Who we are
Nelson Shepherd (a trading name of ADD OWNER NAME(S)) is the data controller for the personal information described here. We're registered with the Information Commissioner's Office, registration number ADD. Contact us at ADD EMAIL or ADD ADDRESS.
What we collect and why
| When you… | We collect | Why, and our lawful basis | How long we keep it |
|---|---|---|---|
| Ask for a call back | Name, phone or email, business type, your message | To reply to your enquiry. Legitimate interests. | 12 months, then deleted automatically, unless you become a client |
| Refer a friend | Your name and email, your friend's name and contact details | To contact your friend, who you've confirmed is happy to hear from us, and to thank you. Legitimate interests. | 12 months, then deleted automatically |
| Download a free guide | First name, email, business type (optional), which guides you downloaded and when, and whether you asked for tax tips | To send you the guide and follow up on it: legitimate interests. To send tax tips and reminders, only if you tick the box: consent. | 12 months after your last download, then deleted automatically. If you ask for tips, until you unsubscribe |
| Sign up for reminders | Email, first name, which reminders you chose | To send the reminders you asked for. Consent. | Until you unsubscribe |
| Become a client | Contact and business details, services chosen, your acceptance of our engagement letter | To provide our services and keep a record of our agreement. Contract. | At least 6 years after our work ends |
| Upload documents | Your name, email, and the files you send (which may include ID documents and financial records) | To provide our services and carry out identity checks the law requires. Contract and legal obligation. | At least 6 years after our work ends; ID records at least 5 years, as the Money Laundering Regulations require |
| Pay us | Your name, the amount, and payment references. Direct Debit and card details are held by GoCardless and Stripe, not by us | To take payment for our services. Contract. Keeping accounting records: legal obligation | 6 years after the end of the financial year, as tax law requires |
| Use the website assistant | The messages you type | To answer your question. Legitimate interests. | We don't keep chat messages. Anthropic keeps them for a limited period under its business terms and doesn't use them to train its models |
Where your information comes from
Most of it comes from you. We also receive information from HMRC, Companies House and your previous accountant when we act for you, from identity-checking services when we verify who you are, and from clients who refer a friend to us. If someone referred you, we'll tell you who when we first get in touch.
To act for you, we need your identity documents and the information for your returns. The law requires the identity checks, so without them we can't take you on. Everything else on our forms is optional unless it's marked as required.
Who we share it with
We only use trusted providers who process data on our behalf and under contract:
- Resend sends us email notifications when you submit a form, and sends you the link to any guide you download.
- Brevo sends reminder emails and tax tips, if you sign up for them.
- Cloudflare hosts this website, stores your form submissions and uploaded files, and provides cookie-free visit statistics.
- Anthropic provides the AI behind the website assistant. Personal details such as UTR, National Insurance and bank numbers are removed automatically before a message is sent.
- Payment providers (GoCardless and Stripe) if you pay us online. We never see your full card details.
Some providers process data outside the UK, mainly in the European Economic Area and the United States. Where they do, we rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US companies, or on the ICO's International Data Transfer Agreement or Addendum. CHECK PROVIDER AGREEMENTS
We share information with HMRC, Companies House and other authorities when we act for you or when the law requires it. We never sell your information.
Cookies
This website doesn't use advertising, tracking or social media cookies, so you won't see a cookie banner. The calculators, forms and website assistant work without storing anything on your device.
Our hosting provider, Cloudflare, may set the security cookies below. They're strictly necessary to protect the site and its forms from automated attacks, so the law doesn't require your consent, but you should know about them.
| Cookie | Set by | What it does | How long it lasts |
|---|---|---|---|
| __cf_bm | Cloudflare | Tells people apart from automated bots, so spam and attacks are blocked | 30 minutes after you stop using the site |
| cf_clearance | Cloudflare | Remembers that you passed a security check, so you aren't asked again. Only set if a check is shown | Set by our security settings, usually under a day |
| CF_Authorization | Cloudflare | Keeps Nelson Shepherd staff signed in to our private contacts page. Never set for visitors | 24 hours |
We count visits with Cloudflare Web Analytics. It doesn't use cookies, doesn't store anything on your device and doesn't follow you across other websites. It tells us which pages are read and roughly where visitors come from, so we can improve the site.
You can block or delete cookies in your browser settings. If you block the security cookies, some forms may ask you to complete a check.
Emails from us
If you download a guide, we send you the link and may follow up once about it. We only send tax tips and reminders if you ticked the box or signed up for them, and every one has an unsubscribe link. Our reminder emails may record whether they were opened, so we can see which reminders are useful. CHECK BREVO SETTINGS
Keeping your information safe
Uploaded documents are stored privately and can't be opened from the website. Our systems use encryption, two-step verification and access only for people in the practice who need it.
Your rights
You can ask us to see, correct or delete your information, to restrict or object to how we use it, or to move it to another provider. Where we rely on your consent, such as for tax tips, you can withdraw it at any time by unsubscribing or contacting us. You can always object to marketing emails. Some records we must keep by law, even if you ask us to delete them. Contact us and we'll reply within one month.
We don't make decisions about you based only on automated processing. The website assistant gives general information; any decision about your affairs is made by a person.
Our services and this website aren't intended for children under 13.
If you're unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk.
Last updated 15 October 2026.