Privacy notice

1. Who we are

Agency Xpert Ltd ("we", "us") is the controller of the personal data described in this notice. We are a private company limited by shares, registered in England and Wales, company number 16615051. Our registered office is 110 Pall Mall, Chorley, England, PR7 2LB.

For anything about your personal data, email support@agencyxpert.co.uk with "Privacy" in the subject line. You can also write to us at our registered office. We have not appointed a data protection officer.

2. The information we collect

Website visitors and people who contact us

• If you use our contact form or email us: your name, email address, phone number and company (if you give them), your message, and any times you suggest for a consultation. The form sends your message to our support mailbox and we may record it in our customer records (CRM) so we can follow it up.
• If someone refers you to us, or we meet at an event, we may record your name, business and contact details. If we do, we'll tell you within a month.
• Our web server logs each request: your IP address, the page requested, the date and time and your browser details. We use these logs to keep the site working and secure.

We don't use analytics or advertising tools, and our pages don't load third-party tracking scripts.

Client account users and invited team members

• Your account: name, work email address, job title and phone number (if you add them), your password (stored only as a one-way hash, never in readable form), when you signed in, failed sign-in attempts and your notification settings.
• If a colleague invites you to their business's account, we get your name and email address from them.
• Your business: its name and trading name, legal structure, company and VAT numbers, sector, stage, number of employees, website, phone, address, goals and challenges.
• What you and we add while we work together: tasks, documents you upload, meeting requests and notes, support tickets and messages, reports, risks, records of the business systems we help you set up, staffing requests, and our own notes about your account.
• Statements you agree to: confirming you are a business customer, the sanctions declaration and your agreement to our Client Services Agreement (with its version), each with the wording, date and time, who agreed, and the IP address and browser details, as a record that you agreed. We keep these with your client account records.
• Security records: the IP address and browser details of each sign-in session, and an activity log of actions in your account (for example sign-ins, changes and file downloads) with the IP address used.
• Notifications we send you in the platform and by email. Account owners always get emails about their plan, free trial and failed payments, whatever their email setting.

If you upload information about other people, such as your own staff or customers, we handle it on your behalf to provide our services. Please make sure you are allowed to share it with us and that those people know.

People whose identity we check for anti-money-laundering

Our financial and tax work (such as cash-flow forecasts, bookkeeping set-up, financial models and tax and VAT guidance) is covered by the Money Laundering Regulations 2017. Before we start that work, and while we work with you, the law requires us to carry out client due diligence on the business and the people who own, control or act for it. For each of those people we may record:

• full name, role in the business, date of birth, nationality and ownership percentage;
• how and when we checked their identity, and copies of the identity evidence provided;
• the results of politically exposed person (PEP) and sanctions checks, which can show that someone holds or held a prominent public role; and
• notes about the checks and our risk assessment of the business.

We get this information from you and from public sources such as the Companies House register and the UK sanctions list. Personal data we collect for these checks will be processed only to prevent money laundering, terrorist financing or proliferation financing, unless another law allows a different use or you agree (Money Laundering Regulations 2017, regulation 41). Only our staff can see identity documents; they are not shown in your client account. The law may require us to report suspicions to the National Crime Agency, and in that case it does not allow us to tell you.

Politically exposed person checks can show a person's political role, and our checks can sometimes reveal information about criminal allegations or convictions. We use this only to meet our anti-money-laundering and sanctions duties, under the Data Protection Act 2018 (section 10 and Schedule 1: preventing unlawful acts and meeting regulatory requirements), and in line with our appropriate policy document.

Contractors on our register

We keep a register of freelancers and contractors and introduce them to our clients. Clients agree terms with and pay contractors directly; we don't pay contractors or charge them anything. If you are on our register, we record:

• your name, email address, phone number, role and skills, day rate, location and availability, and whether you work through a limited company (and any opt-out notice you give us);
• the checks we make before we introduce you: your identity, your right to work in the UK (how and when we checked it, and when a follow-up check is due), your qualifications and your references;
• your agreement to us sharing your details with clients, and when we last introduced you; and
• our notes, and the requests and clients we have proposed you for.

