Who we are
This website is run by HCA Accountants Ltd, a company registered in England and Wales (company number 06208449). Our registered office is Park House, Wilmington Street, Leeds, LS7 2BP. HCA Accountants Ltd is the controller of the personal information described in this notice and is registered with the Information Commissioner’s Office (registration number ZA552883).
For any privacy question or request, email ask@hca-accountants.com, call 0113 460 1786, or write to us at the address above.
This notice covers this website, the enquiry form and Finn, our website assistant. If you become a client, we will give you separate information about how we handle your client records.
When you send an enquiry
What we collect: the service you are interested in, your name, email address, phone number (optional), preferred day and time, and your message.
Why: to reply to you and, if you want, to arrange a conversation about our services. Our lawful basis is taking steps at your request before entering into a contract, and our legitimate interest in answering enquiries.
How it reaches us: the website does not store your enquiry. It is sent straight to our inbox at ask@hca-accountants.com as an email, delivered by Brevo, an email delivery service. Your enquiry is then held in our email system.
Do you have to give it? No. There is no legal requirement to send an enquiry. If you choose not to, we simply cannot reply through the website, and you can call or email us instead.
How long we keep it: if you do not become a client, we delete your enquiry within 24 months of our last contact with you. If you become a client, it becomes part of your client records.
Spam protection: Cloudflare Turnstile checks that an enquiry comes from a person rather than an automated program. The check uses your network address and technical information from your browser. The website also briefly counts requests from your network address to limit abuse. These checks do not keep a record of your enquiry. Our lawful basis is our legitimate interest in keeping the website secure.
When you use Finn
Finn is our AI guide to public tax and business setup information and to our published services. Finn is in beta. Do not rely on its answers to make decisions. Check the linked official guidance or speak to us first.
What is processed: your question and your recent messages in the same chat (up to the last six). Finn does not receive your network address.
Who processes it: to find relevant guidance and prepare an answer, your question is sent to Cloudflare (Workers AI, which searches our guidance library), and your question with your recent messages may be sent to TypeSafe AI (which decides what kind of question it is) and OpenAI (which helps choose and compose the answer from official sources). These providers act on our behalf under written data protection terms. TypeSafe AI and OpenAI are based in the United States, so your messages may be processed outside the UK.
How long providers keep it: OpenAI may keep messages for up to 30 days to monitor for abuse, then deletes them. TypeSafe AI keeps data only as long as it needs to provide its service.
What we keep: we keep a record of each question and Finn’s answer for 90 days, so we can check answer quality and fix mistakes. Before saving, we automatically remove email addresses, phone numbers, National Insurance numbers, tax references, bank details and postcodes. We cannot reliably detect names, so please leave them out. Records are not linked to your network address or identity, and are deleted automatically after 90 days. Your chat is also kept in your browser for the current tab, for up to two hours. Use “Clear chat” to remove it from your browser sooner.
Usage limits: to prevent abuse and control costs, we count questions against a scrambled (salted and hashed) version of your network address. We do not store the address itself. These counters are deleted after two days.
Please keep it general. Do not include names, contact details, tax references, National Insurance numbers, bank details, passwords or private documents. Finn cannot see client records and does not submit anything to HMRC or Companies House.
Our lawful basis is our legitimate interest in offering general guidance to visitors and in checking and improving the quality of that guidance. “Talk to HCA” opens the separate enquiry form and does not send your chat to us.
Cookies and browser storage
We do not use advertising or marketing analytics cookies. The website stores two things in your browser, both for features you choose to use:
- hca-theme (local storage): remembers whether you chose the light or dark appearance. It stays until you clear it.
- Finn chat (session storage): keeps your chat visible while the tab is open, for up to two hours.
Cloudflare Turnstile runs a security check when you use the enquiry form. The check uses your network address and browser information. Our lawful basis is our legitimate interest in keeping the website and form secure. Cloudflare explains how it handles that information in its privacy policy.
Hosting and technical information
The website is hosted on Cloudflare. When you visit, Cloudflare processes standard technical information, such as your network address, browser type and the pages requested, so it can deliver pages and protect the site from attacks. Our lawful basis is our legitimate interest in running a secure website.
Who helps us run the website
We share personal information only with organisations that help us run this website, and only as far as they need it:
- Wharfedale AI (SB Ecom Ltd), which builds and supports this website on our behalf.
- Cloudflare: hosting, security checks, usage limits and part of Finn.
- Brevo: delivers enquiry emails to our inbox.
- TypeSafe AI and OpenAI: help Finn understand questions and prepare answers.
Some of these providers process information outside the UK. Where they do, we use a safeguard recognised by UK law. Cloudflare is certified under the UK Extension to the EU-US Data Privacy Framework. For OpenAI, we use the International Data Transfer Addendum to the EU Standard Contractual Clauses, included in OpenAI’s data processing terms. We have asked TypeSafe AI for the same safeguard; until it is in place, we automatically remove email addresses, phone numbers, National Insurance numbers, reference numbers and postcodes from questions before they are sent to TypeSafe AI. Brevo is based in the European Union, which the UK recognises as providing adequate protection. You can ask us for a copy of these safeguards at ask@hca-accountants.com.
We do not sell your information, and we do not use it for marketing unless you ask us to.
Your rights
You have the right to ask for a copy of the personal information we hold about you, and to ask us to correct it, delete it or restrict how we use it. You can also object to our use of it and, in some cases, ask for it to be transferred to you or another organisation. Email ask@hca-accountants.com to make a request. We will reply within one month.
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
We will update this notice when the way we handle personal information changes. The date at the top shows when it was last updated.