Privacy notice
How Second Line Advisory collects, uses and protects personal data.
Last updated: 7 November 2026
Who we are
Impact AI Analytics Ltd, trading as Second Line Advisory ("Second Line Advisory", "we", "us"), is committed to protecting your privacy. This notice explains what personal data we collect, why we collect it, how we use and share it, how long we keep it, and the rights you have over it.
Second Line Advisory provides specialist tax, VAT, finance and practice-support services to UK accountancy practices, delivered under the practice's own name, together with help for practices on their own systems, processes and use of AI.
Impact AI Analytics Ltd is registered in England and Wales under company number 11464338 with its registered office at Suite 7, Aldershot Enterprise Centre, 14-40 Victoria Road, Aldershot, GU11 1TQ.
We act as the data controller for personal data we collect from visitors to our website (secondlineadvisory.co.uk), from practices and businesses that enquire about or use our services (including through our contact form and our Microsoft Bookings booking page), from suppliers and professional contacts, and from anyone who signs up to receive our communications. Where we process personal data on a practice's instructions, including personal data contained in a client question sent to us for a free technical steer, we act as a data processor (see Client data we process on your behalf below).
We process personal data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
Questions about this notice: info@secondlineadvisory.co.uk.
What information we collect
We collect personal data when you visit our website, request a download or guide, enquire about or buy our services, work with us as a supplier or partner, or otherwise deal with us.
Depending on your relationship with us, this may include:
- Name, job title, organisation and contact details (email address, telephone number, postal address)
- Business information about your organisation, including the accounting, data and software systems you use
- Billing details and payment records
- Records of our communications with you, including emails, calls, support tickets and meeting notes
- Information you give us when you request a guide, checklist or other resource
- Marketing preferences and consent records
- Technical data when you contact us or book a call through Microsoft 365 services (for example your email address and the time of your booking)
We may also receive personal data about you from:
- Companies House and other public registers
- Your organisation, where it engages us on behalf of its staff
- Software platforms you give us access to in the course of an assignment (for example Xero, QuickBooks or Sage), only to the extent you authorise
- Identity verification, credit reference and fraud prevention agencies, where required
If you give us personal data about other people (for example your colleagues or your clients), you must make sure you have a lawful basis to share it with us.
How we use your information and our lawful basis
We only use your personal data where the law allows us to. The table below sets out each purpose and the lawful basis we rely on.
| Purpose | Lawful basis |
|---|---|
| Delivering our services, tools and support to you or your organisation | Performance of a contract |
| Managing engagements, billing and payments | Performance of a contract |
| Responding to enquiries made by web form, email, telephone or chat | Legitimate interests |
| Sending you a guide, download or resource you requested | Performance of a contract / legitimate interests |
| Sending marketing about our services, content and events | Consent, or legitimate interests where you are an existing client or have enquired about our services (soft opt-in) |
| Improving our website, services and resources | Legitimate interests |
| Identity verification, anti-fraud and credit checks | Legal obligation / legitimate interests |
| Keeping our systems, data and premises secure and preventing misuse | Legitimate interests |
| Managing suppliers, partners and professional contacts | Performance of a contract / legitimate interests |
| Handling complaints and disputes, and establishing or defending legal claims | Legitimate interests |
| Meeting legal, regulatory and tax obligations, including responding to HMRC, the ICO or a court | Legal obligation |
| Keeping business records for administration and audit | Legitimate interests / legal obligation |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can object to any processing based on legitimate interests (see Your rights).
We do not use personal data to make automated decisions that have legal or similarly significant effects on you, and we do not use your personal data to train AI models. Where AI tools assist our work, outputs are reviewed by a qualified person before they are relied on.
Client data we process on your behalf
When you send us a client question, ask us to review a computation or draft advice, give us access to accounting or finance systems, or ask us to clean, migrate or analyse data, we handle the personal data involved as a data processor on your instructions. You (or your organisation) remain the data controller for it.
That data may include personal data about your customers, suppliers, employees and clients, such as names, contact details, invoice and payment records.
For this processing:
- We act only on your documented instructions, set out in our engagement terms and data processing agreement
- We use sub-processors (for example cloud hosting and AI model providers) under written contracts, and we keep a current list available on request
- We do not use client data to train AI models
- We return or delete client data at the end of the engagement, in line with your instructions
- We help you respond to data-subject requests and regulator enquiries that relate to that data
If you are an individual whose data is held in one of our clients' systems, please contact that client first; we will support them in responding to you.
How long we keep your data
We keep personal data only for as long as we need it for the purpose it was collected, to meet our legal and contractual obligations, or to deal with any claims.
| Category | Retention period | What happens at the end |
|---|---|---|
| Client engagement records, contracts and correspondence | 6 years from the end of the engagement | Secure deletion |
| Invoices, payments and other financial records | 6 years from the end of the financial year they relate to | Secure deletion |
| Client data processed on your instructions (processor role) | Duration of the engagement, then up to 30 days | Returned to the client or securely deleted on instruction |
| Enquiries and prospects who do not become clients | 24 months from last contact | Secure deletion |
| Marketing consent and preference records | Until consent is withdrawn, plus a suppression record | Suppression list retained |
| Identity verification and anti-fraud records | 5 years from the end of the relationship | Secure deletion |
| Supplier and partner records | 6 years from the end of the relationship | Secure deletion |
We may keep data longer where a legal hold, dispute or regulatory investigation requires it. Where we no longer need to identify you, we may anonymise data and keep it for statistical and product-improvement purposes.
