How we handle personal data

Kiaraj is a trading name of Kiara World Ltd, registered in England and Wales under company number 07689392, with its registered office at 118a Junction Road, Bolton, England, BL3 4NQ. Data protection enquiries: info@kiaraj.co.uk.

As controller — for the contact details you give us through this website and for our own business records. We decide why and how that data is used.

As processor — for the client records we receive to prepare VAT working papers. The instructing accountancy practice is the controller. We act on written instructions under a data-processing agreement completed before any records are transferred.

Only what you enter in the partner pricing form: your firm name, your contact name, a work email, an optional phone number, your answers to a small number of scoping questions, and any notes you add. The form does not accept file uploads, and we ask you not to attach records to a first email.

Our lawful basis is legitimate interests — responding to a business enquiry you initiated and keeping a record of our dealings with your organisation. If we ever want to send you something you did not ask for, we will ask for consent first. We do not currently operate a marketing mailing list.

Records supplied for a VAT preparation engagement are used only to carry out that engagement. They are held in engagement-specific folders with access restricted to the people working on that engagement, and the finished pack is returned through a secure channel.

AI tools are used to help extract, structure and reconcile records. We use business accounts rather than consumer AI services. The specific providers, and the commercial terms governing whether data may be retained or used to train their models, are being finalised and will be named in the data-processing agreement before any records are transferred.

Every engagement teaches us something about how records behave — how a particular retailer presents VAT, how a marketplace reports fees, which exceptions recur. We retain that generalised knowledge in our own process: rules, mappings, checks and templates.

We do not retain your clients' records as a corpus for that purpose, and we do not reuse one engagement's records on another. Records are used only for the engagement they were supplied for and are held only for the agreed retention period.

Our storage provider, its location, and the full sub-processor list are being finalised as part of launch. We will name them, and the mechanism covering any transfer outside the UK, in the data-processing agreement. We will not transfer client records to a sub-processor that is not named in that document.

Enquiry data is kept only as long as needed to deal with the enquiry and our ongoing relationship. Retention and deletion periods for client records are governed by professional record-keeping requirements and will be set out in the engagement documents. You can ask us to delete data at any time and we will do so unless we are legally required to keep it.

You can ask for a copy of your data, ask us to correct or delete it, object to our processing, or ask us to restrict it. Write to info@kiaraj.co.uk and we will respond within one month. Where we are a processor rather than the controller, we will pass your request to the organisation that instructed us and tell you we have done so.

If you are unhappy with how we have handled your personal data, you have the right to complain to us. Email info@kiaraj.co.uk with “Data protection complaint” in the subject line, or write to us at 118a Junction Road, Bolton, England, BL3 4NQ. Tell us what happened and what you would like us to do about it.

We will acknowledge your complaint within 30 days of receiving it. We will then investigate and respond without undue delay, keeping you informed of progress. We aim to give you an outcome within three months; if a complaint is unusually complex and we need longer, we will tell you why and when you can expect a response.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk. You can do that at any time — raising a complaint with us first does not affect that right, and you do not have to come to us first.

This website sets no analytics, advertising or tracking cookies unless you choose to accept them on the banner shown on your first visit. Fonts are served with the page rather than from a third party.

Google Analytics 4. We use it to see which pages practices find useful and where enquiries come from. It runs in Google's Consent Mode with analytics and advertising storage set to “denied” until you accept, so no analytics cookie is set before then. Nothing you type into an enquiry form is ever sent to analytics.

LinkedIn Insight Tag. If you accept, a LinkedIn tag also loads. It lets us measure whether LinkedIn brings practices to this site and sets LinkedIn cookies. It does not load at all if you decline.

Your choice. We store it in one first-party cookie, kiaraj_consent, for 12 months so we do not ask again. It holds only the word “granted” or “denied”. If you accept, we may also keep a short in-browser note, deleted when the tab closes, so the pricing section is counted once per visit. You can change your choice here at any time.

This notice will be updated as the arrangements described above are finalised. Material changes will be notified in writing to organisations we are engaged with.