Privacy Policy

Fiscal Flow is the trading name of Unskipped Ltd, a company registered in England and Wales. This policy explains what personal data we collect, why we process it, how long we hold it and what you can ask us to do with it. It is written to meet the information requirements of the UK GDPR and the Data Protection Act 2018.

Last reviewed: 8 September 2026

About this policy

Unskipped Ltd, trading as Fiscal Flow, is registered in England and Wales under company number 14533994, with a registered office at 40 Borrowdale Avenue, Ipswich, England, IP4 2TG. We build and run client acquisition systems for accounting and CPA firms.

This policy covers personal data belonging to clients and their staff, prospective clients and enquirers, newsletter subscribers, and visitors to fiscalflow.uk. It applies from the last reviewed date shown above and replaces any earlier version. If you have a signed Engagement Letter with us, this policy sits alongside the terms of that engagement. Where the two differ on data handling, the Engagement Letter takes precedence.

Controller and processor

Our role changes depending on whose data it is, and that determines who you should contact.

We are the controller for our own contacts

For enquiries made through this website, newsletter subscribers, people who download our guides or use our tools, and our own clients and their staff, Unskipped Ltd decides why and how the data is processed. We are the data controller, and this policy explains what we do.

We are a processor for campaign data

Where we run advertising, landing pages or a CRM for a client, the people who enquire through those campaigns are that client's contacts, not ours. The client is the data controller and we act as their processor under the terms of their Engagement Letter. We process that data only on their instructions and we do not use it for our own marketing.

Which one applies to you

If you enquired through fiscalflow.uk, contact us using the details at the bottom of this page. If you enquired through a campaign belonging to an accounting firm we work with, that firm is the controller and their privacy policy applies. We will pass any request on to them promptly if it reaches us by mistake.

What personal data we collect

We group the data we hold into three categories, based on where it comes from.

Data you give us directly

Your name, firm name, role, email address, telephone number and website when you complete an enquiry form, book a call, take a quiz or scorecard, download a guide or subscribe to the newsletter. On calls and during an engagement this extends to what you tell us about your firm: size, client numbers, services, fee levels, growth targets and current marketing. Where we take on work, we also hold billing contact details and correspondence with you.

Data collected automatically

When you visit fiscalflow.uk we collect technical and usage data through cookies and similar technologies: IP address, approximate location, device and browser type, pages viewed, time on page, referring source and the advertisement or link that brought you here. Analytics and advertising data of this kind is only collected where you have consented through the cookie banner. Our hosting provider also keeps server logs for security and diagnostics.

Data from other sources

We may hold business contact details taken from public sources such as a firm's own website, Companies House or a professional directory, where we have a legitimate interest in approaching that firm. We also receive data from the platforms we use, for example when someone books through our calendar tool, engages with an advert or opens an email. We do not buy consumer marketing lists.

We do not seek special category data, such as health, ethnicity, religious or political information, and we ask that you do not send it to us. If it reaches us incidentally we delete it.

Why we process your data

Every processing activity we carry out rests on one of four lawful bases under Article 6 of the UK GDPR.

Performance of a contract

Where you are a client, we process your data to deliver the engagement: building and running campaigns, corresponding with you, managing approvals, reporting on performance, invoicing and collecting payment. Without this data we cannot provide the service.

Legitimate interests

We rely on legitimate interests to respond to enquiries, to follow up on a conversation you started, to approach firms whose business contact details are publicly available where our services are relevant to them, to keep records of who we have spoken to, to measure how our website and advertising perform, and to protect our systems from misuse. We have considered your interests and rights in each case, and you can object at any time.

Consent

We rely on consent for the newsletter and other marketing emails to individuals, and for analytics and advertising cookies on this website. Consent is optional, is never bundled with anything else, and can be withdrawn at any time using the unsubscribe link in any email or the manage cookies link in the footer. Withdrawing consent does not affect processing that already took place.

Legal obligation

We keep records we are required to keep, including accounting and tax records under the Companies Act 2006 and tax legislation, and we respond to lawful requests from HMRC, the courts or a regulator where we are obliged to.

International data transfers

Some of our suppliers store or process data outside the United Kingdom, mainly in the European Economic Area and the United States. We also work with clients in the United States, which means their data is processed there. Where data leaves the UK, we rely on the UK adequacy regulations for the EEA, the UK Extension to the EU-US Data Privacy Framework where a supplier is certified, or the International Data Transfer Agreement and Addendum to the Standard Contractual Clauses. We review these arrangements when we take on a new supplier.

How long we keep your data

We hold personal data only for as long as the purpose or a legal duty requires, then delete or anonymise it.

