TTAM Ltd
PRIVACY NOTICE

Introduction
The Data Protection Act 2018 (“DPA 2018”) and the General Data Protection Regulation (“GDPR”) impose certain legal obligations in connection with the processing of personal data.
 Last updated: 15/11/2025
We may amend this privacy notice from time to time. If we do so, we will notify you by email or publish the updated version on our website at www.ttam.ltd.
TTAM Ltd is the data controller within the meaning of the GDPR and we process personal data. The firm’s contact details are as follows: Marlwood Drive, Bristol, BS10 6SH. For any data protection queries, contact us at ttam.smarttax@gmail.com or call +44 (0) 7887 04 3020. The Data Protection Officer is Tervel Mihaylov.
We may amend this privacy notice from time to time. If we do so, we will supply you with and/or otherwise make available to you a copy of the amended privacy notice.
Where we act as a data processor on behalf of a data controller (for example, when processing payroll), we provide an additional schedule setting out required information as part of that agreement. That additional schedule should be read in conjunction with this privacy notice.
Purposes for Which We Intend to Process Personal Data
We intend to process personal data for the following purposes: To enable us to supply professional services to you as our client.
•	To fulfil our obligations under applicable laws and regulations, including the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (as amended).
	
•	To comply with professional obligations to which we are subject as a member of the Association of Accounting Technicians (AAT).To investigate and/or defend potential complaints, disciplinary proceedings, or legal claims.
•	To issue invoices for our services and resolve any related fee disputes.
•	To contact you about other services we offer that may be of interest to you, where you have provided consent.
•	To maintain accurate client records and ensure effective communication.
•	To manage and improve our business operations and service delivery.
Legal Bases for Processing Personal Data
Our processing of personal data is based on the following legal grounds: Consent: Where you have provided clear and informed consent for us to process your personal data for specific purposes.
•	Contractual necessity: The processing is necessary for the performance of our contract with you.
•	Legal obligation: The processing is required to comply with legal obligations to which we are subject (e.g., MLR 2017).
•	Legitimate interests: The processing is necessary for our legitimate interests, including: 
•	Investigating or defending legal claims.
•	Ensuring the efficient delivery of services.
•	Preventing fraud and safeguarding our business.
Please note that it is a condition of our engagement that you provide the personal data we request. Failure to do so may prevent us from providing services or continuing our engagement.

•	Categories of Personal Data Collected
•	Where applicable, we may collect the following categories of personal data:
•	Identity data (e.g., name, date of birth, national insurance number)
•	Contact details (e.g., address, email, phone number)
•	Financial information (e.g., bank details, income, tax records)
•	Employment and business details
•	Special category data (e.g., health or biometric data), only where necessary and with appropriate safeguards
Source of Personal Data
•	We may obtain personal data directly from you or from third parties, including:
•	HMRC and other government bodies
•	Publicly accessible sources (e.g., Companies House)
•	Referrals from other professionals or service providers
•	Your employer or business contacts (where relevant)
Persons/Organisations to Whom We May Disclose Personal Data
We may share your personal data with the following parties where necessary for the purposes outlined in this notice, and in accordance with applicable data protection laws:
•	HM Revenue & Customs (HMRC)
•	Any third parties with whom you instructor permit us to correspond
•	Subcontractors engaged to support the delivery of our services
•	An alternate appointed by us in the event of incapacity or death
•	Tax insurance providers
•	Professional indemnity insurers
•	Our professional body, the Association of Accounting Technicians (AAT), and/or the Office of Professional Body Anti-Money Laundering Supervisors (OPBAS), in connection with practice assurance and compliance with the Money Laundering Regulations 2017 (as amended)
•	[Any other recipients relevant to your practice, e.g., software providers, legal advisers]
•	Where required or permitted by law, we may also share your personal data with:
•	The police and other law enforcement agencies
•	Courts and tribunals
•	The Information Commissioner’s Office (ICO)
We may need to share your personal data with the third parties listed above to comply with our legal obligations, including obligations owed to you. If you ask us not to share your personal data with these parties, we may be unable to continue providing services.

