How Forest Finance handles privacy.

Who is responsible for your information

Forest Franchise Limited (company number 17336808) operates this central Forest Finance network website. Its registered office is C/O Forest Finance Vision Centre, 5 Eastern Way, Bury St Edmunds, Suffolk, United Kingdom, IP32 7AB.

Forest Finance is the customer-facing brand used by participating accountancy practices. Forest Franchise Limited controls central website enquiries, website analytics, central marketing and lead routing. It also uses appropriate information for network administration, attribution, support, quality and compliance oversight.

When an enquiry is allocated to and accepted by a particular Forest Finance practice, that practice normally acts as an independent controller for its prospect and client relationship, professional work and client records. Your proposal and engagement letter identify the legal practice responsible for your services. Forest Finance Ltd is the original practice within the network; it is not automatically the provider for every client.

Jake Bailey is the Data Protection Officer for Forest Franchise Limited and the central website/network privacy function. For privacy questions, complaints or rights requests, email info@forest-finance.co.uk. Central Office can help identify the relevant practice.

Information we collect and where it comes from

Central website enquiries may include your name, email, telephone number, business type, business or company details, company number, occupation or trade, services needed, enquiry text, referral/campaign source and privacy or marketing choices. Location, preferred contact method or preferred accountant may be included where provided and relevant to routing.

Technical information may include IP address, device and browser details, form and security logs, and cookie or analytics information according to the technologies used and your choices. Information comes from you, your use of the website and, where relevant, the person who refers you or the practice handling your enquiry. Company verification may use public Companies House records.

If you engage a practice, it may need additional details such as address and date of birth, UTR and National Insurance number, tax references, director/shareholder/PSC details, identity and AML/KYC records, bank statements, invoices, receipts, accounting and tax records, payroll information, signed engagement documents and HMRC/Companies House authorisations. Relevant information may be supplied by you, your authorised representatives, your previous accountant or public and verification sources. The practice explains its own processing in its privacy information.

Please provide only information relevant to your enquiry. Essential contact and business details are needed to respond and route it. Further information may be required for an engagement or a legal duty; the practice will explain this. Optional marketing consent is not a condition of making an enquiry.

Why we use information

• Answering and routing enquiries: to understand your needs, respond and connect you with an appropriate practice. We rely on legitimate interests in responding to enquiries and managing network referrals; where applicable, steps you request before entering a contract with us.
• Central administration and security: to operate and protect the website, troubleshoot problems, maintain records and manage the network. We rely on legitimate interests in safe, effective operations and any applicable legal obligations.
• Network support and oversight: to manage lead allocation, attribution, service quality and appropriate compliance oversight. We rely on legitimate interests in administering and supporting the network, limited to information needed for those purposes.
• Optional analytics and advertising technologies: to understand website use and campaign performance, with consent where required. The Cookie Policy explains the current Google Consent Mode implementation and your choices.
• Promotional email: central marketing through Brevo uses a separate opt-in. We rely on your consent and you can withdraw it at any time.
• Professional services: the engaged practice uses information to deliver the agreed services and administer its client relationship. Its bases may include performance of a contract with an individual client, legitimate interests in serving business clients and legal obligations for tax, accounting, AML and regulatory compliance. It is responsible for identifying any additional conditions required for sensitive information.

Where legitimate interests apply, processing must be necessary and proportionate and balanced against your rights. You may object as explained below.

Enquiry routing and who receives information

Forest Franchise Limited may share relevant enquiry details with an appropriate Forest Finance accountant or practice, considering your location or territory, preferences, service requirements, capability and capacity. The receiving practice can contact you about the requested support. The practice responsible for any professional engagement will be identified before work begins.

Central website/network systems include Hostinger for hosting, WordPress and the website CRM/forms for enquiry capture and management, Microsoft 365/Outlook for correspondence and administration, Brevo for communications and marketing consent/suppression, and Google Analytics for website measurement. Forest Hub is currently a synthetic-data/staging project and is not described here as a live client-data platform.

