Privacy policy

Last updated: 26/08/2026

This privacy policy explains how First Light Accountants collects, uses, stores and shares personal information when you visit our website, contact us, enquire about our services or become a client.

Who we are

First Light Accountants is an accountancy practice operated by Robin Cutler. We are the data controller for the personal information described in this policy.

Contact: rob@firstlightaccountants.co.uk

Website: firstlightaccountants.co.uk

Business address: 10 Lumsden Close. Bradwell, Gt. Yarmouth.

ICO registration number: ZC223414

Information we may collect

• identity and contact information, including name, address, telephone number and email address;

• business and employment information;

• financial, accounting and tax information;

• National Insurance numbers, Unique Taxpayer References and other tax identifiers where required;

• identification and verification information required for anti-money laundering and client due diligence checks;

• information you provide through website forms, email, telephone, WhatsApp or other communications;

• technical information about your use of our website, including information collected through cookies or similar technologies where applicable; and

• any other information reasonably required to provide our services or comply with our legal and professional obligations.

How and why we use personal information

We may process personal information to:

• respond to enquiries and provide quotations;

• take steps at your request before entering into a contract and provide accountancy, bookkeeping, tax and related services under our contract with you;

• carry out identity verification, client due diligence and anti-money laundering checks and meet other legal or regulatory obligations;

• communicate with HM Revenue & Customs and other authorities where authorised or required;

• manage our client relationship, records, invoicing and administration;

• establish, exercise or defend legal claims and protect our business against fraud or misuse;

• operate, secure and improve our website and business systems; and

• send marketing communications where permitted by law and in accordance with your preferences.

Our lawful bases

Depending on the purpose, we rely on one or more lawful bases under UK data protection law. These may include: contract (including taking steps before entering a contract); legal obligation; legitimate interests, such as operating and protecting our practice, responding to business enquiries and improving our services where those interests are not overridden by your rights; and consent where the law requires us to obtain it. Where special category or criminal offence data is processed, we will only do so where an additional lawful condition applies.

Where we obtain information

We normally obtain information directly from you. We may also obtain information from authorised representatives, previous accountants or advisers, HMRC and other public authorities, identity and anti-money laundering verification providers, publicly available sources, accounting or bookkeeping systems, and other parties where you have authorised the disclosure or the law permits it.

Who we may share information with

Where necessary and lawful, information may be shared with:

• HMRC and other government, regulatory or law-enforcement bodies;

• the Association of Accounting Technicians (AAT) and other professional or regulatory bodies where required;

• our continuity provider, professional advisers and insurers where appropriate;

• trusted service providers that support our practice, including cloud hosting, email, accounting, bookkeeping, tax, electronic-signature, identity/AML verification, data storage, IT and security providers;

• payroll or other specialist professional providers where a service is provided through a trusted partner; and

• other accountants, advisers or third parties where you instruct us to share information or where disclosure is otherwise lawful.

We do not sell your personal information.

International transfers

Some technology and service providers may process information outside the United Kingdom. Where personal information is transferred internationally, we will take reasonable steps to ensure that an appropriate lawful transfer mechanism and safeguards are in place where required.

How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, tax, anti-money laundering, professional, insurance and record-keeping requirements. Different records may therefore have different retention periods. When information is no longer required, it will be securely deleted or destroyed in accordance with our retention arrangements.

Security

We use appropriate organisational and technical measures designed to protect personal information against accidental loss, unauthorised access, alteration or disclosure. Access is restricted to those who need the information for legitimate business purposes.

Your data protection rights

Depending on the circumstances, you may have rights to ask us for access to your personal information, to correct inaccurate information, to erase information, to restrict or object to certain processing, and to receive certain information in a portable format. Where processing is based on consent, you may withdraw that consent at any time. These rights are subject to legal conditions and exemptions.

To exercise a data protection right, contact us using the details above.

Complaints

If you have concerns about how we use your personal information, please contact us first so that we can try to resolve the matter. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Our website may use cookies and similar technologies. Please see our Cookie Policy below for more information.

Changes to this policy

We may update this privacy policy from time to time. The current version will be published on this website with the date of the latest update.