Privacy notice
Last updated: 28 October 2026
This notice explains how Finn6 Solutions Limited collects, uses, shares and protects personal information, and the rights you have over it. It applies to visitors to this website, people who contact us, our clients and the individuals connected with them (such as directors, shareholders, persons with significant control, employees and family members), and our suppliers and business contacts.
Please read it alongside any engagement letter or other privacy information we give you when you become a client. Where those documents give more specific information about a particular service, that information applies as well as this notice.
1. Who we are
Finn6 Solutions Limited (“Finn6”, “we”, “us”, “our”) is a company registered in England and Wales with company number 17033842. We provide company formation, bookkeeping and accounts, payroll, tax and compliance, and business advisory services.
For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, Finn6 is the controller of the personal information described in this notice, which means we decide how and why it is used. In some limited cases, for example when we run payroll using information our client gives us about its employees, we may act as a processor on our client's behalf, and our client is the controller.
We are registered with the Information Commissioner's Office (“ICO”) under registration number [ICO NUMBER]. We are supervised for anti-money laundering purposes by [AML SUPERVISOR].
We have not appointed a Data Protection Officer because we are not required to. Questions about this notice or how we handle personal information should be sent to contact@finn6.com.
2. The personal information we collect
The information we collect depends on how you interact with us. It may include:
- Identity information: name, title, date of birth, nationality, and, where required for identity verification, copies of identity documents such as a passport or driving licence and photographs or video taken during electronic verification.
- Contact information: email address, telephone number, and residential, business and service addresses.
- Company and role information: the companies you are connected with, your role (for example director, shareholder, secretary or person with significant control), shareholdings and voting rights, and appointment dates.
- Financial information: bank statements and transaction records, invoices, receipts, payroll records, pension information, VAT records, tax returns and calculations, and other accounting records.
- Tax and government identifiers: National Insurance number, Unique Taxpayer Reference, Companies House authentication codes and personal codes, VAT and PAYE references, and similar identifiers.
- Employment information: where we run payroll, employee names, addresses, dates of birth, National Insurance numbers, tax codes, pay, hours, benefits, pension contributions, statutory payments and leave information.
- Communications: the content of emails, messages, enquiry forms and notes of calls and meetings.
- Technical information: when you visit our website, your IP address, browser type, device information and the pages you request, as recorded by our hosting provider for security and operational purposes.
- Marketing preferences: whether you have asked to receive or not receive updates from us.
3. Where we get personal information from
- Directly from you, when you fill in our enquiry form, email or call us, complete onboarding documents, or send us records.
- From our clients, who may give us information about their directors, shareholders, employees, family members, customers and suppliers so we can provide our services.
- From public sources, including the Companies House register, the Insolvency Register, the electoral roll, sanctions lists and other public records.
- From third parties, including HMRC, Companies House, previous accountants (during a professional handover), banks, pension providers, identity verification and credit reference agencies, and your other professional advisers.
- Automatically, through our website hosting provider when you visit this website.
4. How we use personal information and our lawful bases
We must have a lawful basis under the UK GDPR for each way we use personal information. The table below sets out the main purposes and the basis we rely on.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and preparing proposals for our services | Steps taken at your request before entering into a contract; legitimate interests in responding to people who contact us |
| Providing our services, including company formation, bookkeeping, accounts, payroll, VAT, Corporation Tax and other filings | Performance of a contract with you, or legitimate interests where the contract is with the company you are connected with |
| Carrying out identity verification, customer due diligence, sanctions screening and ongoing monitoring | Legal obligation under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 and related law |
| Verifying identity for Companies House on behalf of directors and persons with significant control | Legal obligation; performance of a contract |
| Reporting suspicious activity to the National Crime Agency where required | Legal obligation |
| Keeping business, accounting and client records | Legal obligation; legitimate interests in running our business and defending legal claims |
| Invoicing, collecting fees and managing our relationship with you | Performance of a contract; legitimate interests |
| Running the company name check on our website | Legitimate interests in providing a useful tool to people considering forming a company |
| Operating, securing and improving our website and IT systems | Legitimate interests in keeping our systems secure and working properly |
| Meeting the requirements of our professional body, regulators, insurers and auditors | Legal obligation; legitimate interests |
| Establishing, exercising or defending legal claims | Legitimate interests |
| Sending updates about our services, deadlines and changes in law to clients and contacts | Legitimate interests for existing clients; consent where the law requires it. You can opt out at any time. |
Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms. You can ask us for more information about this balancing.
5. Special category and criminal offence data
Some information is more sensitive and given extra protection by law. We only collect it where it is necessary.
- Health information may be processed when we run payroll (for example statutory sick pay or maternity pay) or where it is relevant to a tax matter. We rely on the conditions relating to employment and social security law, or legal claims, under Article 9 of the UK GDPR and Schedule 1 of the Data Protection Act 2018.
- Information about criminal convictions, allegations or sanctions may be revealed by our anti-money laundering and sanctions checks. We process it because the law requires these checks, relying on the conditions in Schedule 1 of the Data Protection Act 2018 relating to preventing or detecting unlawful acts and regulatory requirements.
- Biometric information, such as facial comparison during electronic identity verification, is processed by our identity verification provider only for the purpose of confirming your identity, and only where you choose that method.
We keep an appropriate policy document setting out how we handle this type of information, as the Data Protection Act 2018 requires.
6. Anti-money laundering and identity checks
Before we act for a client, and periodically during our relationship, the law requires us to verify the identity of the client and of the individuals who own or control it, understand the nature of the business and the source of funds where relevant, and screen against sanctions and politically exposed persons lists. We may use an electronic verification service, which may leave a “soft footprint” on your credit file. This does not affect your credit score.
