1. About this policy
This policy explains how we handle personal data, both when you use this website or get in touch, and when we provide our services. We handle personal data in line with the UK GDPR and the Data Protection Act 2018.
If you’re a client, you’ll also receive this notice as part of our engagement letter.
2. Who we are
Cyfri Cyfrifwyr Cyfyngedig, trading as PJE Accountants & Advisors. Registered in England and Wales, company number 04993371. ICO registration number Z200756X.
Offices in Aberaeron, Aberystwyth and Lampeter. Main office: 23 College Street, Lampeter, SA48 7DY.
We’re the data controller for the personal data we process. For any data protection question, contact Llyr Gwyn Davies, Director and MLRO, at post@pje.co.uk or on 01570 422 451.
3. Anti-money laundering statement
The law requires us to check the identity of our clients, and in some cases the people connected to them, before we act. Any personal data we receive for these checks will be processed only for the purposes of preventing money laundering, terrorist financing or proliferation financing, unless another law allows us to use it or you have agreed to a different use.
We won’t use it for marketing or any other purpose.
4. The personal data we collect
- identification data, such as name, date of birth and National Insurance number
- contact details, such as address, email and telephone number
- financial information, such as income, bank details and tax information
- business information, such as company details and transactions
- identity verification data, such as passports, driving licences and proof of address
- records of our communications with you
- technical data, such as IP address and login details for our client portals
- through this website: the details you give us in our message and booking forms (such as your name, email, phone number and what you’d like to discuss), and basic technical data our hosting provider records to keep the site secure, such as your IP address
5. Sensitive information
Some of our checks can involve more sensitive information. Screening against sanctions lists, politically exposed persons lists and adverse media can reveal information about public roles or criminal matters, and our identity checks may compare a photo of you with your ID document (a biometric check).
We only process this kind of information where the Data Protection Act 2018 allows it, mainly for preventing money laundering, fraud and other unlawful acts, and with additional safeguards in place.
6. Where we get your data
- you directly, including through this website’s forms
- your representatives, such as employees or advisers
- HMRC, Companies House, banks and the software providers we use for your work
- identity verification providers and credit reference agencies, as part of electronic identity checks
- publicly available sources where relevant
7. Why we use it, and our legal basis
- To reply to your enquiry and arrange a consultation when you contact us through the website: to take steps at your request before entering into a contract, or for our legitimate interests.
- To provide our services under our contract with you.
- To meet our legal and regulatory obligations, including anti-money laundering checks, record keeping and reporting to authorities where required.
- For our legitimate interests in managing our relationship with you, keeping our records and systems secure, improving our services and establishing or defending legal claims. We only rely on this where it doesn’t override your own interests and rights.
- With your consent where it’s needed, such as for marketing emails. You can withdraw consent at any time.
8. If you don’t provide it
Some information is a legal requirement, such as the identity information we need before we can act for you, and some is needed to deliver the work. If it isn’t provided, we may not be able to take you on or complete the work.
9. Automated decisions
We don’t make decisions about you based solely on automated processing. Electronic identity checks produce a result, but a member of our team reviews any result that needs it before a decision is made.
10. Who we share it with
- HMRC, the Welsh Revenue Authority, Companies House and other public bodies, as your work requires
- our professional body and anti-money laundering supervisor
- our professional advisers and insurers
- service providers who process data for us, including our cloud accounting, practice management, document storage and identity verification systems
- Web3Forms, which delivers the messages and booking requests you send through our website forms to us by email, and keeps a copy for a limited time before deleting it
- subcontractors or specialists engaged to help deliver your work
- law enforcement or regulatory authorities where the law requires it
Our service providers act on our instructions under written agreements and must keep your data secure.
11. Transfers outside the UK
Some of our providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or approved contractual safeguards, such as the international data transfer agreement or addendum. You can ask us for details of the safeguards that apply.
12. How we keep it secure
We use access controls, encryption where appropriate, secure cloud systems and staff training and confidentiality obligations. No system is completely secure, but we take the steps you’d expect to protect your data.
13. How long we keep it
- Anti-money laundering records, including identity documents: five years after our relationship ends, then deleted, unless another law requires us to keep them, they’re needed for legal proceedings, or you agree to us keeping them.
- Other client records: generally six years after our relationship ends, and longer where the law or an ongoing matter requires it.
- Website enquiries that don’t lead to work: one week, then deleted.
- Marketing preferences: until you tell us to stop.
14. Your rights
You have the right to:
- access your personal data
- have inaccurate data corrected
- have data erased, in certain circumstances
- restrict or object to processing
- have data transferred to you or another organisation
- withdraw consent where we rely on it
- complain to us, and to the ICO
Some rights are limited where we must keep data for legal or regulatory reasons, including anti-money laundering records. To use any of these rights, contact us using the details above.
15. Cookies
This website doesn’t use cookies for advertising, tracking or analytics, and doesn’t load social media feeds. Our hosting provider may set a strictly necessary cookie to keep the site secure; it doesn’t identify you. If we ever add analytics, we’ll ask for your consent first and update this policy.
We use Cloudflare Web Analytics to count visits and see which pages are read. It doesn’t use cookies or store anything on your device, and it doesn’t identify you.
Our Find us page asks before showing maps from Google Maps. If you agree, Google may set its own cookies, under Google’s privacy policy. Your choice is kept in your browser, and you can change it here.
16. Links to other websites
Our website links to other websites, such as our social media pages and Google reviews, and to Cyfri Cyfyngedig for financial planning. Cyfri Cyfyngedig is a separate company with its own privacy notice. We’re not responsible for how other websites handle your data, so please read their privacy notices.
17. Complaints
If you’re unhappy with how we’ve handled your personal data, please tell us first by emailing post@pje.co.uk or writing to our Lampeter office. We’ll acknowledge your complaint within 30 days, look into it and let you know the outcome.
You can also complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.
18. Changes to this policy
We’ll update this policy when our practices or the law change, and post the latest version here. Version: October 2026.
Questions about this page? Email post@pje.co.uk or call 01570 422 451.