A short
notice on what
we do with
your data.

From this website we collect only what you give us deliberately, plus a small amount of information needed to keep the site functioning.

• · Contact-form details — your name, email, telephone (if supplied), business name and the content of your message.
• · Direct correspondence — emails, letters and call notes if you choose to contact us.
• · Strictly-necessary cookies — a session cookie and a CSRF cookie, used purely to keep the site working and protect form submissions. No analytics or marketing cookies are set.
• · Server logs — standard web logs (IP, user agent, request path, timestamp), retained for 30 days for security and abuse prevention.

For prospective clients writing to us through the website, our lawful basis is your consent (which you give by submitting the form) and our legitimate interests in responding to enquiries about our services.

For ongoing clients, additional lawful bases apply — most importantly contract (performing the engagement) and legal obligation (anti-money laundering checks, retention of accounting records, statutory filings). These are explained in detail in your engagement letter.

Personal information you send us through the website is read only by Sowilo Investments Ltd. We do not sell, rent, or trade personal data, and we do not use it for marketing.

For client engagements, we share information with HMRC, Companies House, and your bank or pension provider where you instruct us to. We may, in rare circumstances, be required to disclose information to law enforcement, the courts, or our regulator (the AAT) — we do so only when legally compelled.

Our IT systems include UK and EU-hosted email, accounting software (Xero, FreeAgent, QuickBooks — per your engagement) and document storage. All providers are bound by data-processing agreements consistent with UK GDPR.

• · Enquiry that does not become an engagement — deleted within 12 months.
• · Client tax records — six years from the end of the relevant tax year (HMRC requirement).
• · Anti-money-laundering records — five years after the end of the engagement (MLR 2017).
• · Payroll records — six years from the end of the tax year they relate to.
• · Server logs — 30 days.

Under UK GDPR you have the right to:

• · request a copy of the personal data we hold about you (right of access);
• · ask us to correct inaccurate data (rectification);
• · ask us to delete data we no longer need (erasure);
• · ask us to stop or limit how we use your data (restriction);
• · receive your data in a portable form (portability);
• · object to processing based on legitimate interests.

Some rights are subject to exceptions where we have a legal obligation to retain data (for example, six-year tax records). To exercise any right, write to hello@sowiloinvestments.com.

This site uses only strictly-necessary cookies to keep sessions valid and protect form submissions from cross-site request forgery. We set no analytics, advertising, or third-party cookies. If we ever introduce optional cookies, they will be off by default and require explicit opt-in via the cookie preferences panel.

You can revisit your preferences at any time using the cookie preferences link.

If you have a concern about how we have handled your personal data, please write to us first at hello@sowiloinvestments.com. We will reply within ten working days.

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow SK9 5AF
ico.org.uk · 0303 123 1113