This Privacy Notice explains what personal data SouthTech Finance Ltd collects about you, why we collect it, what we do with it, how long we keep it, and what your rights are. If you have any questions, contact us at privacy@southtechfinance.co.uk.
SouthTech Finance Ltd is the data controller responsible for your personal data.
| Company name | SouthTech Finance Ltd |
| Company number | 17104352 |
| Registered address | Unit 39b The Hopstore, Old Bexley Business Park, 19 Bourne Road, Bexley, DA5 1LR |
| privacy@southtechfinance.co.uk | |
| Website | www.southtechfinance.co.uk |
| ICO registration | ZC143358 |
Depending on the nature of the services we provide to you, we may collect and process the following categories of personal data:
We are legally required to verify your identity before providing services. This may include:
Where we provide payroll services to a business client, we may process personal data relating to its employees or workers on the client’s behalf. This may include names, addresses, dates of birth, National Insurance numbers, pay and tax information, pension information and statutory payment records. In limited circumstances this may include special category personal data, such as health information relevant to statutory sick pay. Where we process this information on behalf of a client, we act in accordance with the client’s instructions and the applicable data-processing arrangements.
We collect personal data in the following ways:
The table below sets out the purposes for which we process your personal data and the lawful basis under UK GDPR for each.
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing agreed services under our contract | Contractual necessity — Art. 6(1)(b) |
| Verifying your identity (AML) | Legal obligation — Art. 6(1)(c) |
| Complying with anti-money laundering, counter-terrorist financing, sanctions and other legal or regulatory reporting obligations | Legal obligation — Art. 6(1)(c) |
| Retaining records for HMRC compliance | Legal obligation — Art. 6(1)(c) |
| Responding to complaints or disputes | Legitimate interests — Art. 6(1)(f) |
| Responding to enquiries and taking steps requested before a potential engagement | Contractual necessity — Art. 6(1)(b), where the enquiry relates to potential services; otherwise legitimate interests — Art. 6(1)(f) |
| Sending service-related communications | Contractual necessity — Art. 6(1)(b) |
| Improving our services and internal records | Legitimate interests — Art. 6(1)(f) |
We do not use your personal data for marketing purposes without your explicit consent. We do not sell your personal data to third parties.
We share your personal data only where necessary and only with the following categories of recipient:
Your data is processed by third-party data processors that we use to deliver our services. These act as data processors on our behalf and are contractually bound to process data only on our instructions and in accordance with UK GDPR. Appropriate data-processing terms or equivalent contractual arrangements are in place with these providers as required by Article 28 UK GDPR.
| Provider | Purpose |
|---|---|
| FreeAgent, Xero, Sage | Cloud accounting software — bookkeeping records and bank feeds |
| Xenon Connect | Bookkeeping quality control — reads transaction data via connected accounting platforms to flag duplicates and unreconciled items |
| Engager | Practice management — client records and workflow |
| BrightPay | Payroll software (if payroll services are engaged) |
| Xama | Identity verification, sanctions screening and AML risk assessment |
| Microsoft 365 | Email, SharePoint document storage and OneDrive working files |
Some technology providers process personal data under their own data protection responsibilities rather than solely as processors acting on our instructions. These include:
| Provider | Purpose |
|---|---|
| QuickBooks / Intuit | Cloud accounting software — Intuit acts as an independent controller for the standard QuickBooks accounting service used by STF. |
| GoCardless | Direct Debit payment processing — GoCardless acts as an independent data controller and processes data under its own terms and privacy notice. |
| Socket | Proposal creation, pricing presentation and engagement signing — Socket Digital Limited identifies itself as data controller for the Socket application under its privacy policy. |
Where personal data is transferred to an organisation outside the United Kingdom, we ensure that the transfer is covered by UK adequacy regulations, appropriate safeguards or another lawful transfer mechanism under UK GDPR. Please contact us if you require further information about international transfers.
We retain personal data only for as long as necessary for the purposes for which it was collected and in line with our legal and regulatory obligations.
| Category of data | Retention period |
|---|---|
| Client bookkeeping records | 7 years from the end of the relevant tax year |
| AML identity verification records | 5 years from the end of the business relationship |
| Engagement letters and contracts | 7 years from the end of the contract |
| Correspondence and emails | 7 years from the end of the business relationship |
| Unsuccessful enquiries | 12 months from the date of last contact |
On expiry of the relevant retention period, we will securely delete or destroy personal data. If you ask us to delete your personal data, we will consider your request in accordance with UK GDPR. We may continue to retain information where a legal, regulatory or other lawful basis requires or permits us to do so.
As a data subject, you have the following rights. You can exercise any of these rights by contacting us at privacy@southtechfinance.co.uk.
| Right of access | You can request a copy of the personal data we hold about you (a Subject Access Request). We will normally respond within one calendar month, subject to the permitted rules on identity verification, clarification and extensions for complex or numerous requests. |
| Right to rectification | You can ask us to correct inaccurate or incomplete personal data. |
| Right to erasure | You can ask us to delete your personal data where there is no legitimate reason for us to continue holding it. Note that we may be required to retain certain data by law. |
| Right to restriction | You can ask us to restrict processing of your data in certain circumstances — for example, while we investigate a complaint. |
| Right to portability | Where the legal conditions for data portability apply, you can request applicable personal data you have provided to us in a structured, commonly used and machine-readable format. |
| Right to object | You can object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds. |
| Right to withdraw consent | Where we process data based on your consent, you can withdraw that consent at any time. This will not affect the lawfulness of processing before withdrawal. |
| Rights relating to automated decision-making | We do not make solely automated decisions that produce legal or similarly significant effects. Automated systems may support identity verification, AML screening and risk assessment, but client acceptance and other significant decisions are subject to human review. |
We will not charge a fee for handling your request unless it is manifestly unfounded or excessive. We may need to verify your identity before responding.
Our website at www.southtechfinance.co.uk uses cookies and similar technologies. Our separate Website Cookie Policy explains what technologies may be used, why they are used and how you can manage your choices.
This Privacy Notice applies to personal data we collect through the website, including information submitted through enquiry or contact forms, as well as personal data collected in the course of providing professional services.
We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration. These include:
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.
You have the right to complain directly to us if you are unhappy with how we collect, use, store or otherwise process your personal data.
Complaints relating to the processing of personal data should be sent to privacy@southtechfinance.co.uk. You can also contact us by post at our registered address or by telephone. We will accept your complaint however you choose to raise it.
We will acknowledge your complaint within 30 days of receiving it. We will then investigate it without undue delay, take appropriate steps to respond, and keep you informed of progress and the outcome.
This complaints process does not affect your right to complain to the Information Commissioner’s Office (ICO) at any time:
| ICO website | www.ico.org.uk |
| ICO helpline | 0303 123 1113 |
| ICO address | Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. The current version will always be available on our website at www.southtechfinance.co.uk. Where changes are material, we will notify existing clients directly.
This notice was last reviewed on: 24/09/2026