Email: [email protected]
General enquiries: [email protected]