Privacy Policy

1. Who we are (data controller)

Harrison James Ltd is the data controller for the personal data described in this notice. The company is registered in England and Wales under company number 14883325, with its registered office at 85 Great Portland Street, London W1W 7LT, United Kingdom.

ICO data-protection registration is in progress and will be confirmed here once issued.

2. The personal data we collect

• Enquiry data: Name, email address, phone number, business name, indicative turnover band, and the contents of any message you send via our contact form or by email.
• Engagement data (if you become a client): Identity and verification documents required for anti-money-laundering checks, business and tax information, accounting records, and correspondence.
• Technical data: IP address and basic request metadata visible to our hosting provider (Vercel) for security and performance, and — only with your consent — anonymous traffic measurements via Vercel Analytics and error-session replays via Sentry.
• Cookies and similar technologies: See section 7 below.

3. Why we use your data and our lawful basis (UK GDPR Article 6)

• To respond to enquiries and prepare a quote: Lawful basis: Article 6(1)(b) — necessary to take steps at your request prior to entering into a contract.
• To deliver accounting, tax, payroll, and advisory services under an engagement letter: Lawful basis: Article 6(1)(b) — performance of a contract; and Article 6(1)(c) — compliance with our legal obligations (HMRC, Companies House, MLR 2017).
• To meet our regulatory and statutory record-keeping duties: Lawful basis: Article 6(1)(c) — legal obligation, including HMRC retention rules and the Money Laundering Regulations 2017.
• To secure our site and detect abuse of the contact form: Lawful basis: Article 6(1)(f) — legitimate interests in protecting our infrastructure. We use Cloudflare Turnstile (a privacy-preserving CAPTCHA) and rate limiting.
• To measure anonymous website traffic and diagnose errors: Lawful basis: Article 6(1)(a) — your consent, captured via the cookie banner. You can withdraw consent at any time.

4. Who we share your data with (processors and recipients)

We do not sell personal data. We share data only with the service providers we need to run the site and deliver our services, all under written terms that restrict how they may use it:

• Vercel Inc.: Hosting and analytics. Functions for this site are pinned to the London (lhr1) region; some telemetry transits Vercel's global edge.
• Twilio SendGrid: Transactional email delivery for contact-form submissions.
• Cloudflare, Inc.: Turnstile bot-mitigation challenges on the contact form.
• Upstash, Inc.: Distributed rate-limit store used to throttle contact-form abuse (IP address only).
• Functional Software, Inc. (Sentry): Error monitoring; session replay only with your consent.
• HMRC, Companies House, and other UK regulators: Where required by law or your engagement letter authorises us to file on your behalf.

5. International transfers

Some of the processors above are based in or operate from outside the United Kingdom (notably the United States). Where personal data is transferred outside the UK, we rely on the UK Government's adequacy decision for the EU/EEA, the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, as applicable. You can request a copy of the safeguards in place by contacting us.

6. How long we keep your data

• Enquiry-only data (no engagement): Up to 24 months from your last contact, then deleted or anonymised.
• Client engagement records: At least 6 years from the end of the relevant tax year, as required by HMRC and the Companies Act 2006. Anti-money-laundering verification records are kept for 5 years from the end of the business relationship under MLR 2017.
• Website analytics and error data: Anonymised analytics are aggregated and retained by Vercel for up to 12 months. Sentry error events are retained for 90 days; replay clips (with consent) for 30 days.

7. Cookies and similar technologies

We minimise client-side storage and request your consent before setting anything that is not strictly necessary.

• Strictly necessary: We store your light/dark theme preference in your browser's localStorage. This is required for the page to render correctly on return visits and does not require consent.
• Analytics (optional, consent required): Vercel Analytics measures aggregate traffic without third-party cookies or cross-site tracking. Disabled unless you accept analytics on our banner.
• Error session replay (optional, consent required): Sentry captures the page state around a JavaScript error so we can reproduce and fix it. Inputs and text are masked by default. Disabled unless you accept error replay on our banner.

8. Your rights under UK GDPR

You have the right to ask us to: confirm what personal data we hold about you and provide a copy; correct inaccurate or incomplete data; delete data where there is no good reason to keep it; restrict or object to certain processing; and receive your data in a portable format where applicable. Where we rely on your consent (analytics and error replay), you can withdraw it at any time using the banner; withdrawal does not affect the lawfulness of processing before that point.

We aim to respond to rights requests within one month. To make a request, contact us using the details in section 10.

9. Right to complain to the ICO

If you are unhappy with how we handle your personal data, please tell us first so we can try to resolve it. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection.

ICO website: ico.org.uk · Helpline: 0303 123 1113.

10. How to contact us about your data

Please mark any data-protection enquiry as such so we can route it correctly:

11. Changes to this notice

We will update this notice when our processing changes or to keep it accurate. Material changes will be reflected in the “last updated” date at the top of the page and, where appropriate, highlighted on the home page or via the contact form.