1. About this policy
This policy explains how SOAR Worldwide Limited collects, uses and protects personal data when you visit our website, contact us, or engage us for accountancy or sustainability services. Our use of cookies is explained in our separate Cookie Policy. It was last updated on 1 October 2026.
Who we are. SOAR Worldwide Limited (“SOAR”, “we”, “us”) is a company registered in England and Wales with company number 11783628 and registered office at 129 High Street, Teddington, TW11 8HJ. We provide accountancy, tax, business advisory and sustainability consulting services. We are a member firm of the Institute of Chartered Accountants in England and Wales (ICAEW) and are supervised for anti-money laundering purposes by ICAEW. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC264368.
Our role. We are the controller of the personal data described in this policy. For most accountancy, tax and sustainability work we act as a controller, because our professional obligations decide how we handle the data. For some services, such as payroll or bookkeeping carried out on your instructions, we may act as your processor; where that applies, our engagement letter sets out the terms.
Other notices. This policy should be read alongside your engagement letter and our Terms of Business, which take precedence for client work. Our website is not intended for children and we do not knowingly collect data relating to children through it.
Contact us. For any question about this policy or your personal data, email info@soar.ltd or write to us at our registered office.
Keeping your data accurate. Please tell us if your personal details change during your relationship with us.
Changes to this policy. We review this policy regularly. Any update will be posted on this page with a new “last updated” date.
2. The personal data we collect
What we collect depends on how you deal with us: as a website visitor, an enquirer, a client (or a client’s director, employee or shareholder), or a supplier.
| Category | Examples | Usually collected from |
|---|---|---|
| Identity | Name, title, date of birth, job title, signature | You, your employer, Companies House |
| Contact | Email, phone number, postal address | You, your organisation |
| Verification (anti-money laundering) | Passport or driving licence, proof of address, results of identity, sanctions and politically exposed person (PEP) checks | You, electronic ID verification providers, public sources |
| Financial and tax | National Insurance number, Unique Taxpayer Reference, income, investments, bank details, payroll and pension information | You, your employer, HMRC, banks and pension providers acting on your authority |
| Sustainability engagement | Business contact details of staff and suppliers, survey and interview responses, workforce and operational data needed for carbon footprints, ESG reports, materiality assessments and supply chain reviews | Our client organisations, their staff and suppliers |
| Communications | Emails, call notes, meeting records, feedback | You |
| Technical and usage | IP address, browser and device type, pages visited, time on site | Your device, via cookies and similar technology (see our Cookie Policy) |
| Marketing preferences | Newsletter and event sign-ups, opt-outs | You |
Identity
- Examples
- Name, title, date of birth, job title, signature
- Usually collected from
- You, your employer, Companies House
Contact
- Examples
- Email, phone number, postal address
- Usually collected from
- You, your organisation
Verification (anti-money laundering)
- Examples
- Passport or driving licence, proof of address, results of identity, sanctions and politically exposed person (PEP) checks
- Usually collected from
- You, electronic ID verification providers, public sources
Financial and tax
- Examples
- National Insurance number, Unique Taxpayer Reference, income, investments, bank details, payroll and pension information
- Usually collected from
- You, your employer, HMRC, banks and pension providers acting on your authority
Sustainability engagement
- Examples
- Business contact details of staff and suppliers, survey and interview responses, workforce and operational data needed for carbon footprints, ESG reports, materiality assessments and supply chain reviews
- Usually collected from
- Our client organisations, their staff and suppliers
Communications
- Examples
- Emails, call notes, meeting records, feedback
- Usually collected from
- You
Technical and usage
- Examples
- IP address, browser and device type, pages visited, time on site
- Usually collected from
- Your device, via cookies and similar technology (see our Cookie Policy)
Marketing preferences
- Examples
- Newsletter and event sign-ups, opt-outs
- Usually collected from
- You
Special category and criminal offence data. We do not seek this data. Occasionally we may hold information about health or disability where it affects a tax position or relief you ask us to claim. Our anti-money laundering checks may reveal information about criminal offences or sanctions. We handle this data only where the law permits, for example to meet our legal obligations or with your explicit consent, and with extra safeguards.