An engaged practice may use BrightManager and its portal, FreeAgent, Thirdfort for AML/KYC checks, Inform Direct, Microsoft 365, GoCardless, e-signing providers and other relevant professional systems. The suppliers used depend on the practice and services: not every client’s information goes to every supplier. Relevant information may also be disclosed to authorised advisers, HMRC, Companies House, professional bodies or other authorities where necessary for the service or a legal obligation.

International processing

Some suppliers or their support teams may process or access information outside the UK. A UK hosting or tenant region does not establish that every form of access is UK-only. Account-specific processing locations and international-transfer arrangements are being verified against current supplier contracts and data processing agreements. Brevo’s published hosting information places its databases in the EU, and FreeAgent’s published security information identifies data centres in Ireland. These provider statements do not establish the location of every subprocessor or support operation.

Where a restricted international transfer takes place, an applicable UK transfer mechanism is required, such as UK adequacy regulations or appropriate safeguards. This notice does not confirm a particular safeguard for a supplier whose arrangements have not yet been verified. Contact info@forest-finance.co.uk for details relevant to your information, including how to obtain information about applicable safeguards.

Marketing choices

Submitting an accountancy enquiry does not subscribe you to promotional email. Central Office manages network marketing through Brevo using a separate marketing preference. Consent evidence should record what was agreed, when and how the choice was collected.

Replies about your enquiry, proposals, engagement and agreed services are operational communications and do not depend on promotional consent. Essential client messages and client marketing are treated separately.

Use the unsubscribe link or email info@forest-finance.co.uk to stop promotional messages. We retain the minimum suppression information needed to honour your choice and prevent accidental re-subscription.

How long information is kept

• Unsuccessful central enquiries: the normal review/deletion point is 24 months after the last meaningful contact. A practice holding a routed prospect record should apply the network retention standard. Consent/withdrawal evidence and minimal suppression records may need to be retained longer where necessary.
• Marketing contacts: review for removal after 24 months without meaningful engagement. This can include a substantive reply, new enquiry, meeting/call, proposal interaction, becoming a client or expressly reconfirming marketing interest. An email open alone does not restart this period.
• Practice accounting and tax files: the normal review point is six years after the later of disengagement or the end of the last relevant accounting/tax period. The engaged practice is responsible for its records and any applicable retention duties.
• Specific professional records: VAT records are normally retained for at least six years, with longer scheme-specific requirements where applicable; PAYE/payroll records for at least three years from the end of the relevant tax year; and AML/KYC records normally for five years after the business relationship or relevant occasional transaction ends, subject to applicable requirements and permitted extensions.
• Exceptions: information may need to be kept longer for an HMRC enquiry, complaint, professional-indemnity matter, litigation or potential claim, regulatory requirement or other legal hold. Central network records are assessed separately for their purpose and continuing need.

These are retention and review standards, not a claim that deletion runs automatically. The cross-system deletion procedure is still being formalised. Each practice remains responsible for its professional records; Central Office is responsible for central records.

Website backup frequency, storage location and expiry are still being confirmed with the hosting manager. Deleted information may remain in backups until those copies expire or are deleted. Practice-system backups are separate. We do not state an unverified backup period.

Your rights and privacy complaints

Depending on the processing and applicable exceptions, you can request access, correction, erasure, restriction or portability of your personal information, object to processing based on legitimate interests and withdraw consent. Withdrawal does not affect the lawfulness of processing before it was withdrawn. You can object to direct marketing at any time.

Email info@forest-finance.co.uk directly, addressed to Jake Bailey, Data Protection Officer. You do not need to create an account or use a particular form. We may need proportionate information to confirm your identity. Requests are handled without undue delay and normally within one calendar month, subject to the applicable rules for clarification, verification or extensions; we will explain any relevant extension or reason we cannot fulfil a request.

For professional client information, the relevant practice also has responsibilities. Central Office can coordinate or route your request. There is no single automated rights-request or deletion process covering every practice and system.

You can raise a privacy complaint with our DPO and you also have the right to complain to the Information Commissioner’s Office.

Cookies and updates

Read our Cookie Policy for website storage, analytics and current consent behaviour. You can change your choices using Manage cookie preferences. We update this notice when our processing changes.