In this policy:
- 1. Purpose of this notice
- 2. About us
- 3. How we collect your personal data
- 4. The kind of information we hold about you
- 5. How we use your personal data
- 6. Situations in which we use your personal data
- 7. Data retention
- 8. Data sharing and third parties
- 9. International transfers
- 10. Use of artificial intelligence (AI) tools
- 11. Data security
- 12. Your personal data and AI tools — retention
- 13. Your rights
- 14. Right to withdraw consent
- 15. Changes to this notice
- 16. Contact us
1. Purpose of this notice
This notice describes how we collect and use personal data about you, in accordance with the Data Protection Legislation. In this notice “Data Protection Legislation” means any applicable law relating to the processing, privacy, and use of personal data, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended), and the Data (Use and Access) Act 2025.
Please read this notice carefully to understand our practices regarding your personal data and how we will treat it.
2. About us
MJG Accounts Limited (trading as “MJ Goldman Chartered Accountants”, “we”, “us”, “our”) is an accountancy and tax advisory firm. We are registered in England and Wales under company number 05669237. Our registered office is at Hollinwood Business Centre, Albert Street, Oldham, OL8 3QL.
We are regulated by the Institute of Chartered Accountants in England and Wales (ICAEW) and are a member firm of ICAEW.
For the purposes of the UK GDPR, we are the data controller in respect of the personal data we hold about our clients and contacts. In certain circumstances where we process personal data strictly on behalf of a client, we may act as a data processor; this will be set out in our engagement terms.
We have appointed Mark Goldman as our Data Protection Point of Contact (Data Protection Compliance Manager). Our Data Protection Point of Contact is responsible for overseeing compliance with this notice and data protection law, and for assisting with enquiries in relation to this notice or our treatment of your personal data. Contact details are at Section 16.
3. How we collect your personal data
We collect personal data about you in the following ways:
- when you request a proposal or quotation from us;
- when you or your employer or our client engages us to provide services, and during the provision of those services;
- when you contact us by email, telephone, post or social media (for example when you have a query about our services);
- from third parties and publicly available resources (such as your employer, Companies House, HMRC or credit reference agencies);
- through the use of AI meeting transcription tools (currently Fireflies.ai) where you participate in a meeting with us — we will always inform you before or at the start of any meeting where this tool is active;
- through our use of AI-assisted drafting and productivity tools (currently Claude and Microsoft Copilot 365) where personal data is incidentally included in documents or correspondence we work on.
4. The kind of information we hold about you
The information we hold about you may include:
- your personal details (name, address, email, date of birth, National Insurance number, tax codes, tax reference numbers, copies of identity documents for anti-money laundering purposes, payroll information);
- details of contact we have had with you in connection with our services;
- details of the services you have received from us;
- our correspondence and communications with you;
- information about any complaints or enquiries you make to us;
- information we receive from other sources, such as your employer, HMRC or Companies House;
- meeting transcripts and summaries generated via our AI transcription tool where you have participated in a meeting with us; information from research, surveys, and marketing activities where you have agreed to participate or receive marketing from us.
5. How we use your personal data
We process your personal data for the following purposes. We have identified the lawful basis for each below.
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Providing accountancy, tax, payroll and corporate services to you or your employer under our engagement | Article 6(1)(b) — performance of a contract, or steps at your request prior to a contract |
| Processing your data as an employee, subcontractor, supplier or customer of our client | Article 6(1)(b) — performance of a contract with our client |
| Complying with legal and regulatory obligations (including anti-money laundering, HMRC reporting, ICAEW regulatory requirements) | Article 6(1)(c) — compliance with a legal obligation |
| Operating our business efficiently, improving our services, and using AI productivity tools | Article 6(1)(f) — legitimate interests in operating an efficient and competitive professional practice, including marketing and business development, balanced against your rights and interests |
| Maintaining accurate records of meetings and agreed actions (including via AI transcription) | Article 6(1)(f) — legitimate interests in accurate record-keeping and service delivery |
| Sending you information about our services where you have consented to receive it | Article 6(1)(a) — your consent (you may withdraw at any time — see Section 14) |
| Notifying you of changes to our services | Article 6(1)(b) — performance of a contract; or Article 6(1)(f) — legitimate interests |
Where we rely on legitimate interests as our lawful basis, we have carried out or will carry out a Legitimate Interests Assessment (LIA) and can provide a copy on request.
