Privacy Policy

1. Introduction

1.1 Max&B Management Ltd, trading as Numzo (“we”, “us” or “Numzo”), is committed to protecting and respecting your privacy.

1.2 This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you:

• Visit or use numzo.co.uk.
• Contact or communicate with us.
• Request a consultation or quotation.
• Apply to become a Client.
• Engage us to provide accountancy or related services.
• Interact with us as a director, shareholder, employee, contractor, subcontractor or other person connected with one of our Clients.

1.3 We are generally the data controller in respect of personal data for which we determine the purposes and means of processing.

In limited circumstances, we may process personal data on behalf of a Client as a data processor where the nature of the particular Service requires us to act only on that Client’s documented instructions.

1.4 We process personal data in accordance with applicable UK data protection and privacy legislation, including:

• the UK General Data Protection Regulation;
• the Data Protection Act 2018;
• the Data (Use and Access) Act 2025; and
• the Privacy and Electronic Communications Regulations 2003,

in each case as amended from time to time.

1.5 Our registered office is:

Max&B Management Ltd
124 City Road
London
EC1V 2NX
United Kingdom

1.6 If you have any questions about this Privacy Policy or our use of personal data, please contact us at:

Email: contact@numzo.co.uk

2. Personal Data We May Collect

2.1 The personal data we collect depends on your relationship with us and the Services involved.

We may collect the following categories of information.

Identity and contact information:

• Full name
• Date of birth
• Email address
• Telephone number
• Home address
• Business address
• National Insurance number
• Unique Taxpayer Reference (UTR)
• Company number
• Job title or position within a business

Identity verification and compliance information:

• Passport
• Driving licence
• Proof of address
• Details concerning ownership or control of a business
• Beneficial ownership information
• Information required for anti-money laundering checks
• Information concerning source of funds or source of wealth where required
• Sanctions, politically exposed person or other compliance-screening information
• Information relating to criminal offences or allegations where processing is necessary and legally permitted for regulatory or compliance purposes

Financial and tax information:

• Income and expenditure records
• Bank account information
• Financial statements
• Invoices and receipts
• Bank transactions
• Tax return information
• Tax calculations
• VAT information
• Corporation Tax information
• PAYE and payroll information
• CIS information
• Pension information where relevant to payroll
• Dividends, loans and other financial transactions

Business information:

• Business name
• Trading activities
• Company or partnership details
• Shareholdings
• Directors and officers
• Turnover
• VAT registration details
• PAYE references
• Corporation Tax references
• Companies House information
• Information concerning customers, suppliers and transactions where relevant to the Services

Payroll and employee information:

Where we provide payroll or related Services, we may process information relating to employees, directors or workers, including:

• Name and address
• Date of birth
• National Insurance number
• Salary and pay information
• Tax code
• Pension details
• Bank details
• Statutory payment information
• Leave and absence information where relevant
• Employment start and leaving dates
• Other information necessary to operate payroll and comply with employer reporting obligations

Communications information:

• Emails
• Telephone communications
• WhatsApp messages
• Microsoft Teams communications and meeting information
• Consultation and appointment records
• Correspondence with HMRC, Companies House and other authorities
• Records of instructions, approvals and other communications relating to our Services

Website and technical information:

• IP address
• Browser type
• Device information
• Pages visited
• Referring website
• Date and time of visits
• Cookie and similar technology identifiers
• Information concerning interaction with our website or online advertising where applicable

3. How We Collect Personal Data

3.1 We may collect personal data directly from you when you:

• Complete a contact, enquiry or consultation form on numzo.co.uk.
• Contact us by telephone or email.
• Contact us through WhatsApp.
• Communicate with us through Microsoft Teams.
• Arrange an appointment through Calendly or another scheduling service used by us.
• Purchase or request one of our Services.
• Complete our onboarding, AML or identity-verification procedures.
• Provide accounting records, payroll information, tax documents or other information needed for us to provide Services.
• Communicate with us during an ongoing professional engagement.

3.2 We may also receive personal data from third parties or external sources, including:

• HMRC.
• Companies House.
• Previous accountants, bookkeepers or professional advisers where authorised.
• Banks and financial institutions where you have authorised access.
• Accounting, bookkeeping or payroll software.
• Identity verification, AML and compliance providers.
• Public registers and publicly available sources.
• Directors, employees or representatives of a Client.
• Other persons authorised by you or reasonably involved in the Services.