Information collected for these purposes is used only to prevent money laundering and terrorist financing, unless the law allows otherwise or you have agreed. If we are required to make a report to the National Crime Agency, the law may prevent us from telling you that we have done so.
7. Who we share personal information with
We do not sell personal information. We share it only where necessary, with:
- Government bodies, including Companies House and HMRC, when we file returns or register companies on your behalf, and when they request information we are obliged to provide.
- Service providers who act on our behalf, including our website hosting provider, email and productivity provider (Microsoft 365), form delivery service, accounting, bookkeeping and payroll software providers, cloud storage, identity verification and sanctions screening providers, and IT support. They may only use personal information on our instructions and must keep it secure.
- Your other advisers and connected parties, such as your previous or new accountant during a handover, your bank, pension provider, solicitor or financial adviser, where you ask us to or it is necessary to provide our services.
- Our professional advisers, insurers and auditors, including lawyers and our professional indemnity insurer.
- Regulators and supervisory bodies, including our anti-money laundering supervisor, professional body and the ICO, when they inspect or request information.
- Law enforcement and the courts, including the National Crime Agency, where the law requires or permits it.
- A buyer or successor, if we sell, merge or transfer all or part of our business, subject to confidentiality obligations.
8. International transfers
Most personal information we hold is stored in the UK or the European Economic Area. Some of our service providers may process information in other countries, including the United States. Where personal information is transferred outside the UK, we make sure it is protected by UK adequacy regulations, the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or another safeguard permitted by UK data protection law. You can ask us for more information about the safeguards used.
9. How long we keep personal information
We keep personal information only as long as necessary for the purposes we collected it for, including to meet legal, accounting, tax and regulatory requirements. Typical retention periods are:
| Type of information | Retention period |
|---|---|
| Enquiries that do not lead to an engagement | [12 months] from the last contact |
| Customer due diligence and identity verification records | Five years from the end of the business relationship, as required by the Money Laundering Regulations 2017 |
| Client files, working papers, accounting and tax records | Generally six years from the end of the relevant accounting period or engagement, or longer where a tax enquiry, dispute or claim is ongoing |
| Payroll records | At least three years from the end of the tax year they relate to, and longer where required for pension or statutory payment purposes |
| Invoices and our own financial records | Six years from the end of our financial year |
| Website server logs | As set by our hosting provider, typically no more than [90 days] |
| Marketing preferences | Until you opt out, and a record of the opt-out kept so we respect it |
At the end of the retention period, information is securely deleted or anonymised.
10. How we protect personal information
We use appropriate technical and organisational measures to protect personal information against loss, misuse and unauthorised access. These include encrypted connections to this website, access controls and multi-factor authentication on our systems, restricting access to people who need it, confidentiality obligations on staff and contractors, and due diligence on our service providers.
Email is not a secure way to send sensitive documents. Please don't send identity documents, bank details or other sensitive information through our website enquiry form. When you become a client, we will tell you how to share documents securely.
If a personal data breach occurs that is likely to result in a risk to your rights, we will report it to the ICO within 72 hours where required, and tell you without undue delay if there is a high risk to you.
11. Automated decision-making
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Electronic identity verification tools assist our checks, but any decision not to act for a client is made by a person.
12. Cookies and similar technologies
This website does not use advertising, tracking or analytics cookies, and does not store information on your device. Our fonts are hosted on our own servers, so visiting the site does not send your information to third-party font services. If we introduce analytics or other features that use cookies in future, we will update this notice and ask for your consent where the law requires it.
If you choose to use an optional feature that links to a third-party service, such as an online booking page or a messaging app, that provider's own privacy notice will apply.
13. Our company name check
When you use the company name check, the name you enter is sent from our server to the Companies House public API to search the register. We do not link your search to your identity, and we do not keep a record of searches beyond short-term caching of results and temporary limits on the number of searches from one connection to prevent misuse.
14. Children
Our services are intended for businesses and adults. We do not knowingly collect information directly from children, except where a client gives us information about a family member or employee under 18 for tax or payroll purposes.
15. Your rights
Under UK data protection law you have the following rights. Some apply only in certain circumstances.
- Access: to ask for a copy of the personal information we hold about you.
- Rectification: to ask us to correct information that is inaccurate or incomplete.
- Erasure: to ask us to delete information, where we no longer need it or have no lawful basis to keep it. We may not be able to delete information we are legally required to keep.
- Restriction: to ask us to limit how we use your information while a concern is investigated.
- Objection: to object to our use of your information where we rely on legitimate interests, and to object at any time to direct marketing.
- Portability: to receive information you have given us in a structured, commonly used, machine-readable format, or have it sent to another organisation, where we process it by automated means on the basis of contract or consent.
- Withdraw consent: where we rely on consent, to withdraw it at any time. This does not affect anything we did before you withdrew it.
To exercise any of these rights, email contact@finn6.com. We may need to confirm your identity before responding. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will tell you why. There is normally no fee.
Some rights are limited where information is held for anti-money laundering purposes, or where disclosure would prejudice the prevention or detection of crime or breach our duty of confidentiality to a client.
16. If you don't provide information
Where we need information to meet a legal obligation, such as identity verification, or to perform a contract with you, we may be unable to act for you or continue our services if it is not provided.
17. Complaints
If you have a concern about how we handle personal information, please contact us first at contact@finn6.com so we can try to resolve it. We will acknowledge your complaint and respond without undue delay.
You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113.
18. Changes to this notice
We may update this notice from time to time to reflect changes in the law, our services or how we handle personal information. The date at the top shows when it was last updated. Where changes are significant, we will tell clients directly.
19. Contact us
Finn6 Solutions Limited, company number 17033842.
Email: contact@finn6.com