We may process your personal data for more than one lawful basis depending on the purpose. If you have questions about the specific basis we rely on, please contact us.
If you refuse to provide certain information when requested, we may be unable to perform our contract with you or comply with our legal and regulatory obligations.
6. Situations in which we use your personal data
We may use your personal data in order to:
- carry out our obligations arising from any agreements between you, your employer or our client and us;
- comply with our anti-money laundering obligations under the Money Laundering Regulations 2017 and related legislation;
- carry out identity verification and client due diligence checks as required by law;
- provide you with information related to our services that you request, or which we believe may be of interest to you (where you have consented);
- notify you of changes to our services;
- use AI-assisted tools to help us draft correspondence, conduct research and manage meeting records — see Section 10 for full details.
In some circumstances we may anonymise or pseudonymise your personal data so that it can no longer be associated with you, in which case we may use it without further notice to you.
We may also process your personal data without your knowledge or consent where we are legally required or permitted to do so.
7. Data retention
We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, and in line with our legal and regulatory obligations.
Our standard retention periods are set out below. These reflect our legal obligations and professional standards.
| Category | Retention period |
|---|---|
| Client files and engagement documentation | 6 years from the end of the client relationship or completion of the relevant matter |
| Tax records and related correspondence | 6 years (consistent with HMRC enquiry window) |
| Anti-money laundering records (CDD/EDD documentation) | 5 years from the end of the business relationship or completion of the occasional transaction |
| Payroll records | 6 years from the end of the relevant tax year |
| General correspondence | 6 years unless a longer period is required for a specific matter |
| Meeting transcripts and AI-generated summaries (Fireflies.ai) | Retained in line with the underlying client matter or internal record, as above. Sub-processors have a zero-day retention policy — audio is not retained by sub-processors after processing. |
| Tolley+ AI (LexisNexis) | AI-assisted research outputs retained in line with the underlying client matter retention periods (see above). Tolley+ AI platform retains prompts for up to 90 days; uploaded documents are purged after 10 minutes of inactivity. LexisNexis does not use customer data to train AI models. |
| Marketing contacts (with consent) | Until consent is withdrawn or 3 years from last contact, whichever is sooner |
When assessing retention periods, we take into account our business requirements, statutory and regulatory obligations, the lawful basis on which we processed the data, and whether the purpose could reasonably be achieved by other means.
Change of purpose
Where we need to use your personal data for a purpose other than the purpose for which we originally collected it, we will only do so where that purpose is compatible with the original one, or where we have notified you and identified a lawful basis for the new purpose.
8. Data sharing and third parties
Why we share your personal data
Our work for you may require us to share your personal data with third-party service providers, regulatory bodies, agents or sub-contractors where we are required by law or where it is necessary to provide the services set out in your engagement letter. We will only disclose the minimum personal data necessary for each purpose.
Third-party service providers
We use third-party service providers for IT and cloud services, professional advisory services, administration services, banking services, AI processing tools (see Section 10), and practice management. Our current AI tool providers are identified in Section 10. All third-party service providers are required to implement appropriate security measures, and we only permit them to process your personal data for specified purposes in accordance with our instructions and under contractual terms that protect your data.
Regulatory and legal disclosures
We may share your personal data with HMRC, Companies House, the National Crime Agency (in the context of anti-money laundering obligations), ICAEW, or other regulators where we are required by law to do so. We may also share data in connection with the possible sale or restructuring of our business.
9. International transfers
Some of our third-party service providers, including our AI tool providers, are based in the United States. This means your personal data may be transferred to and processed in the United States when we use these tools.
The United States does not have an automatic UK adequacy decision for all transfers; however, we ensure that appropriate safeguards are in place for each transfer as set out below.
| Provider | Transfer mechanism | Safeguards |
|---|---|---|
| Anthropic PBC (Claude) | UK IDTA / UK Addendum to EU SCCs | Enterprise DPA (DPA-2024-01); no model training on customer data; AES-256 encryption; SOC 2 Type II |
| Microsoft Corporation (Copilot 365) | UK Addendum to EU SCCs; UK-US Data Bridge | Microsoft Products and Services DPA (May 2026, aka.ms/DPA); EU Data Boundary; ISO 27001; SOC 2 Type II |
| Fireflies AI Corp (Fireflies.ai) | UK International Data Transfer Agreement (IDTA) | Fireflies DPA (March 2026); zero-day sub-processor retention; AES-256 encryption; SOC 2 Type II |
| RELX (UK) Limited — LexisNexis / Tolley+ AI | Standard Contractual Clauses (SCCs) with UK Addendum (incorporated in LexisNexis DPA); RELX US affiliates certified to EU-US DPF. | LexisNexis Data Processing Agreement (lexisnexis.com/global/privacy/processing-terms.page); LLMs deployed privately within RELX infrastructure — Anthropic and OpenAI have no access to your data via this tool; AES-256 encryption; SOC 2 Type II. |
You can request a copy of the relevant transfer mechanism documentation by contacting Mark Goldman at mgoldman@mjgoldman.co.uk.