3.3 Where a Client provides us with personal data relating to another person, including employees, directors, shareholders, contractors or subcontractors, the Client is responsible for ensuring that it is lawful to provide that information to us and, where required, that the relevant individual has been provided with appropriate privacy information.

4. Lawful Bases for Processing

4.1 We process personal data only where we have an appropriate lawful basis.

Depending on the circumstances, we may rely on the following lawful bases.

Performance of a contract

Where processing is necessary to:

• take steps at your request before entering into an engagement;
• provide the Services you have instructed us to perform; or
• administer our contractual relationship with you.

Legal obligation

Where processing is necessary to comply with legal, regulatory or professional obligations, including:

• tax legislation;
• anti-money laundering requirements;
• sanctions requirements;
• accounting and company law;
• record-keeping requirements;
• regulatory or professional obligations; and
• lawful requests or reporting obligations to public authorities.

Legitimate interests

Where processing is necessary for our legitimate business interests and those interests are not overridden by your rights and interests.

This may include:

• managing and operating Numzo;
• maintaining Client relationships;
• protecting our legal and professional position;
• preventing fraud and misuse;
• maintaining information and system security;
• recovering unpaid Fees;
• improving our Services and website;
• maintaining appropriate business records; and
• obtaining professional, legal or insurance advice.

Consent

Where consent is the appropriate lawful basis, including certain marketing activities or the use of non-essential cookies and similar technologies.

Where we rely on consent, you may withdraw that consent at any time.

5. How We Use Personal Data

5.1 We may process personal data for the following purposes:

• Assessing whether we are able to accept you as a Client.
• Carrying out identity, AML, sanctions and other compliance checks.
• Preparing and maintaining Client records.
• Providing bookkeeping and accounting Services.
• Preparing accounts and financial statements.
• Preparing and submitting tax returns.
• Preparing VAT returns.
• Operating payroll.
• Administering CIS.
• Preparing Corporation Tax returns.
• Assisting with Companies House filings and company compliance.
• Communicating with HMRC and other authorities where authorised.
• Managing professional engagements.
• Requesting information, instructions and approvals.
• Processing payments.
• Issuing invoices.
• Recovering unpaid Fees.
• Scheduling consultations and meetings.
• Communicating with you through telephone, email, WhatsApp or Microsoft Teams.
• Managing complaints or disputes.
• Meeting professional indemnity insurance and legal obligations.
• Protecting against fraud, misuse and security risks.
• Maintaining and improving our website and Services.
• Measuring website and advertising performance where legally permitted.
• Sending marketing communications where permitted by law.

6. Payments

6.1 We may use third-party payment processors, including Stripe, to process payments for our Services.

6.2 Payment providers process payment-card and transaction information in accordance with their own legal and regulatory obligations and privacy terms.

6.3 Numzo does not normally receive or store your complete payment-card details where payment is processed directly by a third-party payment provider.

7. WhatsApp, Microsoft Teams and Other Communications

7.1 You may choose to communicate with us using WhatsApp, Microsoft Teams or other agreed communications platforms.

7.2 Where you use a third-party communications platform, the provider of that platform may process information concerning your account, device, communications and use of its service in accordance with its own privacy terms.

7.3 We recommend that highly sensitive identification documents, financial records or other confidential information are provided using the secure method specified by Numzo rather than through general messaging services unless we have specifically requested or agreed that method.

7.4 Communications relevant to your professional engagement may be retained as part of our Client records.

8. Who We May Share Personal Data With

8.1 We may disclose or make personal data available to third parties where reasonably necessary for the purposes described in this Privacy Policy.

These may include:

• HMRC.
• Companies House.
• The National Crime Agency.
• Other government departments, courts or public authorities.
• Professional bodies and AML supervisors where legally or professionally required.
• Accounting, bookkeeping, payroll and tax software providers.
• Cloud storage and document-management providers.
• Payment processors, including Stripe.
• Appointment-booking providers, including Calendly.
• Email and business communications providers.
• Microsoft and Microsoft Teams.
• WhatsApp and its service providers where you choose to communicate with us using WhatsApp.
• Website hosting, security and online-form providers.
• Identity verification and AML screening providers.
• Analytics and advertising service providers where legally permitted and subject to applicable consent requirements.
• Banks and financial institutions where relevant to the Services.
• Our professional indemnity insurers and insurance intermediaries.
• Solicitors, accountants and other professional advisers.
• Debt-recovery providers where reasonably necessary.
• Law-enforcement or regulatory bodies where disclosure is required or permitted by law.