Data about other people. If you give us personal data about someone else, such as a family member, employee or supplier, please make sure they know you are sharing it and point them to this policy.
If you do not provide data. Where we need data by law or to perform our engagement and you do not provide it, we may be unable to act for you.
3. How we use your data and our lawful bases
We use personal data only where UK data protection law allows. The main purposes and the lawful basis for each are below; some purposes rely on more than one basis.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Responding to enquiries and preparing proposals | Identity, contact, communications | Legitimate interests (responding to people who contact us); steps before entering a contract |
| Client take-on and anti-money laundering checks | Identity, contact, verification | Legal obligation (Money Laundering Regulations 2017 and Proceeds of Crime Act 2002) |
| Providing accountancy, tax, payroll and advisory services | Identity, contact, financial and tax, communications | Performance of our contract with you; legitimate interests where our client is your employer or organisation |
| Providing sustainability services (carbon footprints, ESG reporting, materiality and supply chain work) | Sustainability engagement, contact, communications | Legitimate interests (delivering the service our client has engaged us for); performance of contract |
| Filing returns and dealing with HMRC, Companies House and other authorities | Identity, financial and tax | Legal obligation; performance of contract |
| Billing, collecting fees and managing our relationship | Identity, contact, financial | Performance of contract; legitimate interests (recovering debts) |
| Meeting professional, regulatory and insurance requirements, including quality reviews | All relevant categories | Legal obligation; legitimate interests (meeting our professional standards and defending claims) |
| Sending newsletters, insights and event invitations | Contact, marketing preferences | Legitimate interests for existing clients and business contacts (soft opt-in); consent for others |
| Running, securing and improving our website | Technical and usage | Legitimate interests (operating a secure, useful website); consent where required for cookies |
Responding to enquiries and preparing proposals
- Data used
- Identity, contact, communications
- Lawful basis
- Legitimate interests (responding to people who contact us); steps before entering a contract
Client take-on and anti-money laundering checks
- Data used
- Identity, contact, verification
- Lawful basis
- Legal obligation (Money Laundering Regulations 2017 and Proceeds of Crime Act 2002)
Providing accountancy, tax, payroll and advisory services
- Data used
- Identity, contact, financial and tax, communications
- Lawful basis
- Performance of our contract with you; legitimate interests where our client is your employer or organisation
Providing sustainability services (carbon footprints, ESG reporting, materiality and supply chain work)
- Data used
- Sustainability engagement, contact, communications
- Lawful basis
- Legitimate interests (delivering the service our client has engaged us for); performance of contract
Filing returns and dealing with HMRC, Companies House and other authorities
- Data used
- Identity, financial and tax
- Lawful basis
- Legal obligation; performance of contract
Billing, collecting fees and managing our relationship
- Data used
- Identity, contact, financial
- Lawful basis
- Performance of contract; legitimate interests (recovering debts)
Meeting professional, regulatory and insurance requirements, including quality reviews
- Data used
- All relevant categories
- Lawful basis
- Legal obligation; legitimate interests (meeting our professional standards and defending claims)
Sending newsletters, insights and event invitations
- Data used
- Contact, marketing preferences
- Lawful basis
- Legitimate interests for existing clients and business contacts (soft opt-in); consent for others
Running, securing and improving our website
- Data used
- Technical and usage
- Lawful basis
- Legitimate interests (operating a secure, useful website); consent where required for cookies
Legitimate interests. Where we rely on legitimate interests, we weigh our interests against your rights and do not proceed where your interests override ours. You can ask us for details of that assessment.
Marketing. You can opt out of marketing at any time using the unsubscribe link in any email or by emailing info@soar.ltd. We never sell your data.
Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Change of purpose. We use data only for the purposes we collected it for, or a compatible purpose. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis.
4. Sharing, transfers, security and retention
Who we share data with. We share personal data only where needed for the purposes in section 3:
- HMRC, Companies House, pension regulators and other public bodies, to file returns and meet legal duties.
- Service providers who support our business, such as cloud accounting and practice management software, IT and email hosting, identity verification and e-signature providers. They act on our instructions under written contracts.
- Banks, pension providers, lenders and other advisers, where you ask us to deal with them.