10. Use of artificial intelligence (AI) tools
We use AI tools to help us deliver our services efficiently and accurately. This section explains which tools we use, what personal data they may process, the legal basis on which we use them, and the safeguards we have in place.
10.1 The AI tools we use
| Tool | Provider | How we use it |
|---|---|---|
| Claude | Anthropic PBC (USA) | Assisting with drafting correspondence, summarising documents, technical research and reviewing documents. Client personal data is used only under our Data Processing Agreement with Anthropic and where a documented lawful basis is in place. |
| Microsoft Copilot 365 | Microsoft Corporation (USA) | Drafting and editing emails and documents, summarising meeting notes, and generating content within our secure Microsoft 365 environment. |
| Fireflies.ai | Fireflies AI Corp (USA) | Recording, transcribing and summarising meetings where you are a participant. We will always inform you before or at the start of any meeting where Fireflies is active. You may ask us to disable it for any meeting. |
| Tolley+ AI (LexisNexis) | RELX (UK) Limited (UK/USA) | AI-powered tax research, legislation lookup, HMRC guidance search and drafting assistance, grounded in the Tolley tax content library. Underlying AI models are deployed privately within RELX’s secure infrastructure. Anthropic and OpenAI have no access to your data via this tool. |
10.2 What personal data AI tools may process
- Claude and Microsoft Copilot 365: your name and contact details; details of your tax affairs, financial position or business matters included in correspondence or documents we work on; any other personal information in documents we draft or review.
- Fireflies.ai: your name and role; your voice and spoken contributions during meetings where Fireflies is active; the full content of the meeting, including any financial matters, personal circumstances or professional advice discussed; your email address for sending meeting notes.
- Tolley+ AI (LexisNexis): your name and matter details may be incidentally included in research prompts; documents you have provided to us that are uploaded for analysis. Tolley+ AI is primarily a tax research tool — personal data input is minimised. Prompts are retained for up to 90 days; uploaded documents are purged after 10 minutes of inactivity.
We instruct our staff not to enter sensitive personal information — such as your National Insurance number, bank account details, or health information — into AI tools without a specific documented lawful basis for doing so. Our AI tools do not make automated decisions that have legal or similarly significant effects on you without human review by a qualified member of our staff.
10.3 AI providers as data processors
Each AI provider acts as our data processor — they process your personal data only on our instructions and are not permitted to use it for their own purposes, including training their AI models. We have Data Processing Agreements in place with each provider.
10.4 AI sub-processors
Our AI providers may use third-party sub-processors. Key sub-processors relevant to your personal data include:
| AI provider | Sub-processor | Role |
|---|---|---|
| Anthropic (Claude) | Amazon Web Services (USA) | Cloud infrastructure |
| Anthropic (Claude) | Google Cloud Platform (USA) | Cloud infrastructure |
| Microsoft (Copilot 365) | Microsoft group companies | M365 and Copilot service delivery |
| Microsoft (Copilot 365) | OpenAI (USA) | Underlying AI model (subject to Microsoft’s DPA controls) |
| Fireflies.ai | Amazon Web Services (USA) | Cloud hosting and database |
| Fireflies.ai | Google Cloud Platform (USA) | Cloud infrastructure |
| Fireflies.ai | ASR / transcription vendors (various) | Speech-to-text processing — zero-day data retention |
| Fireflies.ai | OpenAI (USA) | Meeting summarisation — zero-day data retention; Business Associate Agreement in place |
10.5 Your right to opt out of Fireflies
You may ask us to disable Fireflies for any meeting in which you participate. Please inform your contact at MJG Accounts Ltd before or at the start of the meeting and we will do so.
10.6 Changes to our AI tools
We will update this section when we adopt new AI tools or make material changes to how we use existing ones. The current version of this privacy notice is available at www.mjgoldman.com or on request.
