About this policy

Unskipped Ltd, trading as Fiscal Flow, is the data controller for the personal data described here. We are registered in England and Wales under company number 14533994, with a registered office at 40 Borrowdale Avenue, Ipswich, England, IP4 2TG. This policy covers personal data belonging to clients and their staff, prospective clients and enquirers, newsletter subscribers, and visitors to fiscalflow.uk. It applies from the last reviewed date shown above and replaces any earlier version. If you have a signed engagement with us, this policy sits alongside the terms of that engagement. Where the two differ on data handling, the engagement terms take precedence.

What personal data we collect

We group the data we hold into three categories, based on where it comes from.

Why we process your data

Every processing activity we carry out rests on one of four lawful bases under Article 6 of the UK GDPR.

Who we share your data with

We do not sell personal data, and we do not share it for other organisations' marketing.

Data is shared only where it is needed to run our services, meet a legal duty, or operate the systems our work depends on. Every supplier that handles personal data on our behalf is bound by a written processing agreement.

International data transfers

Some of our suppliers store or process data outside the United Kingdom, mainly in the European Economic Area and the United States. We also work with clients in the United States, which means their data is processed there. Where data leaves the UK, we rely on the UK adequacy regulations for the EEA, the UK Extension to the EU-US Data Privacy Framework where a supplier is certified, or the International Data Transfer Agreement and Addendum to the Standard Contractual Clauses. We review these arrangements when we take on a new supplier.

How long we keep your data

We hold personal data only for as long as the purpose or a legal duty requires, then delete or anonymise it.

Your rights

These are statutory rights under the UK GDPR, and they apply regardless of whether you are a client. Some are qualified, meaning they apply in certain circumstances rather than absolutely.

How to exercise your rights

Email us using the contact details below and say which right you want to exercise. We may ask for proof of identity before releasing data, since we need to be sure we are giving it to the right person. We respond within one month, and will tell you if a request is complex enough to need an extension of up to two further months. There is no fee unless a request is manifestly unfounded or excessive.

How we protect your data

Traffic to and from fiscalflow.uk runs over HTTPS, and data held in our CRM, hosting and email systems is encrypted at rest by those providers. Access is limited to people who need it for their work, with multi-factor authentication on every account that holds client data, and access is removed when someone leaves or a project ends. We review permissions on client systems when an engagement ends and hand back or delete credentials. Anyone working with us is briefed on handling personal data and phishing risk. If a breach happens that is likely to risk your rights, we notify the ICO within 72 hours and tell you directly where the risk is high.

Cookies

We use essential cookies to keep the site working, analytics cookies to understand how pages perform, and advertising cookies to measure campaign results. Only the essential ones run without your consent. You can change or withdraw your cookie choices at any time through the banner. Full detail is in our cookies policy at /cookies-policy/.

Children's data

Our services are sold to accounting and CPA firms, and the site is aimed at business owners. We do not knowingly collect personal data from anyone under 18. If you believe a child has submitted data through our website, email us and we will delete it.

Changes to this policy

We update this policy when our processing, suppliers or legal duties change, and revise the last reviewed date at the top. Where a change materially affects how we handle your data, we tell existing clients and subscribers directly by email rather than relying on you to check the page.

How to contact us

One route handles every data question and request.

Send data protection queries, subject access requests and objections to the address below, with enough detail for us to identify your records. We have not appointed a statutory Data Protection Officer, as we are not required to; the director handles these requests directly.

Complaints to the ICO