Privacy Policy

Morgan's Business Solutions Ltd trading as MBS Accountants

Registered Company Number

05517306

Registered Office Address

Conway House, Worcester Street, Gloucester, GL1 3AJ

Contact Email

[email protected]

Contact Phone

0330 460 4600

Data Protection Contact

Ian Morgan, Director

1. Introduction

Morgan's Business Solutions Ltd ("MBS Accountants," "we," "us," or "our") we are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy outlines how we collect, use, store, and protect your data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017).

2. Personal Data We Collect

We may collect and process the following types of personal data:

• Names
• Email addresses
• Financial data (e.g., tax references, VAT numbers)
• Phone numbers
• Dates of birth
• Residential and business addresses
• IP addresses

3. How We Collect Your Data

We collect data through:

• Online forms on our website
• Direct client onboarding
• Third-party services and platforms (e.g., Xero, Dext)

4. Purpose of Data Collection

We collect your data for the following purposes:

• To provide accounting and financial services
• To send newsletters and business updates
• To fulfil legal obligations (e.g., HMRC submissions)
• For marketing purposes (with consent)
• To comply with legal obligations under MLR 2017, including customer due diligence and record-keeping requirements

5. Legal Basis for Processing Data

We process your data under the following legal bases:

• Legal Obligation: When processing is necessary for compliance with legal requirements, including obligations under MLR 2017.
• Contractual Obligation: When processing is necessary for a contract with you.
• Consent: When you have given clear consent for us to process your personal data.
• Legitimate Interest: When processing is necessary for our legitimate business interests.

6. Use of Personal Data for Anti-Money Laundering (AML) Purposes

In accordance with Regulation 41 of MLR 2017:

Personal data obtained for the purposes of preventing money laundering or terrorist financing will not be further processed in a way that is incompatible with those purposes, unless:

• Processing is permitted under another enactment; or
• You have provided consent for the data to be used for other purposes.

We will inform you before establishing a business relationship or carrying out an occasional transaction that:

• Your personal data will be used solely for AML purposes, unless otherwise permitted.
• You have the right to withdraw consent at any time.

7. Data Sharing

We may share your personal data with trusted third parties, including:

• Xero, Syft, Dext, Cashflow Frog, Booke, Karbon, Booke, HMRC, Companies House, Inform Direct, Capium, Activtrak, Signable, Hubdoc, AutoEntry, Jotform, Xama and others

Our website is hosted by Cloudflare, which also protects our website forms from spam (Cloudflare Turnstile). Messages sent through our website forms are delivered to us by email using Resend. Discovery calls are booked through a calendar provided by HighLevel (LeadConnector), and website analytics and advertising measurement are provided by Google and Meta, as described in section 10.

Some data may be accessed outside the UK/EU, including in the Philippines, India, USA, and UAE. In these cases, we ensure adequate safeguards are in place.

8. Data Retention

We retain personal data for at least six years in compliance with HMRC requirements or longer if legally required. Specifically, under MLR 2017, we retain customer due diligence records and transaction data for five years after the end of the business relationship or the completion of an occasional transaction.

9. Your Rights

Under data protection laws, you have the right to:

• Access your personal data
• Request correction of inaccurate data
• Request erasure of your data
• Request restriction of processing
• Object to processing
• Request data portability
• Withdraw consent at any time

Please note that some rights may be restricted under MLR 2017 to prevent activities such as tipping off.

To exercise your rights, contact us at [email protected].

10. Cookies and Tracking Technologies

Our website uses three kinds of cookies and similar technologies:

• Essential – needed for the website to work, to protect our forms from spam (Cloudflare Turnstile) and to remember your cookie choice. These are always on.
• Analytics – Google Analytics, to understand how our website is used and which pages are useful. Only used if you agree.
• Marketing – Google Ads and the Meta Pixel, to measure whether our advertising leads to enquiries and bookings. Only used if you agree.

When you first visit, we ask for your choice. You can accept all, reject everything except essential cookies, or choose categories individually, and you can change your mind at any time using the “Cookie settings” link at the bottom of every page.

We use Google Consent Mode. If you decline analytics or marketing cookies, Google's tags do not set cookies, but may send limited information without cookies that Google uses for aggregated measurement and modelling.

If you book a call through the calendar on our website, the calendar is provided by HighLevel (LeadConnector) and may set cookies needed for the booking to work.

11. Data Security Measures

We protect your personal data through:

• Data encryption
• Secure servers
• Strong password protection

12. Policy Updates

We may update this Privacy Policy from time to time. Existing clients will be notified of significant changes via email.

13. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact:

Ian Morgan

Director

Email: [email protected]

Phone: 0330 460 4600

Last Updated: 30 September 2026