11. Data security
We have put in place commercially reasonable and appropriate security measures to prevent your personal data from being accidentally lost, used, accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and third parties who have a legitimate business need.
We have procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so. In the case of a reportable breach, we are required to notify the ICO within 72 hours of becoming aware of it.
12. Your personal data and AI tools — retention
The retention of data processed through AI tools is as follows:
| Tool | Retention |
|---|---|
| Claude (enterprise) | Not retained by Anthropic for model training. Session data is subject to Anthropic’s enterprise DPA terms. The firm retains AI-assisted outputs in line with the client matter retention periods in Section 7. |
| Microsoft Copilot 365 | Processed within the firm’s Microsoft 365 tenancy and subject to the firm’s own M365 retention settings and Microsoft’s DPA terms. |
| Fireflies.ai | Meeting transcripts and summaries are retained on the Fireflies platform until deleted by the firm, in line with Section 7 retention periods. Sub-processors have a zero-day retention policy — audio is not retained after processing. |
| Tolley+ AI (LexisNexis) | Prompts and conversation history are retained on the Tolley+ AI platform for up to 90 days (AES-256 encrypted). Uploaded documents are purged automatically after 10 minutes of session inactivity. LexisNexis does not use customer data to train its AI models. The firm retains AI-assisted outputs in line with the client matter retention periods in Section 7. |
13. Your rights
Under UK data protection law you have the following rights. To exercise any of these rights, please contact Mark Goldman using the details in Section 16.
- Right to be informed: you have the right to be told how we collect and use your personal data. This notice fulfils that obligation.
- Right of access: you have the right to request a copy of the personal data we hold about you and to check that we are processing it lawfully (a Subject Access Request or SAR).
- Right to rectification: you have the right to ask us to correct inaccurate or incomplete personal data we hold about you.
- Right to erasure: you have the right to ask us to delete your personal data where there is no good reason for us to continue processing it, subject to our legal and regulatory retention obligations.
- Right to restrict processing: you have the right to ask us to suspend processing of your personal data in certain circumstances, for example if you contest its accuracy.
- Right to data portability: where we process your personal data by automated means and on the basis of your consent or a contract with you, you have the right to receive a copy in a structured, commonly used and machine-readable format.
- Right to object: you have the right to object to processing based on legitimate interests. We will stop or restrict processing unless we have compelling legitimate grounds that override your interests or we need to process the data for legal claims.
- Rights related to automated decision-making: we do not make decisions that have legal or similarly significant effects on you based solely on automated processing. All AI-generated outputs that affect you are reviewed by a qualified member of staff before being acted upon.
You will not have to pay a fee to access your personal data or to exercise any of your other rights. However, we may charge a reasonable fee for the administrative costs of complying with your request if it is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances. We may need to verify your identity before we can respond to your request. We will respond within one month of receipt of your request, though we may extend this by a further two months for complex or multiple requests — we will notify you if this is the case.
Complaints-handling procedure
If you have a concern about how we handle your personal data, please raise it with Mark Goldman in the first instance. We will acknowledge your complaint within five working days and aim to resolve it within 30 days. If you are not satisfied with our response, you have the right to complain to the ICO — see Section 16.
14. Right to withdraw consent
Where we process your personal data on the basis of your consent (for example, for direct marketing), you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before you withdrew it.
To withdraw your consent, please email Mark Goldman at mgoldman@mjgoldman.co.uk.
Once we receive your withdrawal, we will stop processing your personal data for the purpose for which you gave consent, unless we have another lawful basis to continue.
15. Changes to this notice
Any changes we make to this privacy notice will be updated on our website at www.mjgoldman.com. We will notify you of any changes that significantly affect how your personal data is processed.
This privacy notice was last updated on 1 October 2026.
16. Contact us
If you have any questions about this notice or about how we process your personal data, please contact our Data Protection Point of Contact:
| Name | Mark Goldman |
| Role | Data Protection Compliance Manager |
| mgoldman@mjgoldman.co.uk | |
| Telephone | 0161 209 6900 |
| Address | Hollinwood Business Centre, Albert Street, Oldham, OL8 3QL |
You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues:
| Address | Information Commissioner’s Office Wycliffe House, Water Lane Wilmslow, Cheshire, SK9 5AF |
| Telephone | 0303 123 1113 |
| Website | ico.org.uk/make-a-complaint/data-protection-complaints/ |