Privacy Policy

Nuvo – Privacy Policy

This privacy notice explains how Nuvo (“We”, “us” or “Our”) collects and uses personal data, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR) and any other applicable laws, regulations and secondary legislation, as amended or updated from time to time, in the UK (‘Data Protection Legislation’).

This privacy notice applies to all personal data we collect or process about you. Personal data is identifiable data, or a combination of pieces of data, that could reasonably allow you to be identified.

This notice is effective from 01/08/2026 and replaces any previous versions. We may update this notice from time to time to reflect changes in law or our practices, so please review it periodically.

  1. ABOUT US

Reference to Nuvo includes different legal entities. This privacy policy is issued on behalf of the Nuvo Group of companies so when we mention we, us or our in this privacy policy we are referring to all group companies that are owned by Nuvo Accountancy Limited or Nuvo Audit Limited and such group company will be the relevant company or companies responsible for processing your data in accordance with this policy.

Nuvo Accountancy Limited is an Accountancy firm regulated by the Association of Chartered Certified Accountants, registration number 1182899. We are registered in England & Wales as a limited company, under company number 05061184 and our registered office is at First Floor, Sterling House, Outrams Wharf, Little Eaton, Derby, United Kingdom, DE21 5EL.

Nuvo Audit Limited is registered in England and Wales under company number 14466804. The registered office address is First Floor, Sterling House, Outrams Wharf, Little Eaton, Derby, United Kingdom, DE21 5EL. The company is registered to carry on audit work in the UK by the Association of Chartered Certified Accountants. Details about our audit registration can be viewed at www.auditregister.org.uk, under registration number 5726608.

Nuvo Payroll Limited, registered in England and Wales under company number 15874107, the registered office address is First Floor, Sterling House, Outrams Wharf, Little Eaton, Derby, United Kingdom, DE21 5EL.

Our Professional Indemnity Insurance is provided by Aqueous Underwriting.

 

  1. DATA CONTROLLERSHIP

For the purpose of the Data Protection Legislation and this notice, we are the ‘data controller’. This means that we are responsible for deciding how we hold and process personal data about you.

Depending on the services provided, different Nuvo group entities may act as separate data controllers or as joint controllers in relation to your personal data. We will let you know which entity will be the controller for your data when you instruct us to provide services for you.

  1. HOW WE COLLECT YOUR PERSONAL DATA

Where we need to collect personal data by law or under the terms of our engagement with you (as set out in our engagement letter and terms of business), and you fail to provide that data when requested, we may be unable to perform the services set out in the engagement letter.

We obtain personal data about you either directly from you or from other third parties, for example, when:

  • You request a proposal or a discovery call from us in respect of the services we provide,
  • You OR your employer OR our clients engage us to provide our services,
  • We conduct services that relate to the provided data above,
  • You contact us by email, telephone, post or social media,
  • From third parties and/or publicly available resources (for example, from your employer or from Companies House),
  • Through your use of our guest Wi-Fi service,
  • By virtue of our access to CCTV footage at our offices,
  • We receive personal data about you from various third parties such as your employees, contractors, subcontractors or agents,
  • As you interact with our website, we may automatically collect technical data. We collect this data by using cookies. Please see our Cookies Policy at Cookie Policy  Nuvo Accountancy
  • Through the use of artificial intelligence (AI) to record meetings and telephone calls for the purposes of creating transcripts.
  • Tax code changes or other HMRC related information is provided to us.

We use your browser’s local storage solely to remember your region selection. This information is stored on your device and is not transmitted to our servers.

You can control or delete local storage data at any time via your browser settings. We do not use local storage or cookies for advertising or tracking purposes.

Where required by law, we recognise and honour browser‑based privacy signals that indicate a user’s preference not to share or track their data.

  1. THE DATA WE COLLECT AND PROCESS ABOUT YOU

The information we hold about you includes, but is not limited to, the following:

  • Your personal details (such as your name and/or address),
  • Contact details, such as your email address, billing address, delivery address and phone numbers,
  • Information available from Companies House,
  • Anti-Money Laundering information including bank account details and other financial transactions,
  • Information in relation to your conduct as an officer of a company or other legal entity,
  • Financial information relating to your tax obligations, such as your Personal Tax reference number or your National Insurance Number and your bank account and payment card details.
  • Transaction Data, including details about payments to and from us and details of other products and services you have purchased from us.
  • Marketing and communications data- your marketing and communications preferences,
  • Data relating to any complaints or enquiries you have made to Nuvo Accountancy,
  • Comments and other interactions on our social media platforms,
  • Technical data including IP address, log in data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access  our website. (You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, some parts of this website may become inaccessible or not function properly).
  • Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.
  • Usage Data includes information about how you interact with and use our website, products and services.

 

  1. LAWFUL BASIS FOR PROCESSING

In order to process your personal data, we are required to do so under a lawful basis as defined within the UK GDPR. Your data can be processed under one or more lawful basis. Nuvo Accountancy processes your personal data under the following:

Contract – Where you and Nuvo have entered into a contract for the provision of our services, we will process your personal data in order to fulfil our contractual obligations.

