Privacy Policy

1. Introduction

Cornell Bond (“we”, “us”, “our”) is a UK-based accounting firm. We are committed to protecting the privacy and security of your personal data.

This Privacy Policy explains how we collect, use, store and share personal information when you:

visit our website at www.cornellbond.co.uk
contact us by email, phone, post or via online forms
become or act on behalf of a client, supplier or business contact.

Please read this Privacy Policy together with any other privacy or fair processing notices we may provide on specific occasions.

2. Who we are and contact details

Cornell Bond is the data controller for the purposes of UK data protection law.

Registered name: Cornell Bond
Registered address: [insert full postal address]
Email: enquiries@cornellbond.co.uk
Phone: [insert]

If you have any questions about this Privacy Policy or how we handle your personal data, contact us using the details above.

3. What data we collect

We may collect and process the following categories of personal data:

Identity data: name, title, date of birth, client IDs.
Contact data: address, email, phone number.
Business and financial data: business name, tax references (e.g. UTR, VAT number), payroll information, bank details (where needed to perform services), transaction history, invoices and payment records.
Communication data: emails, letters, messages, meeting notes.
Technical and usage data: IP address, browser type and version, time zone setting, device information, pages visited and how you use our website (via cookies and similar technologies).
Marketing and preferences data: your preferences in receiving marketing from us and your communication preferences.

We do not intentionally collect special category data (e.g. health data) via our website. If such data is needed for our professional services, we will explain the additional safeguards separately.

4. How we collect your data

We collect data in several ways:

Directly from you: when you fill in forms on our website, contact us by email/phone, or provide information during onboarding or in the course of our services.
From third parties: for example, from HMRC, your employers, banks, or other professional advisers where necessary for our services and authorised by you.
Automatically: via cookies and similar technologies when you visit our website (see “Cookies” below).

5. Purposes and lawful bases for processing

We process your personal data only when we have a lawful basis under UK GDPR. Typical purposes and bases for an accounting firm include:

Providing accounting and advisory services
- Purpose: to perform our contract with you or take steps at your request before entering into a contract.
- Lawful basis: performance of a contract.
Managing our relationship with you
- Purpose: updating records, sending service information, handling queries and complaints.
- Lawful basis: performance of a contract; legitimate interests (to manage our business and client relationships).

Complying with legal and regulatory obligations
- Purpose: meeting obligations under tax law, anti-money laundering regulations, professional standards, and responding to requests from authorities.
- Lawful basis: compliance with a legal obligation.

Business administration
- Purpose: internal record-keeping, accounting, audit, quality checks, and business planning.
- Lawful basis: legitimate interests (efficient and lawful operation of our business).

Marketing and communications
- Purpose: sending relevant updates or information about our services.
- Lawful basis: legitimate interests (promoting our services), or consent where required under the Privacy and Electronic Communications Regulations (PECR). You can opt out at any time.

If we rely on consent, you may withdraw it at any time by contacting us.

6. Sharing your data

We may share your personal data with:

HMRC and other regulators or authorities, where required by law.
Professional advisers such as lawyers, insurers, banks, or other accountants, where necessary.
IT and cloud service providers (e.g. secure email, document storage, practice management or accounting software) under appropriate data processing agreements.
Our professional bodies (e.g. [insert ICAEW/ACCA or other], if applicable) in connection with regulatory oversight or complaints.

We require all third parties to respect the security of your data and to treat it in accordance with the law. We do not sell your personal data to third parties.

7. International transfers

If we store or process personal data using cloud or IT service providers located outside the UK, we will ensure that appropriate safeguards are in place, such as:

an adequacy decision covering the destination country; or
standard contractual clauses or equivalent approved mechanisms.

You can contact us for details of specific safeguards applicable to your data.

8. Data retention

We keep your personal data only for as long as necessary for the purposes we collected it, including to satisfy legal, regulatory, tax, accounting or reporting requirements.

Typical retention periods include:

Client records and working papers: generally up to 6 years after the end of the engagement or the relevant tax year, or longer where required by law or professional rules.
Prospective client enquiries: generally up to 2 years from last contact.
Website usage data: generally up to 2 years, unless aggregated or anonymised for longer-term analytics.

When data is no longer required, we will securely delete or anonymise it.

9. Your rights

Under UK data protection law, you have rights in relation to your personal data, including:

Right of access: to obtain a copy of your personal data and information about how we process it.
Right to rectification: to have inaccurate or incomplete data corrected.
Right to erasure: to ask us to delete your data in certain circumstances.
Right to restrict processing: to limit how we use your data in certain circumstances.
Right to data portability: to receive your data in a structured, commonly used format and transfer it to another controller where legally applicable.
Right to object: to certain processing, particularly where we rely on legitimate interests or for direct marketing.
Rights in relation to automated decision-making and profiling: we do not typically carry out automated decision-making that has legal or similarly significant effects on you.

To exercise any of these rights, contact us using the details in section 2. We may need to verify your identity before responding.

