The Flexible PA

Privacy Notice

Privacy Notice - Last Updated 31.08.26

 

Who we are

This is the privacy notice of The Flexible PA Ltd (referred to as "we", "us" and "our"). We are a company registered in Scotland with company number SC885256 and registered office at Tax Assist Accountants, 2 Biggar Road, Fairmilehead, Scotland EH10 7QBQ. Our trading name is "The Flexible PA" and our website is www.theflexiblepa.com.

We provide virtual assistant and personal assistant services to businesses. This notice explains what personal data we collect, why we collect it, and what we do with it.

For questions about this notice, please contact us at cl****@***********pa.com.

About this notice

This notice describes how we handle personal data as a data controller, that is, personal data for which we decide the purposes and means of processing. It covers information about our website visitors, prospective clients, clients, suppliers and associates.

When we deliver services to our clients we may also process personal data on their behalf, for example, a client's contacts, customers or prospects. Where we do this we act as a data processor for the client, who is the controller. That processing is governed by our services agreement and separate data processing terms with the client, and is not covered by this notice.

Personal data we collect

Website visitors

  • Technical information about your visit (IP address, browser type, pages viewed, device type) collected via cookies and analytics tools.
  • Any information you submit through the website, for example via a contact form, enquiry form or newsletter signup.

Prospective clients

  • Your name, business name, email address and phone number.
  • Any information you provide when discussing a possible engagement.
  • Our records of communications with you.

Clients

  • Your name, business name and contact details, and those of any individuals we deal with in the course of the engagement.
  • Billing and payment information (your invoicing address; your bank details if you provide them).
  • Records of our communications and of services delivered.

Suppliers and associates

  • Contact details, contract information, and records of our engagement.

Where we get this data

Most of the personal data we hold comes directly from you, when you visit our website, submit an enquiry, or engage our services. Some data may come from third-party sources (such as LinkedIn or a referral from an existing contact) where the information has been shared with us or made public.

Why we use it and our lawful basis

Under UK GDPR we must have a lawful basis for processing your personal data. The bases we rely on are set out below.

Purpose Lawful basis
Responding to enquiries from prospective clients Legitimate interests
Providing services to you as our client Performance of a contract
Sending invoices and taking payment Performance of a contract; legal obligation (accounting records)
Keeping records for tax and accounting purposes Legal obligation
Sending marketing about our services (existing clients only, unless you have opted in) Legitimate interests; or consent where you have opted in
Running and improving our website Legitimate interests
Complying with legal, regulatory or professional obligations Legal obligation

Who we share it with

We share personal data with the following categories of recipient:

  • Our associates (virtual assistants working with us) where necessary to deliver your services. Associates are contractually bound to confidentiality and data protection obligations, and act as our sub-processors where they handle personal data on behalf of a client.
  • Our professional advisers: accountant, lawyer, insurance broker, where necessary.
  • Software and service providers who help us run our business (see below).
  • Regulators, authorities and other third parties where legally required.

We do not sell personal data.

Software and service providers

We use the following third-party services to run our business:

  • Email/documents and file storage: Google Workspace
  • Accounting: FreeAgnet
  • CRM: Trello
  • Scheduling: Calendly
  • Communications: Whatsapp, Zoom, Google Meet, Google Chat,
  • Email Marketing: Mailerlite
  • Content Creation: Canva
  • Social Media: Instagram, Facebook, Edits, LinkedIn
  • Analytics: Google Analytics
  • Website: WordPress

International transfers

Some of our software and service providers may process personal data outside the United Kingdom. Where we transfer personal data to a country that is not covered by UK adequacy regulations, we rely on one of the following safeguards to protect it:

  • The UK International Data Transfer Agreement (IDTA); or
  • The UK Addendum to the EU Standard Contractual Clauses; or
  • Any other transfer mechanism permitted under Article 46 of UK GDPR.

For details of the specific safeguards in place for any transfer, please contact us at cl****@***********pa.com

How long we keep it

We keep personal data only for as long as we need it. Our default retention periods are:

  • Website enquiries where we do not proceed: 12 months.
  • Client records (including communications) after the end of our engagement: 6 years.
  • Invoicing and accounting records: 6 years (HMRC minimum).
  • Marketing preferences (including unsubscribes): retained indefinitely so that we can honour opt-outs.
  • Website analytics data: 26 months (Google Analytics default).

Your rights

Under UK GDPR you have the following rights in relation to your personal data:

  1. The right to be informed - you have the right to know what personal data we hold about you and how we use it. This notice provides that information.
  2. The right of access - you may ask for a copy of the personal data we hold about you.
  3. The right to rectification - if the data we hold about you is inaccurate or incomplete you may ask us to correct it.
  4. The right to erasure - you may ask us to delete personal data we hold about you, in certain circumstances.
  5. The right to restrict processing - you may ask us to stop using your data in certain circumstances.
  6. The right to data portability - where we hold data on the basis of consent or contract, you may ask us to provide it in a structured, portable format.
  7. The right to object - you may object to us processing your data where we rely on legitimate interests, and you may object to direct marketing at any time.
  8. Rights in relation to automated decision-making and profiling - you have the right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. We do not carry out this kind of automated decision-making.

To exercise any of these rights, please contact us at cl****@***********pa.com. We will normally respond within one month. If we decide not to take action in response to your request, we will explain why and let you know about your right to complain to us directly and to the UK data protection regulator (see "How to complain" below).

Your right to complain

Separately from the rights above, you have a statutory right under the Data Protection Act 2018 to complain to us directly if you consider that we have failed to comply with data protection law in the way we have handled your personal data. See "How to complain" below.

Cookies

Our website uses cookies. For details of the cookies we use and how to manage your preferences, please see our cookie policy.

Marketing

We may occasionally send you information about our services if you have signed up to receive it, or if you are an existing client and we consider the information relevant to you. You can opt out at any time by clicking "unsubscribe" in any of our marketing emails or by contacting us directly.

How to complain

If you are unhappy with how we have handled your personal data, you can complain to us directly or to the UK data protection regulator. You can complain to either at any time, but we encourage you to raise the concern with us first so we have the opportunity to put it right.

Complaining to us

You can make a data protection complaint by:

  • Email: cl****@***********pa.com
  • Post: Tax Assist Accountants, 2 Biggar Road, Fairmilehead, Scotland EH10 7QBQ , marked "Data protection complaint"

We will acknowledge your complaint within 30 days of receiving it. We will then investigate the complaint without undue delay, keep you informed of our progress, and let you know the outcome.

Complaining to the Information Commission

You also have the right to complain to the Information Commission (previously known as the Information Commissioner's Office, or ICO), the UK data protection regulator:

  • Website: ico.org.uk/make-a-complaint
  • Helpline: 0303 123 1113
  • Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Changes to this notice

We may update this notice from time to time. If we make significant changes we will let you know either by email or by posting a notice on our website. This notice was last updated on the date shown at the top of this document.