Last updated: 15 October 2026

1. Who we are

Books & Returns is the data controller for the personal data described in this policy.

If you have any questions about this policy or your data, contact us using the details above.

2. What we collect

Through our website forms

  • Contact and consultation forms: your name, email address, company name, the service you're interested in and your message.
  • Sign-up form: your name, email address, phone number, business name and type, company number, preferred start date, whether you have a current accountant, and the package and options you chose.
  • Onboarding form: your UTR, company number, accounting software, VAT number and quarter dates, payroll details (number of staff and pay frequency), your previous accountant's name and email, your year-end date, and any accounts you upload.
  • Manage billing form: your email address.

We record the IP address a form was sent from, to block spam and limit repeated submissions.

Through Stripe, our payment provider

When you pay, Stripe collects your card or bank account details, billing address and payment history. We never see or store your full card or bank account numbers. Stripe shares with us your name, email, billing address, what you paid and whether a payment succeeded or failed.

When you become a client

To provide our services we hold your financial records, tax information and correspondence with HMRC and Companies House. Before we start work, UK anti-money laundering law requires us to verify your identity. We do this through a separate secure process, not through the forms on this website.

3. Why we use your data, and our lawful basis

  • Contract: to reply to enquiries you send us, set up your account, take payment and provide the services you sign up for.
  • Legal obligation: to carry out identity checks and keep records under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, and to meet our tax and accounting record-keeping duties.
  • Legitimate interests: to keep a record of sign-ups that weren't completed so we can follow up, to protect our website from spam and abuse, and to manage and improve our business. We only rely on this where it does not override your rights.

We don't use your data for automated decision-making or profiling, and we don't sell it.

4. How long we keep it

  • Anti-money laundering records (identity checks and supporting documents): 5 years after our business relationship ends, as required by law.
  • Accounting records (including invoices and payment records): 6 years.
  • Enquiries that don't lead to work: up to 2 years from our last contact, then deleted.

5. Who we share it with

We share personal data only with organisations that help us run our business, under contracts that require them to protect it:

  • Stripe, to take and manage payments.
  • Hostinger, who host our website and email.
  • Our email provider, to send and receive email.
  • Accounting software providers such as Xero, QuickBooks, FreeAgent, Sage and BrightPay, where we use them to provide our services to you.
  • Google Fonts, which delivers the typeface used on this website. Your browser connects to Google's servers to load it, which shares your IP address with Google.

We also share information with HMRC, Companies House and other authorities where we are acting for you or where the law requires it, and with your previous accountant when we request professional clearance.

Some of these providers may process data outside the UK. Where they do, they use safeguards recognised under UK law, such as the UK International Data Transfer Agreement or adequacy regulations.

6. Your rights

Under UK GDPR you have the right to:

  • access the personal data we hold about you
  • have inaccurate data corrected
  • have your data deleted, where we no longer have a legal reason to keep it
  • restrict or object to how we use it
  • receive your data in a portable format
  • withdraw consent, where we rely on it

To use any of these rights, email info@booksandreturns.com. We'll reply within one month. Some rights are limited where the law requires us to keep records, for example anti-money laundering records.

7. Complaints

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk/make-a-complaint
  • Phone: 0303 123 1113
  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

8. Cookies

See our Cookie Policy for details of the cookies and similar storage used on this website.

9. Changes to this policy

We'll update this page if the way we use personal data changes. The date at the top shows when it was last updated.