Privacy notice
Written to be read rather than to be technically compliant. If anything here is unclear, ask me and I will explain it and then fix the wording.
Last updated: August 2026
Who is responsible
IA Bookkeeps is a sole trader operated by Ibrahim Ahmed, based in Leeds, United Kingdom. For data protection purposes I am the controller of the personal data described here.
Contact: ibrahim@iabookkeeps.co.uk
This site collects nothing on its own
There is no analytics, no tracking pixel, no advertising network, no embedded social media, and no third-party scripts of any kind. The site sets no cookies. Nothing you read here is logged against you.
Cloudflare serves the site and, as a normal part of protecting it, may set a strictly necessary security cookie and process technical request data such as IP address. That processing is necessary to deliver and protect the service; it is not used to build a profile of you.
If you contact me
When you use the contact form or email me, I process the details you send: your name, email address, any organisation name, and the content of your message. The form also records, automatically, the IP address it was sent from, the country Cloudflare associates with that address, and your browser's user-agent string. Those three are kept only to detect and rate-limit spam submissions; they are never used to identify or profile you.
- Why: to answer your enquiry and, if we go ahead, to provide the service. Lawful basis: legitimate interests in responding to a business enquiry, and performance of a contract once engaged.
- Where it goes: form submissions are delivered to me as a notification through Telegram, and stored briefly in Cloudflare Workers KV so a message is not lost if that notification fails. Both act as processors.
- How long: enquiries that do not become work are deleted within 12 months. Client records are kept for as long as the engagement and my record-keeping obligations require, then deleted.
- What I will not do: add you to a marketing list, sell or share your details, or use your message or your data to train any system.
If you become a client
To do the work I necessarily process the financial records you give me, which may contain personal data about you, your staff, your customers or your suppliers. For that data I generally act as processor on your instructions, under the terms of our engagement.
- Stored in the UK, on encrypted devices
- Never used for any purpose other than delivering your work
- Never used to train any system, and never shared with anyone outside the engagement without your instruction
- Returned or deleted on request when the engagement ends, subject to any records I am legally required to retain
- For practice work, accessed through your own systems wherever possible, so the records stay in your environment
If I emailed you first
I send a small volume of business-to-business email to UK incorporated accountancy, bookkeeping and tax-consultancy practices, and to UK incorporated businesses, offering bookkeeping and Excel automation services. If you received one of those, this section explains it.
The lawful basis
Legitimate interests, under Article 6(1)(f) of the UK GDPR. I have carried out and documented a Legitimate Interests Assessment covering the purpose, necessity and balancing tests before sending anything. The balance rests on the contact being made in a purely professional capacity, to a role-holder at an incorporated organisation, about a service directly relevant to their work.
Who I do not email
Sole traders and ordinary partnerships are treated as individual subscribers under regulation 22 of PECR, who require prior consent. They are excluded at source: only incorporated entities — limited companies, LLPs and PLCs — enter the contact list at all.
Where the details came from
| Data | Source | Kept for |
|---|---|---|
| Organisation name, company number, registered postcode | Companies House public register | 24 months from last contact |
| Public business listing details | Google Places | 24 months from last contact |
| Business contact name, role and email address | Hunter | 24 months from last contact |
| The specific reason I contacted you | Your organisation's own public website | 24 months from last contact |
| Record that I contacted you, and when | My own records | 24 months |
| Your address, if you unsubscribe | Your request | Kept indefinitely — see below |
All of it is business contact data about a role at an organisation. I do not buy contact lists, and I do not process special category data for outreach.
How to make it stop
Any of these works, permanently, and none of them requires you to explain yourself:
- Click the unsubscribe link in any email I have sent you
- Reply to any email with the word unsubscribe
- Email ibrahim@iabookkeeps.co.uk and ask
Why unsubscribing keeps your email address: a suppression list only works if it remembers you. Your address is retained indefinitely for the sole purpose of never contacting you again. It is not used for anything else, and it is not shared with anyone. If you would rather I erase it entirely, say so and I will — but I then cannot guarantee you are not contacted again in future.
Your rights
Under UK data protection law you can ask me to:
- Tell you what personal data I hold about you, and give you a copy
- Correct anything inaccurate
- Delete it, where I have no overriding reason to keep it
- Restrict how I use it while a question is resolved
- Provide it in a portable format
- Object to my processing based on legitimate interests — including all outreach email. If you object to direct marketing, I must stop, with no balancing exercise and no questions asked.
Email ibrahim@iabookkeeps.co.uk and I will respond within one month. There is no charge.
Complaints
If you are unhappy with how I have handled your data, please tell me first — it is usually something I can fix quickly. You also have the right to complain directly to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
If this notice changes materially, the date at the top changes with it. Anyone in an active engagement is told directly rather than being expected to re-read the page.