GDPR & Data Processing

Controller and processor roles

For most engagements Bohzo Ltd acts as an independent data controller — accountancy providers determine how client data must be processed to meet legal obligations. Where we run payroll, we process employee data on your instructions and a processing agreement applies: we process only to deliver payroll, keep it confidential, and delete or return it at the end of the engagement.

Lawful bases we rely on

• Performance of a contract — delivering the services you engage us for.
• Legal obligation — AML identity checks, record retention, statutory filings.
• Legitimate interests — service improvement and fraud prevention, balanced against your rights.

Security measures

Encrypted transport for all record exchange, access-controlled storage, least-privilege access within the team, and audit trails on filing activity. Identity documents are stored separately from working papers and retained only as long as AML rules require.

Data subject requests

Requests (access, rectification, erasure, restriction, portability, objection) go to hello@bohzoaccountants.co.uk and are answered within one month. Note that tax law requires us to retain some records for six years even where erasure is requested — we will always tell you exactly what must be kept and why.

Breach handling

Suspected personal-data breaches are contained, assessed and — where they risk your rights — reported to the ICO within 72 hours and to affected individuals without undue delay.