Home / Privacy policy

Privacy policy

This policy explains how Gundastream handles personal data. It is written for the website and for bookkeeping engagements. It was last updated on 23 October 2026.

1. Who we are

The controller is Gundastream, 22 Beechcroft, Humshaugh, Hexham, NE46 4DN, United Kingdom. Email [email protected]. Telephone +44 7911 045367.

For client bookkeeping records, Gundastream is the controller of the contact details and instructions you give us, and a processor of the personal data inside the ledger where that ledger belongs to you and we maintain it on your instructions. The engagement letter confirms the role if a distinction matters for your own compliance. Where your customers, staff or tenants appear in the books, you are responsible for telling them that a bookkeeper sees those records, unless we have agreed in writing to provide a notice for you.

2. Personal data we collect

From the website enquiry, by email or by phone, we collect the name, business name, email address, telephone number and the message you choose to send, including whatever you volunteer about the state of the books.

If you become a client we also process, as the work requires:

• Names and contact details of the people authorised to instruct us, including your accountant if you authorise them.
• Ledger user accounts and correspondence about the file.
• Bank statements, invoices, receipts, payroll reports and other source documents you provide. These often contain personal data of customers, suppliers, employees, directors, landlords’ tenants and agents.
• The reconciliations, exception lists and working papers we create from those documents.
• Invoices we send you for our own fees, and the payment references.

We do not ask you to send special-category data. Source documents sometimes contain it anyway, for example a medical expense or a document that mentions a religion. When that happens we use the document only to code the transaction, we do not build a separate record of it, and we expect you not to send more than the bookkeeping needs.

We do not knowingly collect information from children. The service is for businesses and landlords.

3. Why we use it, and the lawful basis

We do not use personal data for automated decision-making that produces a legal effect. Coding suggestions inside accounting software are reviewed by a person before they are relied on.

We do not sell personal data. We do not use enquiry details to build advertising audiences. We do not send marketing newsletters. A reply to your enquiry, and service messages about a live engagement, are not marketing.

4. Who we share data with

We share personal data only as the work requires:

• Your accountant or other adviser, when you have told us they may receive the pack or instruct journals.
• The provider of the accounting ledger you subscribe to, because the books are stored there under your subscription.
• Our email and file-transfer providers, who carry the correspondence and the documents you send.
• Our own professional advisers, for example if a complaint becomes a legal claim, under a duty of confidence.
• HMRC, the police, or another authority if the law requires a disclosure. We do not volunteer client records.
• A purchaser of the studio, if the practice were ever transferred, and only of the information needed to continue live engagements. We would tell current clients before that happened.

The website itself is static. Sending the enquiry form does not post the contents to a server we operate. It opens an email on your device addressed to [email protected]. The fonts are loaded from Bunny Fonts and the stylesheet icons and Tailwind runtime are loaded from jsDelivr. Those requests reveal your IP address to those networks in the ordinary way a browser loads a public file. We do not add analytics, advertising pixels, or embedded social feeds.

5. Where data is kept

We work from the United Kingdom. Email providers and ledger providers may store data in the UK, the European Economic Area, or in a country the UK regards as adequate, or under the provider’s standard contractual clauses and the UK addendum. The ledger’s storage location is the one you agreed when you subscribed to it. If you need the books kept in a particular region, say so before the scope is accepted and we will confirm whether the package you use can do that. We do not copy client ledgers onto private laptops as a second, unmanaged archive.

6. How long we keep it

• Enquiries that do not become an engagement: 24 months from the last message, then deleted, unless we need a longer record of a complaint.
• Client correspondence, scopes and our fee invoices: six years after the engagement ends, which is the period in which a contractual claim is commonly still possible.
• Working papers we hold outside your ledger: six years after the end of the financial year they relate to, unless a longer period is required because a year is still open with HMRC and you have asked us to retain them.
• The ledger itself: retained for as long as you keep the subscription. When the engagement ends we remove our user. We do not delete your ledger; it is yours.
• Cookie preference in local storage: until you clear it on that browser, or change the choice.

7. Security

Access to a client file is limited to the people doing the work. We do not ask for online banking passwords or Government Gateway passwords. Documents should be sent by email to [email protected] or uploaded to the ledger, not by ordinary unencrypted messaging apps. No method of transmission is perfectly secure. If you believe a statement you sent has gone to the wrong person, telephone us on +44 7911 045367 so we can limit the use of it.

8. Cookies and local storage

This site does not set analytics cookies and does not set advertising cookies. The consent banner stores a single preference in the browser’s local storage under the key gundastream_consent, containing the status you chose and the time. That is so the banner does not reappear on every page. Local storage is not sent to our server with the page request, because the pages are static and the form does not submit to us.

If you reject non-essential storage, we still try to remember that rejection in the same local storage key, so that the rejection itself sticks. If you would rather we stored nothing, clear site data for this website in your browser after dismissing the banner; the banner will return on the next visit, which is the honest consequence.

Our host may keep short server logs, such as IP address, user agent and the page requested, to operate and secure the site. Those logs are not used to profile you and are not paired with enquiry emails.

9. Your rights

Under UK GDPR you can ask us to:

• confirm whether we process your personal data, and for a copy of it;
• correct inaccurate data;
• erase data where there is no continuing reason to keep it;
• restrict processing in the situations the law describes;
• receive data you provided, in a portable form, where the basis is contract and the processing is automated;
• object to processing based on legitimate interests;
• withdraw consent, where consent was the basis. Withdrawing it does not undo processing that has already happened.

Some of these rights are limited where we have to keep records for tax or to defend a legal claim. If you ask us to delete a source document that is also inside your ledger, we will remove our copy where the retention period has ended, and we will tell you that the copy inside the ledger is under your control.

Write to [email protected]. We may need to confirm you are the person the data is about before we release it. We aim to respond within one month. If a request is complex we will tell you before that month ends if we need longer, up to a further two months, which is the extension the law allows.

You can complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or at ico.org.uk/make-a-complaint. We would like the chance to put something right first, and you are not obliged to give us that chance.

10. Changes

If we change this policy we will update the date at the top and, where a change affects a live engagement in a way that is more than editorial, we will email the address we hold for instructions. The previous practice continues to apply to processing that happened before the change.

11. Contact

Gundastream, 22 Beechcroft, Humshaugh, Hexham, NE46 4DN, United Kingdom. [email protected]. +44 7911 045367.