Privacy Policy

Last updated: 19 August 2026

Who we are

Digivolve Accountants is the trading name of MPH & Associates Limited, a company registered in England and Wales (company number 07478324). Our registered office is Delta House, 16 Bridge Road, Haywards Heath, West Sussex RH16 1UA.

We are registered with the Information Commissioner’s Office as a data controller under reference ZA470637.

Matthew Hunt is licensed and regulated by the Association of Accounting Technicians (AAT) under licence number 1003334, and is our representative for data protection purposes.

Any question about this notice, or about how we handle your information, can go to privacy@digivolve.co.uk, or to Matthew Hunt at matthew@digivolve.co.uk, or in writing to the address above.

Our role

For most of what we do — maintaining our client records, meeting our own legal and regulatory obligations, and exercising professional judgement in the advice we give — we act as a data controller.

For services carried out strictly on a client’s instructions, such as running their payroll, we act as a data processor on that client’s behalf. Where that is the case the client is the controller, our engagement terms with them govern the processing, and their own privacy notice explains how the information is used.

Whose information we hold

• Clients — sole traders, company directors, partners, and their nominated contacts.
• Employees and workers of our payroll clients — held in order to run payroll for their employer.
• Prospective clients who contact us or ask for a quote.
• Visitors to this website.

What we hold, and why

Clients and prospective clients. Name, contact details, date of birth, National Insurance number, Unique Taxpayer Reference, identification documents, financial and accounting records, tax information, bank details, and our correspondence with you.

We use it to provide the services we’ve been engaged for, to meet our legal duties, and to communicate with you about your affairs. Our lawful bases are the performance of our contract with you, compliance with legal obligations (including the Money Laundering Regulations 2017, the Companies Act 2006 and tax legislation), and our legitimate interests in running the practice.

Employees and workers of payroll clients. Name, address, date of birth, National Insurance number, salary and payment details, bank details, tax code, pension contributions, and absence records.

Where absence records include information about health, that is special category data. We process it because it is necessary for carrying out obligations in the field of employment law — statutory sick pay, for example — under Article 9(2)(b) of the UK GDPR and Schedule 1 of the Data Protection Act 2018.

Identity verification. To meet our obligations under the Money Laundering Regulations we verify client identity, including by electronic checks. An electronic identity check leaves a soft footprint on your file that does not affect your credit rating.

Website visitors. Technical information such as IP address and browser type, and anything you send us through the website. See “Cookies and this website” below.

How you reach us

We collect information through our website, by email, by telephone, by post, in person, and through our client portal. Some clients also send us information by WhatsApp, which we accept where a client chooses to use it. WhatsApp messages are encrypted in transit by WhatsApp itself. If you would rather not use it, any of the other routes above is fine, and we would suggest email or the portal for anything sensitive.

Who we share information with

• HMRC and Companies House, for the filings and returns we make on your behalf.
• Pension providers and other third parties, where required to operate your payroll.
• Our software providers, who process information on our behalf under contract. The main ones are Microsoft (Microsoft 365, including SharePoint and OneDrive), Dropbox, Xero, Bright Software Group (BrightManager), Moneysoft, Missive, Inform Direct and Dext.
• AAT, our professional body and anti-money-laundering supervisor, where we are required to give them access — for example during a compliance monitoring visit.
• The National Crime Agency. Under the Proceeds of Crime Act 2002 we have a duty to report if we know or suspect that a person is involved in money laundering. We are prohibited by law from telling you if we make such a report, and failing to report would itself be a criminal offence.
• Professional advisers, such as our insurers or solicitors, where necessary.
• A prospective buyer, if we were ever to sell or merge the practice.

We do not sell your information, and we do not share it for anyone else’s marketing.

Where your information is held

Our team works in the UK. Some of our software providers are based outside the UK and may store or process information outside the UK. Where that happens we do so in accordance with UK data protection law, and — for information we process on a client’s instructions — in accordance with our engagement terms with that client.

Most information is held electronically in access-controlled systems. Where we hold paper, it is kept at our office and is generally destroyed once scanned.

How long we keep it

• Client and accounting records — six years plus the current year. That is six years after the last entry in a record, with review and destruction carried out in the following year.
• Anti-money-laundering records — five years after we cease to act, as required by the Money Laundering Regulations 2017, and no more than ten years where a statutory obligation or legal proceedings require us to keep them longer.
• Payroll records — in line with HMRC requirements and our client’s instructions.
• Enquiries that don’t become engagements — retained with our ordinary email records rather than under a separate schedule.

We keep information longer where we are required to, or where we may need it to establish or defend a legal claim.

How we protect it

• Information is held in access-controlled business systems rather than on personal devices.
• Access is limited to the members of our team who need it for their work, through individual named accounts.
• Multi-factor authentication is enabled on the systems that support it.
• Company computers are encrypted, lock automatically, and receive security updates.
• Our systems are backed up, with recovery of deleted files available.

No system is completely secure, and we cannot guarantee the security of information while it is in transit to us. We impose contractual obligations on our suppliers to protect information they handle on our behalf.

If something goes wrong

If we become aware of a personal data breach we will assess it promptly. Where it is likely to result in a risk to people’s rights and freedoms we will report it to the Information Commissioner’s Office within 72 hours, and where the risk is high we will tell the people affected. Where the information belongs to a client, we will tell that client without undue delay and in writing.

Your rights

You have the right to be informed about how we use your information, to ask for a copy of what we hold, to have inaccurate information corrected, and in some circumstances to have information erased, to restrict or object to how we use it, or to have it transferred to someone else. Where we rely on consent you can withdraw it at any time. You can also object to direct marketing at any time.

Some of these rights are limited where the law requires us to keep information — we cannot erase records we are obliged to retain.

To exercise any of these rights, email privacy@digivolve.co.uk. We will respond within one month. If your request is complex or you have made several, we may extend that by up to two further months, and we will tell you within the first month if we need to.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Cookies and this website

This site sets cookies that are necessary for it to work, and uses Google Analytics to understand how visitors use it. Our Cookie Policy lists each cookie, what it does and how long it lasts.

You can change your choices at any time using the cookie settings on this site, or block and delete cookies through your browser settings — though some parts of the site may not work as well if you do.

Changes to this notice

We may update this notice to reflect changes in our services or in the law. The date at the top shows when it was last revised.