Privacy notice

How we use your information.

This notice explains how Wet Floor Accounting handles personal information when you enquire, become a client, use our accounting services or visit this website. It covers prospective, current and former clients, and people whose information we receive through our work: directors, shareholders, sole traders, partners, employees, subcontractors, payroll contacts and other business contacts.

Who is responsible for your information?

Wet Floor Accounting is a trading name of Creator Accounting Ltd, the data controller for the processing described in this notice. We are a limited company registered in England and Wales under company number 16654432. Our registered office is 13 The Woodlands, Lilleshall, Newport, England, TF10 9EN. You can contact us about privacy at info@wetflooraccounting.co.uk or call 07392 340924.

We have not appointed a designated data protection officer. Privacy enquiries are handled by the business at the contact details above. HMRC supervises Creator Accounting Ltd for anti-money-laundering purposes.

What we collect

[TO CONFIRM: ICO data protection fee registration number or applicable exemption]

• Client and accounting information: identity and contact details, National Insurance numbers, Unique Taxpayer References and other tax identifiers, accounts, transactions, bank and bookkeeping records, payroll information, correspondence and engagement records. Identity checks may include identity documents, proof of address, ownership and beneficial-owner information.
• Enquiry information: your name, business name, email address, phone number, optional website, business characteristics, selected assessment answers and the message about your goals.
• Consented website analytics: random visitor and session identifiers, pages and sections viewed, clicks, scroll milestones, time engaged, video progress, completed form stages, campaign tags, referring website, broad device and software details, language and country.
• Security information: short-lived, one-way hashed network identifiers used to rate-limit abusive requests, together with service and error logs needed to keep the website secure.
• Administrator information: authorised administrators' email addresses, encrypted or one-way protected authentication data, session records and security events.

We do not routinely seek special-category information, such as health information, but may encounter it where relevant to payroll or a client matter. Where processing it is necessary, we identify an appropriate additional legal condition and limit access and use. Criminal-offence information required for lawful checks is subject to the applicable legal conditions.

We do not put form answers, passwords, payment details, keystrokes, mouse recordings or session replay into website analytics. We do not store raw IP addresses in the website analytics database. Hostinger processes network information, including IP addresses, to deliver and protect the site.

Where the information comes from

Information comes from you, your business and authorised representatives, and where relevant from employers, previous accountants, accounting systems, HMRC, Companies House and lawful public records. Technical and analytics information comes from your browser, device, referral link and hosting service when you visit the site. We do not buy personal-data marketing lists through this website.

Why we use it and our lawful bases

Accounting services and legal duties

We use personal information to provide bookkeeping, accounts, tax, payroll and advisory services; administer engagements and payments; communicate with clients; and deal with HMRC and Companies House. Our bases are performance of a contract with the individual, compliance with legal obligations (including tax and anti-money-laundering duties), and legitimate interests in providing and administering services to business clients. Where consent is required for an optional use, we ask separately and explain how to withdraw it.

Responding to enquiries

We use enquiry information to assess your request, contact you, prepare a proposed scope and quote, and keep a record of our response. If you are the prospective contracting individual, we rely on steps you ask us to take before entering a contract. When you contact us for a company or another person, we rely on our legitimate interests in answering genuine business enquiries. Preventing misuse and keeping necessary follow-up records also rely on those legitimate interests. The privacy acknowledgement on the form is not consent to marketing.

Website analytics

We use analytics to understand website journeys, campaign performance and which content leads to enquiries. Non-essential browser storage and analytics start only after you select “Accept analytics”. We rely on your consent and you can withdraw it at any time through Cookie preferences.

Security and administration

We use security and administrator records to protect the site, prevent abuse, investigate faults and control access. We rely on our legitimate interests in operating a secure service and, where relevant, compliance with legal obligations.

What you need to provide

The fields marked as required are needed if you want us to review and answer an enquiry. You do not have to provide them, but without them we cannot deal with the request. The website field is optional. Please do not use the form to send bank details, identity documents, health information or other special-category personal information.

Partially completed assessments

Your answers remain in the page while you complete the assessment and are not sent to the enquiry database until you press “Send my assessment”. If you accepted analytics, the site can record that a numbered step was completed, but not the selected answer or anything typed into the form. Closing or refreshing before submission does not create an enquiry record.

Who receives the information?

Access is limited to authorised Wet Floor Accounting administrators and suppliers that support the website. Hostinger provides hosting, security, MySQL database and media storage in the UK hosting region. Resend delivers enquiry and account-security emails and processes message content and delivery metadata. Cloudflare retains a restricted rollback copy of data from the previous deployment; it is not the active website database. Information may also be disclosed to professional advisers, regulators, courts or law-enforcement bodies where necessary and lawful. We do not sell website visitor or enquiry information.

