Privacy Notice

Document control

Version	Date	Reviewed by	Summary of changes
1.0 (Draft)	13 October 2026	David Stafford	Initial draft of the public-facing privacy notice, including registered office address and subject access handling.
1.1	13 October 2026	David Stafford	Approved by both principals and published as the firm's live privacy notice.

1. Who we are

DJ Stafford Consulting Ltd, trading as Holme Finance ("we", "us", "the firm"), is a company registered in England and Wales (company number 13326973) with its registered office at Suite 3 Business Centre, Meltham Mills Industrial Estate, Meltham, Holmfirth, England, HD9 4AR. We provide accounting, financial reporting and related advisory services to businesses, including through our online platform at app.holmefinance.co.uk.

We are the data controller for the personal data described in this notice, and are registered with the Information Commissioner's Office (ICO). Where we process personal data purely on a client's instructions and to their specification, we may instead act as a processor for that client; our engagement letter says so where that applies.

2. Personal data we collect

Enquiries and correspondence

If you contact us (for example by email to enquiries@holmefinance.co.uk) we collect your name, email address, telephone number if you give it, and the contents of your message.

Clients and the people connected to them

• Contact details of the individuals we deal with at a client (name, email, telephone, job title).
• Details of company officers, persons with significant control (PSCs) and shareholders — name, date of birth, address and shareholding — collected for client due diligence and for statutory compliance work.
• Identity and verification information gathered under the Money Laundering Regulations 2017, including the results of sanctions and similar checks.
• Tax and filing identifiers for client companies, such as Unique Taxpayer Reference, Government Gateway ID, Companies House authentication code and director personal codes. These are encrypted at rest at field level.
• Financial information about a client's business that we receive through Xero or directly from the client, which may include personal data about the client's own employees, customers or suppliers.
• Where the platform's personal tax feature is used, an owner's Self Assessment position as fetched from the relevant source.

Platform users

For people who hold an account on app.holmefinance.co.uk we hold a username, a password hash, multi-factor authentication details (a TOTP secret and hashed backup codes) and a record of which client entities the account may access.

Website visitors

Our website, holmefinance.co.uk, is an information site. At the time of writing it has no contact form, no user accounts and no advertising or analytics cookies. Our hosting and security providers keep ordinary technical server logs (such as IP address, browser type and the pages requested) for security and reliability. If we introduce analytics or non-essential cookies we will ask for consent first and update this notice.

3. Why we use your data and our lawful basis

Purpose	Lawful basis (UK GDPR)
Responding to enquiries and deciding whether to take on a new client	Legitimate interests (running our business and replying to people who contact us); or steps at your request before entering a contract
Providing accounting, reporting, filing and advisory services under an engagement	Contract
Client due diligence, ongoing monitoring, sanctions screening and reporting suspicious activity	Legal obligation (Money Laundering Regulations 2017, Proceeds of Crime Act 2002, Terrorism Act 2000 and related law)
Supporting clients with their tax and companies-law filings	Legal obligation (and contract, as between us and the client)
Running and securing the platform, sending deadline reminders, keeping contact records accurate	Legitimate interests, balanced against your own interests and reasonable expectations
Meeting our obligations to our professional body (ICAEW), our insurers and our own accounting and tax record-keeping	Legal obligation; legitimate interests
Handling complaints and defending legal claims	Legitimate interests; legal obligation

We do not rely on consent for our core services. We do not carry out solely automated decision-making that has legal or similarly significant effects on anyone, and we do not use your personal data for marketing to third parties. We do not sell personal data.

4. Where the data comes from

Mostly from you or from the client you are connected to. We also obtain data from public registers (principally Companies House), from HMRC, from our clients' Xero accounts, and from verification and sanctions-screening sources used in due diligence.