Legal obligation – As tax and financial accountants, we have legal obligations to provide your personal data to organisations such as HMRC as requested or to undertake anti-money laundering checks in accordance with the relevant money laundering legislation from time to time.

Consent – We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to marketing communications.  Where you are an existing client, we may send you marketing communications about our services without obtaining separate consent, where permitted by the Privacy and Electronic Communications Regulations (PECR). In such cases, we rely on our legitimate interests to inform you about services which are similar or related to those you have previously received or expressed an interest in.

You can opt out of marketing communications at any time by using the unsubscribe link in our emails or by contacting us directly.

Legitimate Interests – We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure client experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

 

  1. HOW WE USE YOUR PERSONAL DATA

We adhere to the principles relating to the processing of personal data set out in the UK GDPR, which require personal data to be:

  • Processed lawfully, fairly and in a transparent manner;
  • Collected only for a specified, explicit and a legitimate purpose;
  • Adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed;
  • Accurate and where necessary, kept up to date;
  • Not kept in a form which permits identification of data subjects for longer than is necessary for the purposes for which the data is processed;
  • Processed in a manner that ensures its security using appropriate technical and organisational measures to protect against unauthorised or unlawful processing and against accidental loss, destruction or damage;
  • Not transferred to another country without appropriate safeguards being in place; and
  • Made available to you and allow you to exercise certain rights in relation to your personal data. Please see section 13 for more details.

We may use your personal data in order to:

  • Register you as a new client,
  • To manage our relationship with you,
  • Assist in the preparation of accounts relating to your tenure as a company director,
  • Prepare and deliver Director’s reports and or statements relating to your company/companies,
  • To make and/or receive payments in relation to our services,
  • To review and or assist in payroll activities / reviews of your business(es),
  • Communicate deadlines and data requests relating to your tax returns,
  • Communicate any changes in the legislation / obligations relating to your tax affairs,
  • To complete your tax returns,
  • Notify you of any changes to our services,
  • Provide you with notification of any events to which you have consented to receive communications for,
  • Provide data to third parties for which we have a legal obligation to report to,
  • To seek your feedback and opinion in relation to the services we provide,
  • To make suggestions and recommendations to you about services that may be of interest to you. You can opt out of marketing communications at any time,
  • We may use electronic identity verification, including biometric technologies, to verify client identity and comply with anti‑money laundering and legal obligations. This may involve processing facial images and identification data, including special category personal data. Such data is processed securely, may be shared with authorised third‑party providers, and is retained only as required to meet regulatory and legal requirements.

 

  1. DATA RETENTION

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, tax, accounting or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Typical retention periods include:

  • Client accounting, tax and financial records – up to 6 years after the end of the relevant accounting period
  • Anti‑Money Laundering and identity verification records – 5 years after the end of the business relationship
  • Payroll records – in accordance with HMRC requirements (usually between 3-6 years)
  • Marketing records – until you withdraw consent or object to marketing
  • Complaints records – up to 6 years after resolution

We may retain data longer where required to establish, exercise or defend legal claims.

In some circumstances, we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Where data is no longer required, it will be securely deleted or anonymised.

  1. CHANGE OF PURPOSE

Where we need to use your personal data for another reason, other than for the purpose for which we collected it, we will only use your personal data where that reason is compatible with the original purpose.

Should it be necessary to use your personal data for a new purpose, we will notify you and communicate the legal basis which allows us to do so before starting any new processing. Your regulatory rights remain unaffacted including the right tobject to any further processing that is incompatible with the original purpose.

  1. DATA SHARING

Why might you share my personal data with third parties?

We will share your personal data with third parties where we are required by law, where it is necessary to deliver our services to you, to run our business, to meet a legal or regulatory obligation. or where we have another legitimate interest in doing so to provide the services to you. These include: practice management/accounting/tax/payroll software providers; cloud hosting, document management and IT support providers; telephony/communications/CRM providers; AI-assisted third-party tools (cross-referenced to section 11); AML and identity verification providers; professional advisers and consultants; regulatory and statutory bodies.

Nuvo may, from time to time, undertake to engage with additional resource and/or engage with other service providers to ensure the provision of the services to its clients are maintained. This may involve third parties outside the UK and the EEA.

All of our third-party service providers (Data Processors) are required to take appropriate security and data protection measures to ensure compliance with data protection legislation and the accurate processing and safety of your personal data. We only permit our third-party service providers to process your personal data for specified purposes and in accordance with our instructions.

We carry out due diligence on every third-party service provider before engaging them… Each is bound by a written contract (a Data Processing Agreement, where required under Article 28 UK GDPR).  We maintain a record of our third-party service providers, including where they are AI tools, and this record is reviewed regularly.

 

We may share your personal data with other third parties, for example in the context of the possible sale or restructuring of the business. We may also need to share your personal data with a regulator or to otherwise comply with the law.

These third parties may include professional advisers, consultants who provide services to us, payroll and accounting software providers, cloud hosting providers, IT support providers, and regulatory bodies where required by law.

