Personal Data Privacy Policy

1. Introduction

Got Sunshine (“GS”, “we”, “us”, “our”) provides virtual assistant related administrative support to businesses and individuals across the UK. We take the privacy and security of personal data seriously, and we are committed to handling it lawfully, fairly and transparently. This policy explains what personal data we collect, why and how we use it, who we share it with, how long we keep it, and what rights you have over it. This policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025, together with any other applicable data protection and privacy legislation in force from time to time.

2. Who we are

Got Sunshine is the data controller responsible for your personal data for the purposes of this policy. Our details are: 

Founder: Hannah Frost-Nickols

Contact email: hannah@gotsunshine.co.uk

ICO registration reference: ZC001835

If you have any questions about this policy, or about how we handle your personal data, please contact us using the details above.

3. Who this policy covers

This policy applies to personal data we collect and process in connection with: 

Clients and prospective clients 

Individuals connected with our clients, such as their employees, customers, tenants or family members, where this is relevant to the bookkeeping, payroll or administrative work we carry out

Associates and subcontractors who work with us

Visitors to our website and followers of our social media channels

Suppliers and other business contacts

4. The personal data we collect

Depending on our relationship with you, the personal data we collect may include:

  • Identity information – name, date of birth, and identification documents such as a passport or driving licence, collected primarily to meet our anti-money laundering client due diligence obligations

  • Contact details – home or business address, email address, and telephone number 

  • Financial information – bank account details, transaction data, invoices, payroll information, tax records and other financial records necessary to provide bookkeeping, payroll and accounting support

  • Business information – company registration details, VAT registration details, Unique Taxpayer Reference (UTR), and correspondence with HMRC or other regulators 

  • Employment and payroll data – where we process payroll on a client's behalf, this may include salary, National Insurance number, pension contributions and similar information about a client's employees 

  • Communications – emails, messages and call records exchanged with us 

We collect this information directly from you and your authorised representatives, from publicly available sources such as Companies House, and, where relevant, from third parties such as HMRC, your accountant, or other professional advisers acting on your behalf.


5. Why we use your personal data, and our lawful basis

We only process personal data where we have a lawful basis to do so under UK GDPR. Depending on the activity in question, we rely on one or more of the following: 

•       Performance of a contract – to provide the virtual assistant or related services you have engaged us to deliver 

•       Legal obligation – to comply with our obligations under tax law, anti-money laundering legislation, and other regulatory requirements 

•       Legitimate interests – to manage our business relationship with you, run and improve our business and services, and, where appropriate and you have not objected, to send relevant marketing communications 

•       Consent – where we specifically ask for your consent, for example for certain marketing communications, which you may withdraw at any time 

We use personal data for purposes including: 

•       Providing virtual assistant services 

•       Verifying your identity in accordance

•       Communicating with you about your account and our services 

•       Invoicing and processing payments 

•       Maintaining the business and accounting records we are legally required to keep 

•       Improving our services and website 

•       Sending marketing communications, where you have agreed to receive them

6. Anti-money laundering and client due diligence

GS is a supervised business under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. As part of this supervision, we are required to carry out client due diligence checks, which may include verifying your identity and, in some cases, the source of funds. We retain records relating to this due diligence for the period required by law – currently a minimum of six years from the end of our business relationship with you – even if you cease to be a client.

7. Who we share your personal data with

We may share personal data with: 

•       Our associates and subcontractors who provide services to you on our behalf, on a confidential basis and only to the extent necessary to carry out that work •       Software and cloud service providers we use to deliver our services, such as cloud accounting platforms (for example FreeAgent, Xero or CRMs) and payment processing providers (for example GoCardless) 

•       HMRC and other relevant government or regulatory bodies, where required by law or necessary to carry out the services we provide to you 

•       Our own professional advisers, such as our accountant, solicitor, or insurer, where necessary 

•       Our anti-money laundering supervisory authority

•       Any third party in the context of a sale, merger or restructuring of our business We do not sell your personal data to third parties.

8. International data transfers

Some of the software and cloud service providers we use may store or process data outside the UK. Where this is the case, we take steps to ensure an adequate level of protection is in place, such as relying on UK adequacy regulations or appropriate contractual safeguards, including Standard Contractual Clauses or the UK International Data Transfer Addendum.

9. How long we keep your data

We retain personal data only for as long as necessary for the purposes set out in this policy, including to meet our legal, accounting, tax and anti-money laundering obligations. As a general guide: 

•       Financial and tax records: a minimum of six years from the end of the relevant tax or accounting year, in line with HMRC requirements 

•       Anti-money laundering due diligence records: a minimum of six years from the end of the business relationship 

•       General client correspondence: for the duration of the business relationship, plus a reasonable period afterwards 

•       Marketing data: until you withdraw consent or object, or as otherwise required by law

10. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including secure cloud-based systems, access controls, confidentiality obligations on our associates and subcontractors, and regular review of our data handling practices.

11. Your rights

Under UK GDPR, you have the right to: 

•       Be informed about how your personal data is used 

•       Access the personal data we hold about you 

•       Have inaccurate personal data corrected 

•       Request erasure of your personal data, in certain circumstances 

•       Restrict or object to our processing of your personal data, in certain circumstances 

•       Request portability of your personal data, in certain circumstances 

•       Not be subject to solely automated decision-making which has a significant effect on you – we do not currently carry out any such automated decision-making 

To exercise any of these rights, please contact us on hannah@gotsunshine.co.uk. We will respond within one month, as required by law.

12. Your right to complain

You have the right to raise a concern about how we handle your personal data directly with us. Full details of how to do this are set out in our separate Data Protection Complaints Policy, available from us on request. You also have the right to complain to the Information Commissioner's Office (ICO) at any time, whether or not you have raised the matter with us first: 

Website: ico.org.uk

Telephone: 0303 123 1113 

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Cookies and website data

Where you visit our website, we may use cookies and similar technologies to help it function properly and to understand how it is used. You can control or disable cookies through your browser settings, or through any cookie consent tool on our site. Please see our separate policy.

14. Children's data

Our services are aimed at businesses and adults, and we do not knowingly collect personal data directly from children. Where payroll or related work for a client requires us to process limited data about that client's employees who are under 18, we do so only as part of the services we have been contracted to provide, and in line with this policy.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our services, or the law. The current version will always be available from us on request and will be clearly dated.

16. Contact us

If you have any questions about this policy or how we handle your personal data, please contact us on hannah@gotsunshine.co.uk.