- Sustainability partners, such as data platforms, assurance or verification bodies and certification schemes, where needed to deliver an engagement and agreed with our client.
- Our professional body, AML supervisor, auditors, insurers and legal advisers, under duties of confidentiality.
- Law enforcement and regulators where the law requires it. We may be legally unable to tell you about some disclosures, such as suspicious activity reports to the National Crime Agency.
- A buyer or successor if our business is sold or restructured, subject to confidentiality.
International transfers. Some providers store or access data outside the UK. When this happens we make sure the transfer is lawful, for example because the country is covered by UK adequacy regulations or because we use the UK International Data Transfer Agreement or Addendum. Contact us for details.
Security. We use appropriate technical and organisational measures, including access controls, encryption, multi-factor authentication and staff confidentiality duties. Access is limited to people who need it. We have procedures for suspected data breaches and will notify you and the ICO where the law requires.
How long we keep data. We keep data only as long as needed, including to meet legal, regulatory, tax and insurance requirements.
| Data | Retention period |
|---|---|
| Anti-money laundering records (identity checks, risk assessments, transaction records) | 5 years after the business relationship ends, as required by the Money Laundering Regulations 2017 |
| Client files, working papers, tax returns and correspondence | 7 years after the end of the engagement or the period the work relates to, whichever is later. This reflects the 6-year limitation period for claims plus a margin |
| Payroll and pension records we hold for clients | 7 years after the end of the tax year they relate to |
| Sustainability engagement data | 7 years after the end of the engagement, in line with our client files |
| Our own billing and fee records | 7 years after the end of the financial year they relate to |
| Enquiries that do not lead to an engagement | 2 years from last contact |
| Marketing contact details | Until you unsubscribe; we keep a suppression record so we do not contact you again |
| Website analytics data | As set out in our Cookie Policy |
Anti-money laundering records (identity checks, risk assessments, transaction records)
- Retention period
- 5 years after the business relationship ends, as required by the Money Laundering Regulations 2017
Client files, working papers, tax returns and correspondence
- Retention period
- 7 years after the end of the engagement or the period the work relates to, whichever is later. This reflects the 6-year limitation period for claims plus a margin
Payroll and pension records we hold for clients
- Retention period
- 7 years after the end of the tax year they relate to
Sustainability engagement data
- Retention period
- 7 years after the end of the engagement, in line with our client files
Our own billing and fee records
- Retention period
- 7 years after the end of the financial year they relate to
Enquiries that do not lead to an engagement
- Retention period
- 2 years from last contact
Marketing contact details
- Retention period
- Until you unsubscribe; we keep a suppression record so we do not contact you again
Website analytics data
- Retention period
- As set out in our Cookie Policy
We keep data for longer where there is a complaint, claim, HMRC enquiry or regulatory investigation, until it is resolved. Original records you give us belong to you and are returned to you once our work is complete; we keep copies only as needed.
When data is no longer needed we delete it securely or anonymise it.
5. Your rights and how to complain
Under UK data protection law you have the right to:
- Be informed about how we use your data, which this policy does.
- Access your data and receive a copy (a subject access request). We will make reasonable and proportionate searches.
- Correct data that is inaccurate or incomplete.
- Erase your data where there is no good reason for us to keep it. Legal duties, such as anti-money laundering record keeping, may mean we cannot delete some data.
- Restrict our use of your data, for example while its accuracy is checked.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Data portability, where you provided the data and we process it by automated means under a contract or your consent.
- Withdraw consent where we rely on it. This does not affect processing already carried out.
How to exercise your rights. Email info@soar.ltd. We may need to confirm your identity first. We normally respond within one month; if a request is complex we may extend this by up to two further months and will tell you why. There is usually no fee, but we may charge a reasonable fee or refuse if a request is manifestly unfounded or excessive.
Complaints to us. If you are unhappy with how we have handled your personal data, please contact us first at info@soar.ltd with “Data protection complaint” in the subject line. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you updated, and tell you the outcome.
Complaints to the regulator. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, atico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.
6. Cookies
Our website uses cookies and similar technologies. Please refer to our separate Cookie Policy, which explains which cookies we use, why we use them, and how you can manage your choices.