What we share with clients. When we propose you for a client's request, the client sees your name, role, skills, location, availability and proposed rate, and a written introduction statement confirming that we checked your identity, that you have the experience and qualifications the role needs and are willing to do it, the date of our right-to-work check and whether your permission to work is time-limited, any references we took for a role with children or vulnerable adults, and any limited-company opt-out. If the client accepts you, we give them your email address and phone number so you can agree terms directly. We only do this with your agreement. When we propose you, we also give you details of the client's request.

Payments

Card payments are taken by Stripe on its own secure checkout page. We never see or store your full card details. We give Stripe your business name and the email address of the account owner who checks out, so it can set up your payments. Stripe gives us your billing name, email address and billing address, any tax ID you enter, and records of your subscription, payments and invoices. Stripe also uses some of this information for its own purposes, such as preventing fraud, as explained in Stripe's privacy policy.

3. Why we use it, and our lawful bases

We don't rely on your consent to run your account; we need this information to provide our services. Where we rely on legitimate interests, you can object (see section 7).

Do you have to give us this information? We need your name, email address and message to reply to an enquiry. We need your account details to provide our services. Client due diligence is required by law: without it we can't start or continue financial or tax work. Contractors must pass our identity and right-to-work checks before we can introduce them.

4. Who we share it with

• Fasthosts Internet Ltd hosts our website, platform, database and stored files on a server in the UK. Our emails are sent from our own mail server on that UK server.
• Stripe takes card payments for us. Stripe group companies in Ireland and the US process payment information.
• Clients and contractors, as described above when we introduce a contractor.
• Professional advisers, such as our accountants, lawyers and insurers, who must keep it confidential.
• HMRC, the National Crime Agency, the Home Office or other authorities where the law requires us to.

We don't sell personal data.

Transfers outside the UK

We host our website and platform on a server in the UK. Our hosting provider's terms allow it to process data in the UK or the EU, which UK law treats as adequate. Stripe may process payment information in the US. For those transfers Stripe relies on the UK Extension to the EU–US Data Privacy Framework and the UK International Data Transfer Addendum to the EU standard contractual clauses.

5. How long we keep it

We may keep information for longer if the law requires it or we need it for a legal claim.

6. Keeping it secure

All connections to our website and platform are encrypted (HTTPS). Passwords are stored only as one-way hashes, staff access depends on their role, and actions in the platform are logged. No system is completely secure, so if you think your account has been misused, contact us straight away.

7. Your rights

You have the right to:

• ask for a copy of the personal data we hold about you (access);
• ask us to correct information that is wrong or incomplete (rectification);
• ask us to delete your information (erasure);
• ask us to limit how we use your information (restriction);
• object to us using your information where we rely on legitimate interests, and at any time to us using it for marketing (objection);
• ask for information you gave us, which we use under a contract, in a format you can reuse or send to someone else (portability); and
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, email support@agencyxpert.co.uk with "Privacy request" in the subject line. We may ask you to confirm your identity. We reply within one month; if a request is complex we may need up to two more months, and we'll tell you if so. There is normally no charge. Some rights are limited by law: for example, we must keep anti-money-laundering records for 5 years even if you ask us to delete them. Client users can also update their own name, job title and phone number in their account settings.

8. Automated decisions

We don't make decisions that have legal or similarly significant effects on you based solely on automated processing.

9. Cookies

We only use cookies that are strictly necessary: to keep you signed in to your client account, to keep our staff signed in, and briefly while a staff member sets up two-factor sign-in. We don't use analytics or advertising cookies, so there is no cookie banner. See our cookies page for the full list.

10. Complaints

If you're unhappy with how we have handled your personal data, please tell us first: email support@agencyxpert.co.uk with "Complaint" in the subject line. Our complaints procedure explains what happens next.

You can also complain to the Information Commission (known as the ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Changes to this notice

We update this notice when the way we use personal data changes. If we make significant changes, we'll tell clients by email or in their account. The date at the top shows when it was last updated.