Privacy Policy
This policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it.
Who we are
Arro is a trading name of Arro Group Ltd, a company registered in Northern Ireland. Our registered office is 254 Suffolk Road, Belfast, BT11 9PB. We are the data controller for the personal information described in this policy.
For any privacy enquiry, write to us at info@arrogroup.co.uk or call 028 9508 4138.
Information we collect
We collect personal data in three ways:
- Information you give us. Name, email, phone, business name, and any details you share when you contact us, request a callback, or become a client.
- Information we collect to do our work. Once you become a client, we collect financial and tax information needed to deliver the services agreed in your engagement letter. This may include payroll data, accounting records, identification documents required for anti-money-laundering checks, and correspondence with HMRC, Companies House, and other authorities.
- Information collected automatically. When you visit this website, we collect basic technical information (IP address, browser type, pages visited, referrer) for analytics and security. See cookies below.
How we use your information
We process personal data on the following legal bases:
- Contract. To deliver the accountancy, tax, audit, and advisory services agreed in your engagement letter.
- Legal obligation. To meet our duties under tax law, anti-money-laundering regulations, audit standards, and the rules of our professional bodies.
- Legitimate interests. To respond to enquiries, run our practice, improve our services, prevent fraud, and keep our network secure. We balance these interests against your rights.
- Consent. Where the law requires it, for example optional marketing communications. You can withdraw consent at any time.
Who we share information with
We share personal data only where necessary, including with:
- HMRC, Companies House, and other regulators as required to file returns, accounts, and statutory documents on your behalf.
- Our software providers (cloud accounting, payroll, document storage, secure email) under written data-processing agreements.
- Banks, lenders, and other professionals only where you have asked us to, or where the engagement requires it.
- Our professional bodies and insurers for quality reviews, regulatory inspections, and professional indemnity matters.
- Law enforcement or courts where we are legally compelled to do so.
We do not sell personal data and we do not share it for third-party marketing.
How long we keep information
We retain client records for a minimum of seven years from the end of the engagement, in line with HMRC and professional body requirements. Some records (for example, audit working papers and anti-money-laundering documentation) may be retained for longer where regulation requires it. Enquiry-stage information for prospects who do not become clients is deleted after twenty-four months.
Your rights
Under UK GDPR you have the right to:
- Ask for a copy of the personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Ask us to delete your data, subject to our legal and regulatory retention obligations.
- Object to processing based on legitimate interests.
- Restrict processing in certain circumstances.
- Receive your data in a portable format.
- Withdraw consent where consent is the basis for processing.
To exercise any of these rights, email info@arrogroup.co.uk. We will respond within one calendar month.
If you are not satisfied with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
How we keep information secure
We use encrypted storage, access controls, two-factor authentication, and regular backups. Access to client data is limited to the staff working on the engagement. We use reputable cloud providers based in the UK and EEA, and review our security arrangements regularly.
Cookies
This website uses a small number of cookies. Strictly necessary cookies are used to deliver the site and remember your consent choices. Analytics cookies help us understand how visitors use the site so we can improve it; these are only set with your consent. We do not use advertising or tracking cookies for third-party marketing.
International transfers
Most of our processing takes place in the UK and EEA. Where a service provider transfers data outside these regions (for example, a cloud platform with US infrastructure), we rely on UK adequacy regulations or standard contractual clauses to keep your data protected.
Changes to this policy
We update this policy from time to time. The date at the top of the page reflects the most recent change. For material changes that affect existing clients, we will write to you directly.
Contact
For any privacy question, write to us at:
Arro Group Ltd254 Suffolk Road
Belfast
BT11 9PB
info@arrogroup.co.uk · 028 9508 4138