8.2 We do not sell your personal data to third parties.

8.3 We require service providers acting on our behalf to process personal data only for appropriate purposes and to maintain suitable security and confidentiality protections where required by law.

9. International Transfers

9.1 Some of the technology and service providers we use may process or store personal data outside the United Kingdom.

9.2 Where UK data protection law requires additional safeguards for an international transfer, we will use an appropriate lawful mechanism.

Depending on the circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses; or
• another legally permitted transfer mechanism.

9.3 Further information about safeguards applicable to a particular transfer may be requested by contacting us.

10. Anti-Money Laundering and Regulatory Disclosures

10.1 We are subject to anti-money laundering, proceeds-of-crime, sanctions and related regulatory requirements.

10.2 We may process identification, ownership, financial and business information for the purposes of complying with these obligations.

10.3 In some circumstances we may be legally required to disclose information to the National Crime Agency or another competent authority.

10.4 The law may prohibit us from informing you that such a report or disclosure has been made.

10.5 A disclosure made in accordance with our legal or regulatory obligations will not constitute a breach of our confidentiality obligations.

11. Data Retention

11.1 We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to satisfy applicable legal, regulatory, tax, accounting, insurance and professional requirements.

11.2 The appropriate retention period depends on the type of record and the circumstances.

Client engagement and accounting records will normally be retained for an appropriate period following the end of our engagement, which will commonly be at least six years where required for tax, accounting, legal, professional or insurance purposes.

11.3 Records obtained for anti-money laundering and customer due diligence purposes will be retained for the period required by applicable law and may then be deleted unless another lawful reason for continued retention applies.

11.4 Information relating to an enquiry that does not result in an engagement may be retained for a reasonable period for administration, record keeping, fraud prevention and dealing with any subsequent enquiry.

11.5 Where personal data is relevant to a dispute, complaint, investigation, insurance notification or legal claim, it may be retained for longer where reasonably necessary.

11.6 Where personal data is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it.

12. Your Data Protection Rights

12.1 Depending on the circumstances, UK data protection law may give you the following rights:

• Right of access – to request confirmation of whether we process your personal data and obtain a copy of relevant personal data.
• Right to rectification – to ask us to correct inaccurate or incomplete information.
• Right to erasure – to ask us to delete personal data in certain circumstances.
• Right to restriction – to request restriction of processing in certain circumstances.
• Right to data portability – to obtain certain personal data in a structured, commonly used and machine-readable format where the legal requirements apply.
• Right to object – to object to certain processing based on legitimate interests and to object to direct marketing.
• Right to withdraw consent – where processing is based on consent.
• Rights relating to solely automated decision-making – where applicable.

12.2 These rights are not absolute and may be subject to exemptions or restrictions under applicable law.

For example, we may be required to retain information despite an erasure request where the information is needed to comply with a legal or regulatory obligation.

12.3 To exercise a data protection right, please contact:

contact@numzo.co.uk

12.4 We may request information reasonably necessary to confirm your identity or authority before responding to a request.

12.5 We will respond within the timeframe required by applicable data protection law.

13. Automated Decision-Making

13.1 We do not normally make decisions about individuals which produce legal or similarly significant effects solely by automated means.

13.2 We may use technology to assist with identity verification, AML screening, fraud prevention, sanctions screening or other compliance functions, but material decisions concerning acceptance or continuation of a professional engagement remain subject to appropriate review.

14. Marketing Communications

14.1 We may send information about Numzo and our Services where permitted by applicable law.

14.2 Where consent is required for a marketing communication, we will obtain that consent before sending it.

14.3 You may opt out of marketing communications at any time by:

• using an unsubscribe option contained in the communication; or
• contacting us at contact@numzo.co.uk.

14.4 Opting out of marketing does not prevent us from sending communications necessary to administer an existing Client relationship or provide the Services.

