Privacy.

Who is responsible for your data

The data controller is Quids Bookkeeping Ltd, company number 17264350. Our registered office is on our terms page.

To ask for your data, ask us to delete it, or ask anything else about this page, email [email protected].

Cookies and measurement

We do not set cookies, so there is no cookie banner. A banner is only needed when a site stores or reads something on your device. Ours does not.

We do count visits. The tools below are set up so that none of them can store anything in your browser. That means none of them can recognise you on a later visit or follow you to another site.

Our lawful basis is legitimate interests: we want to know which pages are useful. It is counting, not a profile of you.

Google Analytics, from Google, counts visits and which pages are used. It runs permanently in Google's consent denied mode, which sends the count with no cookie and no identifier.

Vercel Web Analytics, from Vercel, who host this site, counts page views. It identifies a visit by scrambling details of the request your browser already sends, on Vercel's own servers, and discards that after 24 hours. Nothing is written to your browser.

Cloudflare Web Analytics, from Cloudflare, counts page views and the country they came from. It uses no cookies, stores nothing in your browser and does not fingerprint you.

Our own visit counter, which we run ourselves on Cloudflare, notes what happens while a page is open: how long it was on screen, how far down you scrolled, which links and buttons you clicked, and how far you got through a form (never what you typed into it). Our server works out a visit code from your IP address and browser using a secret that changes every day and is then deleted, so the code cannot be traced back to you or linked to another day, and your IP address is never kept. If your browser sends a Global Privacy Control or Do Not Track signal, it does not run.

We can see how many visits a page had, the site or search that sent them, the country, and the kind of device. We cannot see whether you have been here before.

Our hosting provider also keeps standard server logs, which include IP addresses, for security and to keep the site running. We do not use them to build a picture of who you are. The typeface is served from our own site, not from Google.

If you use the contact form or the quote tool

The contact form asks whether you are joining the waitlist or asking a question, and for your name, phone number, email address, business type, how many subcontractors you pay, whether you are VAT registered and a short message about what you need. All of these are required.

The quote tool on the pricing page asks for your name, email address, phone number and business type, all required, and the details it needs to work out a price: your turnover band, number of subcontractors, whether you are VAT registered, payroll and the state of your books.

We use what you send to reply to you and to work out a fair price. The lawful basis is Article 6(1)(b) of the UK GDPR, taking steps at your request before entering into a contract. Your details reach us as an email, and a copy is kept in our own enquiry records, held for us by Cloudflare, so an enquiry is not lost if an email goes astray. We also get an alert on our phone through Telegram, so we see it sooner. They are not published, and they are not shared or added to any email list unless you tick a box.

Both forms have two separate boxes, unticked when you arrive: one to be emailed when 2027 spaces open, and one for the free monthly CIS deadline reminder. They are explained in the next two sections. They are never required, and leaving them unticked has no effect on us replying to you.

The 2027 waitlist

If you tick the waitlist box on the contact form or the quote tool, we add your email address and name to our 2027 waitlist. To join the waitlist from the contact form you have to tick it, because the waitlist exists so that we can email you.

We use it to email you once, when places for new clients open, and for nothing else. The lawful basis is your consent, Article 6(1)(a), which you give by ticking the box. The list is held by Resend, which also sends the emails. Every email has an unsubscribe link that works in one click. You can also write to the address above and we will remove you. The address stays on the list until you unsubscribe or ask us to delete it, or until we have emailed everyone on it and no longer need it.

The free CIS deadline reminder

You can get our monthly CIS deadline reminder by signing up on the CIS deadline reminders page, which asks for your name and email address, or by ticking the reminder box on the contact form or the quote tool. The reminder list is separate from the waitlist: joining one does not put you on the other.

We use your address to send one email a month, around the 12th, a week or so before the CIS return is due. We use it for nothing else. The lawful basis is your consent, Article 6(1)(a), which you give by ticking the box.

The list is held by Resend, which also sends the emails. If you sign up on the reminders page, a copy of your name and email address is also kept in our own records, held for us by Cloudflare, so a sign-up is not lost if Resend has a problem. Every email has an unsubscribe link at the bottom that works in one click. You can also write to the address above and we will remove you. The address stays on the list until you unsubscribe or ask us to delete it.