How we share your information
We never sell personal data. We share it only where necessary to run our business, deliver our services or meet a legal duty, with:
- Cloud hosting, storage and infrastructure providers
- AI tools used to assist our work, under contracts that restrict use of your data and prohibit training on it
- Microsoft 365 (Outlook, Teams and Bookings), which we use for email, calls, bookings and document storage, and our email-sending platform
- Software platforms you give us access to for an assignment (for example Xero, QuickBooks or Sage)
- Our group and associated businesses, where they help deliver services to you
- Professional advisers, including accountants, lawyers and insurers
- Identity verification, credit reference and fraud prevention agencies
- HMRC, the ICO, courts and other regulators or law enforcement bodies where required by law
- A prospective buyer or investor, in the event of a sale, merger or restructure of our business
Every service provider that processes personal data for us does so under a written contract that requires them to keep it secure and use it only on our instructions.
International data transfers
Some of our providers, including cloud and AI platforms, store or process data outside the United Kingdom, most commonly in the European Economic Area and the United States.
Where personal data leaves the UK, we make sure it is protected by one of the following:
- A UK adequacy regulation covering the destination country
- The UK Data Bridge (for US providers certified under the EU-US Data Privacy Framework)
- The UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses
- Another safeguard permitted under UK GDPR
You can ask us for details of the safeguards in place for a specific transfer using the contact details at the end of this notice.
Marketing and how to opt out
We may send you information about our services, guides and resources by email, and occasionally by post or telephone.
We send email marketing to you if you have consented, or if you are an existing client or have enquired about our services and have not opted out (the "soft opt-in" under PECR). We may also contact accountancy practices by email about services relevant to their role, relying on our legitimate interests; where the practice is a sole trader or partnership we will only do so with consent. You can opt out at any time.
You can opt out at any time by clicking the unsubscribe link in any email or by emailing info@secondlineadvisory.co.uk. We will add you to a suppression list so you are not contacted again, and opting out will not affect any service you receive from us.
We do not share your details with third parties for their own marketing.
How we keep your information secure
We apply technical and organisational measures appropriate to the risk, including:
- Encryption of data in transit and at rest
- Role-based access controls and multi-factor authentication for our systems
- Secure, access-controlled cloud infrastructure with logging and monitoring
- Regular backups and tested recovery procedures
- Staff training on data protection and information security, with confidentiality obligations in employment and contractor agreements
- Written contracts with all providers that process personal data for us
- Regular review of our security policies and of the AI tools and models we use
No system is completely secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will tell you and the ICO as the law requires.
Your rights
Under UK GDPR you have the following rights over your personal data:
| Right | What it means |
|---|---|
| To be informed | To know how we use your data (this notice) |
| Access | To get a copy of the personal data we hold about you |
| Rectification | To have inaccurate or incomplete data corrected |
| Erasure | To have your data deleted in certain circumstances |
| Restriction | To ask us to pause processing while an issue is resolved |
| Portability | To receive data you gave us in a structured, machine-readable format |
| Objection | To object to processing based on legitimate interests, and to direct marketing at any time |
| Automated decisions | Not to be subject to a solely automated decision with legal or similarly significant effects |
| Withdraw consent | To withdraw consent at any time where consent is our lawful basis |
These rights are not absolute. We may need to keep certain data to meet a legal obligation or to defend a claim, and we will explain this if it applies.
To exercise a right, email info@secondlineadvisory.co.uk with the right you wish to exercise and the data it concerns. We may ask you to confirm your identity. We will respond within one month; for complex requests we may extend this by up to two further months and will tell you if so.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.
Cookies
Our website does not set cookies and does not use analytics or advertising tracking. If that changes, we will update this notice and, where required, ask for your consent first.
Children's data
Our services are for businesses and professionals and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email info@secondlineadvisory.co.uk and we will delete it.
Other websites and services
Our website may link to third-party sites and services, including Microsoft Bookings. This notice covers only Second Line Advisory. Those third parties have their own privacy policies, and we are not responsible for how they use your data.
Changes to this notice
We review this notice regularly and update it when our practices or the law change. The date at the top shows when it was last updated. Significant changes will be posted on our website and, where appropriate, notified to you by email. Earlier versions are available on request.
How to contact us
For any questions about this notice, to exercise your rights, or to raise a concern about how we handle your data:
Data Protection Lead: Idrees Muhammad, Impact AI Analytics Ltd, trading as Second Line Advisory, Suite 7, Aldershot Enterprise Centre, 14-40 Victoria Road, Aldershot, GU11 1TQ
Email: info@secondlineadvisory.co.uk · Website: secondlineadvisory.co.uk