10. Cookies and website tracking

Our website may use cookies and similar technologies to:

make the site work (essential cookies)
improve performance and security
analyse how visitors use our site (analytics cookies).

Where required by law, we will seek your consent before setting non-essential cookies. You can change your cookie preferences via your browser settings and, where available, via our cookie banner/settings tool.

For more information, please refer to our Cookie Policy.

11. Security

We take appropriate technical and organisational measures to protect your personal data, including:

access controls and authentication on our systems
encryption and secure transfer methods where appropriate
regular backups and system monitoring
staff training on data protection and confidentiality.

However, no method of transmission or storage is completely secure; you should take your own precautions when sending information to us electronically.

12. Complaints

If you have any concerns about how we handle your data, contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

Website: www.ico.org.uk
Phone: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

13. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website and will show the effective date. Continued use of our website or services after changes are made indicates that you have read and understood the updated policy.

Privacy Policy

1. Introduction

Cornell Bond (“we”, “us”, “our”) is a UK-based accounting firm. We are committed to protecting the privacy and security of your personal data.

This Privacy Policy explains how we collect, use, store and share personal information when you:

visit our website at www.cornellbond.co.uk

contact us by email, phone, post or via online forms

become or act on behalf of a client, supplier or business contact.

Please read this Privacy Policy together with any other privacy or fair processing notices we may provide on specific occasions.

​

2. Who we are and contact details

Cornell Bond is the data controller for the purposes of UK data protection law.

Registered name: Cornell Bond

Registered address: [insert full postal address]

Email: enquiries@cornellbond.co.uk

Phone: [insert]

If you have any questions about this Privacy Policy or how we handle your personal data, contact us using the details above.

​

3. What data we collect

​

We may collect and process the following categories of personal data:

Identity data: name, title, date of birth, client IDs.

Contact data: address, email, phone number.

Business and financial data: business name, tax references (e.g. UTR, VAT number), payroll information, bank details (where needed to perform services), transaction history, invoices and payment records.

Communication data: emails, letters, messages, meeting notes.

Technical and usage data: IP address, browser type and version, time zone setting, device information, pages visited and how you use our website (via cookies and similar technologies).

Marketing and preferences data: your preferences in receiving marketing from us and your communication preferences.

We do not intentionally collect special category data (e.g. health data) via our website. If such data is needed for our professional services, we will explain the additional safeguards separately.

​

4. How we collect your data

​

We collect data in several ways:

Directly from you: when you fill in forms on our website, contact us by email/phone, or provide information during onboarding or in the course of our services.

From third parties: for example, from HMRC, your employers, banks, or other professional advisers where necessary for our services and authorised by you.

Automatically: via cookies and similar technologies when you visit our website (see “Cookies” below).

​​

5. Purposes and lawful bases for processing

​

We process your personal data only when we have a lawful basis under UK GDPR. Typical purposes and bases for an accounting firm include:

Providing accounting and advisory services

Purpose: to perform our contract with you or take steps at your request before entering into a contract.

Lawful basis: performance of a contract.

Managing our relationship with you

Purpose: updating records, sending service information, handling queries and complaints.

Lawful basis: performance of a contract; legitimate interests (to manage our business and client relationships).

​​

Complying with legal and regulatory obligations

Purpose: meeting obligations under tax law, anti-money laundering regulations, professional standards, and responding to requests from authorities.

Lawful basis: compliance with a legal obligation.

​​

Business administration

Purpose: internal record-keeping, accounting, audit, quality checks, and business planning.

Lawful basis: legitimate interests (efficient and lawful operation of our business).

​​

Marketing and communications

Purpose: sending relevant updates or information about our services.

Lawful basis: legitimate interests (promoting our services), or consent where required under the Privacy and Electronic Communications Regulations (PECR). You can opt out at any time.

If we rely on consent, you may withdraw it at any time by contacting us.

​

6. Sharing your data

We may share your personal data with:

HMRC and other regulators or authorities, where required by law.

Professional advisers such as lawyers, insurers, banks, or other accountants, where necessary.

IT and cloud service providers (e.g. secure email, document storage, practice management or accounting software) under appropriate data processing agreements.

Our professional bodies (e.g. [insert ICAEW/ACCA or other], if applicable) in connection with regulatory oversight or complaints.

We require all third parties to respect the security of your data and to treat it in accordance with the law. We do not sell your personal data to third parties.

​

7. International transfers

If we store or process personal data using cloud or IT service providers located outside the UK, we will ensure that appropriate safeguards are in place, such as:

an adequacy decision covering the destination country; or

standard contractual clauses or equivalent approved mechanisms.

You can contact us for details of specific safeguards applicable to your data.

​

8. Data retention

We keep your personal data only for as long as necessary for the purposes we collected it, including to satisfy legal, regulatory, tax, accounting or reporting requirements.

​

Typical retention periods include:

Client records and working papers: generally up to 6 years after the end of the engagement or the relevant tax year, or longer where required by law or professional rules.

Prospective client enquiries: generally up to 2 years from last contact.

Website usage data: generally up to 2 years, unless aggregated or anonymised for longer-term analytics.

​​