Enquiries that do not become clients

Contact details and notes from an enquiry, call or proposal are kept for 24 months from our last meaningful contact, so that we can pick up a conversation where it left off. After that they are deleted unless you have separately subscribed to the newsletter.

Client records

Engagement documents, correspondence, campaign records and reporting are kept for six years from the end of the engagement. That period reflects the limitation period for contract claims and our own tax and company record-keeping obligations. Invoices and accounting records are kept for six years from the end of the relevant accounting period.

Newsletter and marketing

Subscriber data is kept until you unsubscribe or ask to be removed. After that we keep a minimal suppression record — usually just your email address — indefinitely, so that we do not accidentally email you again.

Website and analytics data

Analytics data in Google Analytics 4 is retained for 14 months and is aggregated rather than identifying. Server logs are kept for a short period for security and diagnostics. Cookie consent records are kept for 12 months so that we can show what you agreed to and when.

Personal data we process on behalf of a client is retained for as long as their Engagement Letter provides, and is returned or deleted at their direction when the engagement ends.

Your rights

These are statutory rights under the UK GDPR, and they apply regardless of whether you are a client. Some are qualified, meaning they apply in certain circumstances rather than absolutely.

Access

Ask for a copy of the personal data we hold about you, along with an explanation of what we do with it and who we share it with.

Rectification

Ask us to correct anything inaccurate, or to complete anything incomplete. Usually the quickest route is simply to tell us what is wrong.

Erasure

Ask us to delete your data where we no longer need it, where you withdraw consent, or where you object and we have no overriding reason to keep it. It does not apply to records we must retain by law.

Restriction

Ask us to pause processing while a dispute about accuracy or our legitimate interests is being resolved. We keep the data but stop using it.

Portability

Ask for the data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another provider where that is technically feasible.

Objection

Object to processing based on legitimate interests, including profiling. Where you object to direct marketing, we stop immediately and without question.

Withdraw consent

Withdraw consent at any time where we rely on it, using the unsubscribe link in any email or the manage cookies link in the footer. This does not affect processing already carried out.

Automated decisions

We do not make decisions producing legal or similarly significant effects by automated means alone. Scoring in our own systems is used to prioritise follow-up and is always reviewed by a person.

How to exercise your rights

Email us using the contact details below and say which right you want to exercise. We may ask for proof of identity before releasing data, since we need to be sure we are giving it to the right person. We respond within one month, and will tell you if a request is complex enough to need an extension of up to two further months. There is no fee unless a request is manifestly unfounded or excessive.

How we protect your data

Traffic to and from fiscalflow.uk runs over HTTPS, and data held in our CRM, hosting and email systems is encrypted at rest by those providers. Access is limited to people who need it for their work, with multi-factor authentication on every account that holds client data, and access is removed when someone leaves or a project ends. We review permissions on client systems when an engagement ends and hand back or delete credentials. Anyone working with us is briefed on handling personal data and phishing risk. If a breach happens that is likely to risk your rights, we notify the ICO within 72 hours and tell you directly where the risk is high.

Cookies

We use essential cookies to keep the site working, analytics cookies to understand how pages perform, and advertising cookies to measure our own campaign results. Only the essential ones run without your consent. You can change or withdraw your cookie choices at any time through the banner or the manage cookies link in the footer. Full detail is in our Cookie Policy.

Children's data

Our services are sold to accounting and CPA firms, and the site is aimed at business owners. We do not knowingly collect personal data from anyone under 18. If you believe a child has submitted data through our website, email us and we will delete it.

Changes and how to contact us

We update this policy when our processing, suppliers or legal duties change, and revise the last reviewed date at the top. Where a change materially affects how we handle your data, we tell existing clients and subscribers directly by email rather than relying on you to check the page.

Send data protection queries, subject access requests and objections to the address below, with enough detail for us to identify your records. We have not appointed a statutory Data Protection Officer, as we are not required to; the director handles these requests directly.

Data queries: privacy@fiscalflow.uk — Response within 1 month under UK GDPR
Data controller: Unskipped Ltd, trading as Fiscal Flow
Registered address: 40 Borrowdale Avenue, Ipswich, England, IP4 2TG
Companies House: 14533994
ICO registration: [ICO registration number — to be added]

Complaints to the ICO

If you are unhappy with how we have handled your data or your request, you can complain to the Information Commissioner's Office. We would rather hear from you first so we can put things right, but you are not required to contact us before going to the ICO. Write to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, call 0303 123 1113, or use the online form at ico.org.uk/make-a-complaint. Complaining to the ICO does not affect your right to seek a remedy through the courts.