Privacy Policy

We handle financial data, which is among the most sensitive information a business holds. We treat it accordingly: it is encrypted at rest and in transit, accessible only to named people bound by signed non-disclosure agreements, and never shared with any outside party without a confidentiality contract in place and, where an external party is involved, your prior written consent.

The Standard Solutions is the data controller for the information you provide. Questions about this policy, or about your data, go to [email protected].

1. Information we collect

• From website enquiries. Your name, email address, telephone number and a description of the services you need, submitted through our contact form or by email.
• From active clients. To deliver our services we process financial records including bank statements, invoices, receipts, payroll data, tax identification numbers and supporting documentation. We request this only once an engagement letter is in place, and only through secure channels we have agreed with you.
• Due diligence records. Identification documents, proof of address and ownership information collected to meet our client due diligence obligations.

We do not collect special category personal data, and we ask that you do not send it to us.

2. Why we process it, and on what basis

Purpose	Lawful basis
Delivering contracted bookkeeping, accounting, payroll and tax services	Performance of a contract
Billing, invoicing and collecting payment	Performance of a contract
Responding to enquiries and client correspondence	Legitimate interests
Client due diligence and anti-money-laundering screening	Legal obligation
Retaining records after an engagement ends	Legal obligation

We do not currently send direct marketing. If that changes we will seek your explicit consent first, and you will be able to withdraw it at any time.

3. How your data is protected

This is the part of the policy that matters most, so it is set out in full.

• Encrypted devices. All work is performed on encrypted devices with full-disk encryption enabled. Devices are password-protected and locked when unattended.
• Encrypted cloud storage. Client records are held on encrypted cloud work drives. We do not store client financial data on personal devices, removable media or unencrypted local folders.
• Two-factor authentication. Two-factor authentication is enabled on every platform that holds or touches client data, including accounting software, cloud storage and email.
• Access control. Access is granted on a need-to-know basis. Only the team members assigned to your engagement can reach your files. Access is reviewed when team members join, change role or leave, and is revoked immediately on departure.
• Non-disclosure agreements. Every member of our team signs a confidentiality and non-disclosure agreement before being given access to any client data. The obligation continues after they stop working with us.
• Secure transmission. Sensitive documents are exchanged through secure cloud links rather than as email attachments wherever possible.
• No casual disclosure. We do not hand client data to anyone outside the firm on request, informally, or as a convenience. Disclosure happens only in the limited circumstances set out below, and only with a contract behind it.

4. Who we share data with

We do not sell your personal data, and we do not share it for anyone else’s marketing. Sharing is limited to the following.

• Infrastructure providers. We use third-party platforms for encrypted cloud storage and communication, such as Google Drive, Dropbox, OneDrive, Gmail and Slack. These providers process data on our instructions under their own contractual and security commitments. They do not access your records for their own purposes.
• Client-directed software. We work inside the accounting platforms you have granted us access to, such as Xero, QuickBooks Online and Zoho Books. Your data in those platforms remains under your control and your contract with that provider.
• Our own team. Team members assigned to your engagement, each bound by a signed non-disclosure agreement. No separate consent is needed for our own staff.
• External subcontractors. We will not give an external subcontractor access to your data without your prior written consent. Any subcontractor must sign a confidentiality and non-disclosure agreement before access is granted, and is permitted to see only what the specific task requires.
• Legal requirement. We may disclose information where the law compels us to, including to tax authorities, regulators or law enforcement. Where a report of suspicion is required, we may be prohibited by law from telling you.

5. International transfers

Your data is processed by us in Pakistan. Where we use cloud providers, data may be stored on servers in other countries, subject to those providers’ own safeguards. For clients in the UK or EU, we rely on the providers’ standard contractual clauses or equivalent transfer mechanisms. You may ask us for details of the arrangements covering your data.

6. How long we keep it

We retain client records for the duration of the engagement and for six years after it ends. Six years matches the record-keeping periods required under Pakistani tax law and under UK company and VAT rules, which cover the jurisdictions most of our clients operate in.

Enquiry data from people who do not become clients is deleted within 12 months.

After the retention period, records are securely deleted from our systems and cloud drives.

7. Your rights

Depending on where you are located, you may have the right to:

• Access a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have data erased, subject to our legal retention obligations
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent where processing is based on it

To exercise any of these, email [email protected]. We will respond within 30 days. There is no charge unless a request is manifestly unfounded or excessive.

Clients in the UK may also complain to the Information Commissioner’s Office. We would ask you to raise the matter with us first so we can put it right.

8. Cookies

Our website uses only the functional cookies set by our website hosting platform, which are necessary for the site to load and display correctly. We do not use advertising cookies, and we do not operate analytics that track individual visitors across sites. You can block or delete cookies in your browser settings, though parts of the site may then not display properly.

9. Data breaches

If a breach occurs that is likely to affect your rights, we will notify you without undue delay and, where required, notify the relevant supervisory authority within 72 hours of becoming aware of it.

10. Changes to this policy

We may update this policy. The current version is always published on our website with its effective date. We will notify active clients by email of any change that materially affects how their data is handled.