If you become a client

To do the bookkeeping we hold the records the work needs: your bank transactions, purchase and sales invoices, receipts, the details of subcontractors you pay and what was deducted from them, your VAT position, and the identity documents we are required to take before acting for you.

The lawful basis is Article 6(1)(b), performing our contract with you, and Article 6(1)(c), our own legal obligations, which is what covers the identity checks and the records we are required to keep. Where those records include personal data about your subcontractors or your staff, you are the controller of it and we process it on your instructions under a written agreement.

Your Xero subscription stays in your name, so the ledger is yours throughout and there is nothing for us to hand back if you leave. If you connect an inbox so supplier invoices can be picked up, we read only that inbox and only for that purpose, and you can disconnect it whenever you like.

Who else touches it

We use other companies to run the service. They act on our instructions and are bound by contract. We do not sell personal data and we do not share it for anyone's marketing.

If you have only used the website

• Resend

  Sends your enquiry to us by email, and holds the reminder list and the waitlist

  Ireland (eu-west-1)

• Vercel

  Hosts the website

  Global network

• Cloudflare

  Manages our domain records, and keeps a copy of your enquiry or reminder sign-up in our own records

  Global network

• Telegram

  Sends us an alert on our phone when an enquiry arrives, with your name, contact details and message

  Global network

• Google Analytics 4

  Detailed reporting on how the site is used, and which pages lead to an enquiry

  May process outside the UK

• Vercel Web Analytics

  Counts page views, including visits that an ad blocker hides from Google Analytics

  May process outside the UK

• Cloudflare Web Analytics

  Counts page views and the country they came from

  May process outside the UK

• Our own visit counter

  Notes how a page is used while it is open, such as time on screen, scrolling, clicks and how far a form got

  May process outside the UK

If you are a client

• Supabase

  The database your records sit in

  London, UK

• Nylas

  Reads the supplier invoices out of the inbox you connect

  EU region

• Xero

  The ledger itself, on your own subscription

  Per Xero's own terms

• Anthropic

  Reads documents to pull the figures off them

  Per Anthropic's own terms

• Stripe and GoCardless

  Take the monthly payment

  Per their own terms

• Sentry

  Tells us when something breaks

  Errors only

We also send returns and information to HMRC for you once you have approved them. Your CIS300 is the exception: we prepare it and you submit it yourself. HMRC is not our processor. It is a public authority handling the data under its own legal powers.

How long we keep things

• An enquiry that does not become work: 12 months, then deleted. That is our own policy, not a legal requirement. Ask and we will remove yours sooner.
• The reminder list and the waitlist: until you unsubscribe. Ask us and we will delete your address from either. Our own copy of a reminder sign-up is kept for as long as you stay on the reminder list.
• Client records and identity checks: 5 years after we stop acting for you. Regulation 40 of the Money Laundering Regulations 2017 sets that minimum, so we cannot shorten it, even if you ask us to delete them.
• Accounting records: 6 years from the end of the accounting period, which is how long HMRC requires records to be kept.

Where your data is held

Email sent from this site, the reminder list and the waitlist are handled by Resend in Ireland. Our copy of your enquiry or reminder sign-up is held by Cloudflare, a company based in the United States, so it may be held outside the UK, and the phone alert passes through Telegram, which may also process it outside the UK. The inbox connection used for client work runs on Nylas's EU region. The counting tools above are run by, or hosted with, companies based in the United States, so the count of your visit may be processed there. Where a provider processes data outside the UK, the transfer is covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. To find out where a particular record sits, ask us.

Your rights

Under the UK GDPR you can ask for a copy of the personal data we hold about you. You can ask us to correct it, delete it, or restrict what we do with it. You can ask for it in a portable format, and you can object to us processing it. Where we rely on your consent, you can withdraw it at any time.

Email [email protected] and we will answer within one month. There is no charge. We cannot delete records we are legally required to keep. If that applies, we will tell you which records and why.

If you are unhappy with how we have handled it

Tell us first and we will try to put it right. If you are still not happy, you can complain to the Information Commissioner's Office, the UK regulator for data protection. They are at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, on 0303 123 1113, and at ico.org.uk. Complaining to them does not cost anything.

Changes to this notice

If we change how we handle personal data, we will update this page. If you are a client and the change is a significant one, we will tell you directly.