  1. TRANSFERRING PERSONAL DATA OUTSIDE THE EUROPEAN ECONOMIC AREA (EEA)

The data we directly collect from you will be predominantly processed in the UK. We may, from time to time, process your personal data outside the UK (and, where relevant, the EEA).

Where we have transferred data to countries that have been deemed to provide an adequate level of protection by the UK government, we rely on those adequacy regulations.

Where such adequacy regulations do not apply, we ensure the appropriate safeguards are in place to protect your data in accordance with UK GDPR. This includes the use of the UK IDTA (International Data Transfer Agreement) or other legally approved transfer mechanisms, will be implemented as necessary to provide the required levels of security.

  1. THE USE OF AI

Nuvo may use AI technologies, including AI-assisted third-party tools, in limited ways to support the delivery of our services, internal efficiency and service development. This may include tools used for note taking, transcription, recording or summarising client meetings and telephone calls, productivity assistance, and the preparation of client insight dashboards or similar reporting outputs.

Where we use AI-assisted tools in connection with meetings or calls, the content of those meetings or calls may be recorded, transcribed, analysed or summarised by a third-party service provider acting on our behalf. This may include personal data contained in the discussion, such as names, contact details, business information, financial information, tax or accounting information, and any other information provided during the meeting or call. Where required, we will provide appropriate notice or obtain any necessary consent before recording a meeting or call.

Where we use AI-assisted tools to generate dashboards, insights or service-related reports, those tools may process client business, accounting or financial data for the purpose of producing those outputs. We will only permit third-party AI service providers to process personal data for specified purposes, in accordance with our instructions, and subject to appropriate contractual, confidentiality, security and data protection safeguards, including data processing terms required under Article 28 UK GDPR where applicable.

Before deploying AI-assisted tools that involve new, large-scale, systematic or potentially high-risk processing of personal data, we will assess the data protection risks and, where required, complete a Data Protection Impact Assessment or equivalent risk assessment. We will also consider whether any international transfer safeguards are required under section 10 of this notice.

Any use of AI is carried out in line with applicable laws and regulatory requirements and is subject to appropriate controls, human oversight, internal policies and procedures. Where personal data is involved, it is handled in accordance with our commitments to privacy, fairness, transparency  data protection legislation.

We do not use AI systems to make solely automated decisions that have legal or similarly significant effects on individuals.12. IS MY DATA SECURE?

We have put in place commercially appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way and to prevent it from being altered or disclosed accidentally.

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have reason and need to process your personal data to provide the applicable services. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

  1. YOUR RIGHTS

It is important that the personal data we hold about you is accurate and current. Should your personal information change, please notify us of any changes of which we need to be made aware by contacting us. Please see section 15: CONTACT US in order to submit your request.

Your rights in connection with personal data

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 you have the following rights in relation to your personal data:

  • Information: Request information on how we process your personal data. This privacy notice provides the transparency required in relation to this right, however further information can be requested if needed.
  • Access: Request access to your personal data. This enables you to receive details of the personal data we hold about you and to check that we are processing it lawfully. You will not normally have to pay a fee to access your personal data however we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated
  • Rectification: Request correction of the personal data that we hold about you. We may need to verify the accuracy of the new data you provide to us.
  • Erasure: Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below).
  • Objection: You have the right to object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party), and there is something about your particular situation which makes you want to object.

Direct marketing: You have the absolute right to object at any time to the processing of your personal data for direct marketing purposes, including profiling related to such marketing. You can exercise this right at any time by:- clicking the unsubscribe link included in all marketing emails we send; or

– contacting us using the details set out in section 15: CONTACT US.

 

Once you exercise your right to object, we will stop sending you marketing communications.

  • Restriction: Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Portability: Request the transfer of your personal data to you or another data controller if the processing is based on consent, carried out by automated means and this is technically feasible.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights).

If you wish to exercise any of the rights set out above, contact us using the details set out in section 15: CONTACT US

 

  1. RIGHT TO WITHDRAW CONSENT

In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal data for a specific purpose (for example, in relation to direct marketing that you have indicated you would like to receive from us), you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please email our data protection point of contact, as detailed in section 15: CONTACT US.

Once we have received notification that you have withdrawn your consent, we will no longer process your personal information (personal data) for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

  1. CONTACT US

We have appointed a Data Protection Point of Contact to oversee compliance with data protection obligations.

If you have any questions about this privacy notice or how we process your personal data, please contact:

Email: [email protected]

  1. COMPLAINTS PROCEDURE

If you have a concern or complaint about how we handle your personal data, you have the right to raise it with us. Complaints should be submitted to our Data Protection Point of Contact using the contact details set out in this notice. We will acknowledge receipt of your complaint within 5 working days and aim to provide a full written response within 30 calendar days. If a complaint is complex or requires further investigation, we will keep you informed of progress and any revised response timescales. Raising a complaint with us does not affect your right to lodge a complaint with the Information Commissioner’s Office (ICO).

 

  1. CONTACTING THE ICO

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, at any time. The ICO’s contact details are as follows:

Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Telephone – 0303 123 1113 (local rate) or 01625 545 745 Website – https://ico.org.uk/concerns

 

  1. THIRD-PARTY LINKS

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.