Transfers of Personal Data Outside the UK and EEA
Your personal data will be processed within the UK and the European Economic Area (EEA) only. We do not transfer personal data outside these regions. If this changes, we will update our privacy notice and ensure appropriate safeguards are in place in accordance with UK GDPR.
Retention of Personal Data
As a data controller, and in line with recognised good practice in the accountancy and tax sector, we retain records relating to you as follows:
•	Tax return preparation: Information is retained for 7 years from the end of the tax year to which it relates.
•	Ad hoc advisory work: Information is retained for 7 years from the date the business relationship ceased.
•	Ongoing client relationships: Data required for multi-year compliance (e.g., capital gains base costs, claims and elections submitted to HMRC) is retained throughout the relationship and deleted 7 years after the relationship ends, unless you request a longer retention period.
•	Our contractual terms provide for the destruction of documents after 7 years, and acceptance of these terms is taken as agreement to this retention and destruction period.
•	You are responsible for retaining any information we send to you, including capital gains base costs and claims/elections submitted to HMRC. These documents will be provided in the format agreed between us.

Legal Retention Requirements for Clients
You are required by law to retain records relevant to your tax affairs as follows:
Individuals, trustees, and partnerships:
•	With trading or rental income: 5 years and 10 months after the end of the tax year
•	Otherwise: 22 months after the end of the tax year
Companies, LLPs, and other corporate entities:
•	6 years from the end of the accounting period
Where We Act as a Data Processor
Where we act as a data processor (as defined under the Data Protection Act 2018), we will delete or return all personal data to the data controller as agreed—typically at the termination of the contract, unless otherwise specified.
Your Rights Under Data Protection Law
Requesting Personal Data We Hold About You (Subject Access Requests – SARs)
You have the right to request access to the personal data we hold about you. These requests are known as Subject Access Requests (SARs).
To make a SAR, please submit your request in writing, marked for the attention of:
Tervel Mihaylov MAAT
TTAM LTD
7 Marlwood Drive, Bristol BS10 6SH
Email: ttam.smarttax@gmail.com
To help us respond promptly and accurately, please include sufficient details to verify your identity and locate the relevant information. For example:
•	Your date of birth
•	Any previous or other names you have used
•	Your previous addresses within the past five years
•	Any personal reference numbers we Categories of Personal Data may have issued (e.g., National Insurance number, tax reference, VAT registration number)
•	A description of the information you are requesting
•	If you do not have a National Insurance number, please include:
•	A copy of the back page of your passport or your driving licence
•	A recent utility bill showing your current address
We will respond to SARs within one month of receipt. In certain cases, we may refuse a request (e.g., if a similar request was recently fulfilled and no significant changes have occurred). We do not charge for handling SARs.
You may authorise someone else (e.g., a solicitor, friend, or relative) to make a SAR on your behalf. In such cases, we require written authorisation signed by you.
If we act as a data processor on your behalf (e.g., for payroll services), we will assist you with SARs in accordance with the same principles.
Correcting Your Data (Right to Rectification)
You have the right to request correction of any inaccurate personal data we hold about you, and to have incomplete data completed. Please notify us immediately if you believe any data we hold is incorrect or incomplete.
Deleting your records (the right to erasure)
You may request the erasure of your personal data in certain circumstances. We will consider your request and respond accordingly. If we are unable to comply, we will explain the reasons. More information is available on the ICO website.
Restricting or Objecting to Processing
You have the right to request that we restrict the processing of your personal data or object to its processing in certain circumstances. Please contact us if you wish to exercise this right. Further details are available on the ICO website.
Data Portability
You may request a copy of your personal data in a machine-readable format, where:
The data was provided by you
Processing is based on consent or contract
Processing is carried out by automated means
We will respond within one month, or within two months if the request is complex. We will notify you if an extension is needed.
Withdrawal of Consent
Where processing is based on your consent, you may withdraw that consent at any time. Please note:
Withdrawal does not affect the lawfulness of prior processing
We may be unable to continue providing services if consent is withdrawn
We may still process your data under another lawful basis (e.g., legal obligation)
Automated Decision-Making
We do not use automated decision-making in relation to your personal data.
Complaints
If you are dissatisfied with our response to a data request or believe we have not complied with data protection law, you may:
Contact us directly at ttam.smarttax@gmail.com
Lodge a complaint with the Information Commissioner’s Office (ICO) via www.ico.org.uk