Last updated: 13 July 2026
This Privacy Notice explains how Wem & Co / Wem & Co Business Services Ltd collects, uses, stores and shares personal information in connection with the accountancy, tax, audit, company secretarial, payroll, business advisory and related professional services we provide.
References in this notice to data protection law mean the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable UK data protection legislation.
1. Who we are
The data controller is Wem & Co / Wem & Co Business Services Ltd.
Company number: 03734892
Registered office: Savoy House, Savoy Circus, London, W3 7DA
If you have any questions about this Privacy Notice or how we use your personal information, please contact our Data Protection Contact:
Email: Mail@wem.biz
Telephone: 0208 740 6000
Postal address: Savoy House, Savoy Circus, London, W3 7DA
2. The personal information we collect
Depending on the services we provide, we may collect and use personal information including:
• contact details, such as name, address, email address and telephone number;
• identification and verification information required for anti-money laundering checks;
• tax, accounting, payroll, pension, company secretarial and financial information;
• employment, payroll and benefits information where relevant to our services;
• information about directors, shareholders, partners, employees, contractors, trustees or beneficiaries;
• correspondence, meeting notes and records of advice provided; and
• website, device and technical information when you use our website or online systems.
We may receive information directly from you, from your business, from HMRC, Companies House, banks, previous advisers, cloud accounting systems, payroll systems, pension providers, professional advisers, publicly available sources, or other third parties where relevant to the services we provide.
3. How we use personal information and lawful basis
We use personal information only where we have a lawful basis to do so. The main purposes and lawful bases are summarised below.
| Purpose | Examples of personal information used | Lawful basis |
| Providing accountancy, tax, audit, payroll, VAT, company secretarial and advisory services | Contact details, tax records, accounting records, payroll records, business and financial information | Performance of contract; legal obligation; legitimate interests |
| Client onboarding, engagement letters and proposals | Contact details, service requirements, pricing, fee arrangements, identity and verification information | Steps prior to contract; performance of contract; legal obligation; legitimate interests |
| Anti-money laundering, client due diligence and regulatory compliance | Identity documents, ownership and control information, source of funds or wealth information where required | Legal obligation; substantial public interest where special category data is involved |
| Communicating with clients and third parties | Contact details, correspondence, records of advice, meeting notes and instructions | Performance of contract; legitimate interests; legal obligation |
| Billing, payment collection and credit control | Contact details, invoice details, bank/payment authorisation details and payment history | Performance of contract; legitimate interests; legal obligation |
| Marketing and client updates | Business contact details, preferences and communications history | Legitimate interests for relevant business updates; consent where required by electronic marketing rules |
| Website operation and security | IP address, device information, cookies and usage data | Legitimate interests; consent where required for non-essential cookies |
| Use of professional software, cloud systems and productivity tools | Data required to operate accounting, tax, document management, payment, engagement and productivity systems | Performance of contract; legal obligation; legitimate interests |
4. Third-party software and processors
We use third-party software providers and professional platforms to deliver our services. These include systems used for engagement letters and proposals, accounting and bookkeeping, tax return preparation, company secretarial filings, document management, document conversion, payments, communications, productivity and security.
The current systems used by the firm may include Ignition, GoProposal, GoCardless, Stripe, Xero, QuickBooks Online, Hubdoc, Sage, Thomson Reuters Digita, Inform Direct and Microsoft Copilot.
Further details are set out in our Third-Party Software and Data Processing Notice. We do not sell personal information to third parties.
5. Use of AI and productivity tools
We may use Microsoft Copilot and other Microsoft 365 productivity tools to assist with drafting, summarising, organising and analysing business documents and communications. These tools are used to support our staff in providing professional services.
We do not use AI tools to make automated decisions about clients, and responsibility for professional judgement remains with the firm.
6. International transfers
Some of the software providers and professional service platforms we use may process or store personal information outside the United Kingdom, including in the European Economic Area and the United States. Where personal information is transferred outside the UK, we take steps designed to ensure that appropriate safeguards are in place. These may include reliance on adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other safeguards permitted under UK data protection law.
7. How long we keep personal information
We retain personal information only for as long as necessary for the purposes for which it was collected, including to comply with legal, regulatory, tax, accounting, anti-money laundering and professional obligations. Our usual retention periods are summarised below.
| Category | Usual retention period | Reason |
| Client accounting, tax and business records | Normally 6 years after the end of the relevant accounting or tax period, unless a longer period is required | Tax, accounting, limitation and professional obligations |
| Anti-money laundering records | Normally 5 years from the end of the client relationship, unless a longer period is required | Money laundering regulations and professional obligations |
| Engagement letters, proposals and terms of business | Normally 6 years after the end of the engagement or client relationship, unless a longer period is required | Contractual, limitation and professional obligations |
| Payroll and employment-related client records | Normally 6 years where retained as part of client service records, unless a shorter or longer statutory period applies | Tax, employment, accounting and professional obligations |
| Prospect and enquiry records | Normally up to 2 years unless the person becomes a client or there is a continuing business reason to retain the information | Business administration and follow-up |
| Marketing preferences and suppression lists | As long as necessary to respect preferences and demonstrate compliance | Marketing compliance and legitimate interests |
| Temporary document conversion files | For the period necessary to complete the conversion or extraction task, then deleted in accordance with supplier settings or firm procedures | Data minimisation |
8. Website, cookies and fonts
Our website may use cookies, analytics, fonts and similar technologies to operate securely, improve performance and understand how visitors use the site. Further details are set out in our Cookie Policy, where applicable.
9. Security
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or disclosure. These measures include access controls, secure cloud services, staff procedures, password controls and other proportionate safeguards.
10. Your rights
Subject to certain legal limitations, you may have rights to access your personal information, ask us to correct it, ask us to erase it, restrict how we use it, object to certain processing, request portability of your information, and withdraw consent where processing is based on consent.
To exercise your rights, please contact our Data Protection Contact using the details in section 1.
11. Complaints
If you are unhappy with how we use your personal information, please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office. Current contact details are available at: https://ico.org.uk
12. Changes to this Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in law, regulation, professional guidance, our services or the systems we use. The updated version will be published on our website with a revised “last updated” date.