14.5 We may retain limited information on a suppression list where necessary to ensure that a marketing opt-out is respected.

15. Website, Cookies and Similar Technologies

15.1 Our website may use cookies and similar technologies, including pixels, tags, scripts and local storage.

15.2 These technologies may be used for purposes including:

• Operating and securing the website.
• Remembering preferences.
• Improving website functionality.
• Understanding how visitors use the website.
• Measuring website performance.
• Measuring the effectiveness of advertising.
• Supporting advertising or remarketing where applicable.

15.3 Strictly necessary technologies may be used where they are required for the operation, security or functionality of the website and where consent is not legally required.

15.4 Where consent is legally required for analytics, advertising, marketing or other non-essential technologies, those technologies will not be activated until the required consent has been obtained.

15.5 Advertising and marketing technologies used for online advertising, behavioural tracking, remarketing or advertising measurement will be used only in accordance with applicable privacy and electronic communications requirements.

15.6 Where we use third-party services such as Google or Meta advertising technologies, those providers may process information collected through their technologies in accordance with their own privacy notices.

15.7 Where a cookie or privacy preference tool is provided on our website, you may use it to accept, reject or manage non-essential technologies.

Where consent has been provided, you may withdraw that consent or change your preferences at any time.

15.8 You may also control cookies through your browser settings, although disabling certain technologies may affect website functionality.

16. Data Security

16.1 We take appropriate technical and organisational measures designed to protect personal data against:

• unauthorised or unlawful access;
• alteration;
• disclosure;
• accidental loss;
• destruction; and
• damage.

16.2 Measures may include, where appropriate:

• access controls;
• password and authentication protections;
• secure cloud-based systems;
• restricted access to Client information;
• appropriate backup arrangements;
• software and system security measures; and
• procedures for responding to security incidents.

16.3 Access to personal data is limited to persons and service providers who require access for legitimate business, professional or regulatory purposes.

16.4 No system of electronic storage or internet transmission can be guaranteed to be completely secure.

Accordingly, while we take reasonable precautions, we cannot guarantee absolute security.

17. Personal Data Breaches

17.1 Where we become aware of a personal data breach, we will investigate the circumstances and take reasonable steps to contain and manage the incident.

17.2 Where required by applicable law, we will notify the Information Commissioner’s Office and affected individuals within the applicable legal timeframe.

17.3 Where a breach involves a service provider acting on our behalf, we may work with that provider and our professional advisers or insurers when managing the incident.

18. Data Protection Complaints

18.1 If you are concerned about how we have collected, used, stored, disclosed or otherwise processed your personal data, please contact us at:

Email: contact@numzo.co.uk

You may use the subject line:

Data Protection Complaint

18.2 We will acknowledge receipt of a data protection complaint within 30 days.

18.3 We will take appropriate steps to investigate the complaint and may ask you for further information where reasonably necessary.

18.4 We will keep you informed where appropriate and communicate the outcome of our investigation without undue delay.

18.5 We may request reasonable evidence of identity or authority before disclosing personal information or dealing with a complaint submitted on behalf of another person.

18.6 If you remain dissatisfied with the way we have handled your personal data, you have the right to complain to the Information Commissioner’s Office.

Further information is available at:

ico.org.uk

18.7 We encourage you to contact us first so that we have an opportunity to investigate and resolve your concerns.

19. Third-Party Websites and Services

19.1 Our website may contain links to websites or services operated by third parties.

19.2 We are not responsible for the privacy practices of independent third-party websites or services.

You should review the privacy information provided by those organisations when using their services.

20. Changes to This Privacy Policy

20.1 We may update this Privacy Policy from time to time to reflect:

• changes in our Services;
• changes in technology or service providers;
• changes in our business practices;
• changes in applicable law or regulation; or
• professional or regulatory requirements.

20.2 The current version will be published on numzo.co.uk.

20.3 Where a change is material and it is appropriate to do so, we may also notify affected Clients by email or another reasonable method.

21. Contact Us

21.1 Questions, requests or complaints concerning personal data may be sent to:

Max&B Management Ltd trading as Numzo
124 City Road
London
EC1V 2NX
United Kingdom

Email: contact@numzo.co.uk

Website: numzo.co.uk