Who we are

This is the privacy statement of Whitelaw Wells. Whitelaw Wells will be a “controller” of the personal information that we collect in relation to the provision of accountancy, taxation and payroll services to our clients, unless otherwise stated in this privacy statement.

This privacy statement explains how we collect and use personal information about you.

What personal information we collect

When we are engaged to provide personal tax services, we will collect personal taxpayer details, including, but not limited to: name, date of birth, address, National Insurance and tax reference numbers, marital status, bank account details, contact details, sources and amounts of income, expenses, investments and other assets. We will also require to see identification details, including copy passport and photographic ID and proof of address.

When a client engages us to provide accountancy services, we may collect the following personal information relating to our client’s employees and their partners:

  • salary details, including: name, date of birth, address, National Insurance number / tax reference, marital status, salary / earnings details, bank account details, contact details (for example, email address), pension deductions and benefits in kind or other deductions;
  • financial information for accounts and audits, including: bank statements, invoices, supplier and customer information, payroll information and company secretarial information (name, date of birth, addresses, details of certain taxable income (for example, dividends) and share registry;
  • VAT information, including: bank statements, invoices (sales and costs) and cash expenses; and
  • identification details, including: copy passport, photographic ID and proof of address and details of all correspondence, which may contain financial information.

When we are engaged to provide payroll services, we will collect employee details, including, but not limited to: name, date of birth, address, National Insurance and tax reference numbers, marital status, bank account details, contact details, pension deductions and benefits in kind or other deductions.

We may ask you for additional personal information during the course of our engagement with clients, which shall be collected, stored and used in accordance with this privacy notice.

Where we collect personal information from

We collect personal information from our clients and H M Revenue & Customs (HMRC), banks, solicitors, investment managers, lenders and other agents. We also collect personal information from Companies House, which is a publicly accessible source.

How we use your personal information

We need to process personal information to perform the services you have engaged us to carry out and to comply with legal obligations and this includes:

  • deliver payroll services by processing salaries for clients, including filing returns with HMRC and distributing employee payslips by email / post;
  • deliver personal tax services by preparing and submitting annual tax returns and advising on tax payments / liabilities by email / post;
  • deliver accounting services by preparing accounts, submitting tax returns and complying with Companies House reporting requirements, as set down under the Companies Act 2006;
  • deliver VAT services by preparing and submitting VAT returns;
  • deliver audit services by reviewing entities’ accounts to reach an audit opinion;
  • deliver company secretarial services by maintaining statutory books and submitting documentation to Companies House in accordance with the Companies Act 2006;
  • meet legal responsibilities, including the requirements of the Anti-Money Laundering Regulations 2007 and regulatory requirements imposed by regulatory bodies such as The Institute of Chartered Accountants of Scotland (ICAS);
  • verify identity where this is required;
  • communication by post, email or telephone;
  • understand needs and how they may be met;
  • maintain records;
  • process financial transactions; and
  • prevent and detect crime, fraud or corruption.

We may also contact our clients in pursuit of our legitimate interests to promote our services by sending clients communications with updates. Where we use our clients’ personal information for this purpose, you have a right to object to such use by writing to us at 9 Ainslie Place, Edinburgh, EH3 6AS or emailing us at

Who we share your personal information with

We may be required to share personal information with statutory or regulatory authorities and organisations to comply with statutory obligations and in relation to the provision of accountancy, taxation and payroll services. Such organisations include, but are not limited to, HMRC, Government and regulatory authorities, such as The Institute of Accountants of Scotland and Companies House.

We also share personal information with our clients, family and associates, financial organisations, such as banks and pension providers, service providers and credit reference and debt collection agencies in relation to the provision of accountancy, taxation and payroll services and for the prevention and detection of crime, fraud or corruption.

The above organisations will likely become “controllers” of your personal information upon receipt and you should refer to their privacy statements if you would like further information on how they process your personal information.

We may also share personal information with our professional and legal advisors for the purposes of taking advice.

In the event that we do share personal information with external third parties, we will only share such personal information strictly required for the specific purposes and take reasonable steps to ensure that recipients shall only process the disclosed personal information in accordance with those purposes.

If you do not provide your personal information

If we not receive all of the personal information that we need then this may affect our ability to provide our clients with the services they have engaged us to carry out.

How long we retain your personal information for

We will only keep your personal information for as long as necessary to comply with our legal obligations and to safeguard Whitelaw Wells in the event of any claims, complaints, litigation, enquiries and investigations during or following the termination of our engagement with clients. We will review and possibly delete your personal information following a period of at least six years after a client has ceased to engage us to provide services.

Please note that you may have a separate legal requirement to retain business and personal records for a longer period than this and Whitelaw Wells accepts no responsibility for the deletion of records prior to any other statutory deadline. Whitelaw Wells also reserves the right to retain electronic and paper correspondence that is required for professional indemnity insurance purposes.

Holding personal information outside the EEA

We may occasionally use services such as Dropbox, who use servers that are located outwith the EEA. We understand these providers have obtained privacy shield certification or other security measures and we believe these are appropriate safeguards to comply with the GDPR requirements.

Using our website

The information we collect via our website ( may include:

  • any personal details you knowingly provide us with through forms and our email, such as name, address, telephone number etc.;
  • your IP address, this is a string of numbers unique to your computer that is recorded by our web server when you request any page or component on our website. This information is used to monitor your usage of our website; and
  • data recorded by our website which allows us to recognise you and your preferred settings, this saves you from re-entering information on return visits to the site. Such data is recorded locally on your computer through the use of cookies. Most browsers can be programmed to reject, or warn you before downloading cookies, information regarding this may be found in your browsers ‘help’ facility.

Any personal information we collect from our website will be used in accordance with the Data Protection Legislation and other applicable laws. The details we collect will be used:

  • to process your order, to provide after sales service (we may pass your details to another organisation to supply/deliver products or services you have purchased and/or to provide after-sales service); and
  • in certain cases we may use your email address to send you information on our other products and services but this will largely be limited to advising you of changes to tax/payroll rates, Budget newsletters, tax cards and other legislative changes.

We may need to pass the information we collect to other companies for administrative purposes. We may use third parties to carry out certain activities, such as processing and sorting data, monitoring how customers use our website and issuing our e-mails for us. Third parties will not be allowed to use your personal information for their own purposes.

Your rights

You can exercise any of the following rights by writing to us at 9 Ainslie Place, Edinburgh, EH3 6AS or emailing us at

Your rights in relation to your personal information are:

  • you have a right to request access to the personal information that we hold about you by making a “subject access request”;
  • if you believe that any of your personal information is inaccurate or incomplete, you have a right to request that we correct or complete your personal information;
  • you have a right to request that we restrict the processing of your personal information for specific purposes; and
  • if you wish us to delete your personal information, you may request that we do so.

Any requests received by Whitelaw Wells will be considered under applicable data protection legislation. If you remain dissatisfied, you have a right to raise a complaint with the Information Commissioner’s Office at

Changes to our privacy statement

We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained by request from the Edinburgh office, 9 Ainslie Place, Edinburgh, EH3 6AS.

This privacy statement was last updated on 13 May 2018.