Practice systems and authorised access

We use Microsoft 365, including Outlook, OneDrive, Word, Excel, PowerPoint and Copilot, for communication, storage and internal work; Xero and QuickBooks for accounting; GoCardless through QuickBooks for payments where applicable; HMRC agent services and Basic PAYE Tools; and Companies House services for filings. GoDaddy provides domain registration and VyrexCode develops and supports the website. Information shared depends on the service you use. TikTok has a separate optional player described below.

Client work is handled internally by authorised team members. We do not currently outsource accounting work. Access to client information is limited to people who need it for their role, including authorised staff and directors. We use password-protected devices, two-factor authentication and access controls for business systems, including OneDrive. Information may be shared with authorities, professional advisers, service providers and recipients you authorise where necessary. We do not sell personal information.

AI-assisted internal work

We use Microsoft Copilot for appropriate internal tasks and may use relevant client information where appropriate to the task and business service settings. Outputs are subject to human review. We do not deliberately enter sensitive client information into other general-purpose AI tools. We do not use AI to make solely automated decisions with legal or similarly significant effects about you.

International processing

Although the active database uses Hostinger’s UK hosting region, supplier support, subprocessors, retained Cloudflare backups and Resend email processing can involve countries outside the UK, including the United States. Any restricted transfer requires an applicable adequacy basis or contractual safeguards, such as a UK International Data Transfer Agreement or UK Addendum, and the assessment required by UK law. Contact us for the relevant supplier and safeguard information.

[TO CONFIRM: supplier data-processing agreements and applicable UK transfer safeguards]

How long we keep it

• Consented analytics events are deleted after 395 days. Session records are removed after 395 days without activity. The browser’s random visitor identifier is refreshed after 395 days.
• Completed enquiry records in the website database are deleted after 730 days. Notification copies must be removed from the business mailbox under the same timetable unless the enquiry becomes an active client matter or records must be retained for a legal claim or obligation.
• Short-lived rate-limit records expire after their security window and are removed by routine cleanup.
• After analytics consent is withdrawn, a one-way hash of the old random visitor identifier blocks late queued requests for 24 hours. It is then removed by routine cleanup; it is not used to track visits.
• Expired website login sessions, challenges and password-reset records are routinely deleted. Used recovery-code records are deleted after 30 days. Authentication audit events are deleted after 395 days. Core administrator records remain while the account is authorised; website content history is retained while needed to manage and explain published changes.

Client retention depends on the record and applicable obligation, rather than a single period for everything. Accounts, tax and payroll records follow the relevant statutory requirements and engagement needs. Former-client files are retained only for continuing legal obligations or justified claims and then securely deleted. We confirm the applicable client schedule during onboarding. Anti-money-laundering identity and supporting records are generally kept for five years after the business relationship ends or an occasional transaction is completed, and then deleted unless another lawful basis permits or requires continued retention.

Routine database cleanup runs approximately every 12 hours while the app is running, including after a restart. Restricted rollback copies are not used for new processing. They must be reviewed for deletion when rollback is no longer needed, and any restoration must reapply retention and deletion requests.

[TO CONFIRM: client-record retention schedule including statutory obligations]

[TO CONFIRM: Hostinger access-log and backup retention periods]

TikTok videos and advertising technology

Video cover images are stored and served by this website. TikTok is not contacted simply because a video card appears. If you choose “Watch video”, you first see a separate consent prompt. Only “Allow TikTok and play” loads TikTok’s embedded player, which may use cookies or similar storage and receive connection, device and interaction information under its own privacy notice. “Not now” leaves it unloaded. You can close the player to stop the embedded connection; this does not remove cookies already set by TikTok, which you can manage in your browser. Consent to the player is not saved across page loads and is separate from website analytics. Selecting “View original on TikTok” takes you directly to TikTok. The site does not install Meta Pixel, TikTok Pixel, Google Ads tags, Google Analytics, Google Tag Manager or session-replay software.

Your rights

Depending on the circumstances, you can ask for access to your personal information, correction, erasure, restriction, portability or object to processing based on legitimate interests. You can withdraw analytics consent at any time without affecting earlier lawful processing. We normally respond to rights requests without undue delay and within one calendar month. We may ask for proportionate information to confirm your identity.

Data protection complaints

Email info@wetflooraccounting.co.uk with “Data protection complaint” in the subject line, or write to our registered office. Explain what happened and the outcome you want. We will acknowledge a data protection complaint within 30 days, investigate it without undue delay, keep you informed where appropriate and tell you the outcome.

If you are unhappy with our response, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/, call 0303 123 1113 or write to the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Automated decisions and children

The website does not make solely automated decisions that produce legal or similarly significant effects. Analytics is used for aggregate reporting, not advertising profiles. This business-to-business website is not directed at children and we do not knowingly seek their information through the assessment.

Changes to this notice

We review this notice when the website, suppliers or legal requirements change. Material new uses of personal information will be explained before they begin.