5. Who we share data with

We share personal data only with the service providers and bodies needed to do our work:

Recipient	Purpose	Data involved
Xero	Accounting data and reports for each client company	Client financial and contact data
DigitalOcean	Hosting for the platform, database and encrypted backups	All platform data held at rest
Microsoft 365 / Microsoft Graph	Email and automated deadline reminders	Recipient names and email addresses; correspondence
Anthropic (Claude API)	Drafting narrative commentary from prepared financial figures, always reviewed by a person before use	Financial figures. By design this is not raw personal data
Companies House and HMRC	Statutory filings and lookups	Officer, PSC and filing data
GoDaddy	Domain name and DNS for our website and platform	No client personal data

These providers act as our processors under written terms. We also disclose personal data where a client has consented; where the law requires it (for example a Suspicious Activity Report to the National Crime Agency, or a lawful request from a regulator or authority); and to our professional advisers, our professional indemnity insurer and ICAEW where reasonably necessary. A legal duty may prevent us from telling you that a report has been made.

6. Transfers outside the UK

Some of our providers (for example Anthropic, Microsoft and DigitalOcean) may process data on infrastructure outside the UK. Where that happens we rely on a UK adequacy regulation or on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as provided in the provider's terms. You can ask us for details using the contact address in section 10.

7. How long we keep your data

We keep personal data only as long as necessary for the purposes above and to meet legal and professional obligations. Our standard periods are:

Record	Retention
Engagement files and working papers	At least 6 years from the end of the relevant accounting period or engagement
Client due diligence and beneficial ownership records	5 years from the end of the business relationship
Suspicious activity reports and the SAR log	5 years from the date of the report
Complaints records	At least 6 years from resolution
Sensitive client profile fields (UTR, Gateway ID, Companies House code, director codes)	For as long as we act for the client, then securely deleted
Personal tax snapshots	At least 6 years from the date fetched
Enquiries that do not become an engagement; general correspondence	Reviewed periodically and not kept by default beyond the purpose they served

Our firm records are reviewed annually and deleted once the period has passed, unless a legal hold applies. Encrypted backups age out on a rolling basis, so a deleted item may remain in a backup copy for a limited time until that copy is overwritten; backups are not used for any other purpose.

8. How we protect your data

• Sensitive client profile fields are encrypted at rest at field level.
• All traffic to the platform uses HTTPS.
• Platform accounts require multi-factor authentication, and access to each client's data is restricted per user and enforced on the server.
• The platform database is backed up nightly in encrypted form.
• Access to firm systems is limited to the people who need it, and our staff and contractors are bound by confidentiality duties.

If a personal data breach is likely to put your rights and freedoms at risk we will notify the ICO within 72 hours of becoming aware of it, and will tell you directly without undue delay if the risk to you is high.

9. Your rights

Under UK data protection law you have the right to:

• be told whether we hold your personal data and to receive a copy (access);
• have inaccurate data corrected;
• have data erased, where we have no continuing legal reason to keep it — for example, we cannot erase due diligence records during the 5-year period the Money Laundering Regulations require;
• restrict or object to processing based on our legitimate interests;
• receive data you gave us in a portable format, where processing is based on contract and carried out by automated means.

We will respond within one calendar month, extendable by up to two further months for a complex request, in which case we will tell you why. We may need to verify your identity first. There is no fee, unless a request is manifestly unfounded or excessive.

When we respond to a request we remove confidential information about other people or other clients, and some exemptions may apply — for example where disclosing data could prejudice the prevention or detection of crime or the assessment or collection of tax. We will tell you if we cannot give you everything you asked for, and why, where the law allows us to.

If we hold your data as a processor on behalf of a client, we may refer your request to that client.

10. Contact us and complaints

For any question about this notice or to exercise a right, contact David Stafford at enquiries@holmefinance.co.uk, or write to us at Suite 3 Business Centre, Meltham Mills Industrial Estate, Meltham, Holmfirth, England, HD9 4AR.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would be grateful for the chance to put things right first, so please contact us in the first instance.

11. Changes to this notice

We review this notice at least annually, and whenever we adopt a new processor or system, add website analytics or cookies, or the law changes. The current version is always the one published at holmefinance.co.uk. Each review is logged in the document control table at the top of this page.

This notice was approved by the principals of DJ Stafford Consulting Ltd, trading as Holme Finance, and last updated 13 October 2026.