Privacy Notice

Agensi Ltd ("Agensi", "we", "us") provides fractional CFO, COO and CPO services to tech startups and scaleups, in particular SaaS companies. We decide how the personal data described in this notice is used, which makes us its "controller".

Agensi Ltd is registered in England and Wales, company number 10931450. Our registered office is 679 High Road, Leyton, London, England, E10 6RA. We are registered with the Information Commissioner's Office (ICO), registration number ZB138904.

Data protection contact: privacy@agensi.co.uk. General enquiries and marketing opt-out: hello@agensi.co.uk.

• people who visit agensi.co.uk;
• people who sign up to our newsletter or contact us about our services;
• our clients, and people who work for or with them;
• the owners and directors of our clients, whose details we check before and during our work (see section 6).

Our website is not intended for children, and we do not knowingly collect information about children. Other websites linked from ours have their own privacy notices.

• Identity data: name and job title.
• Contact data: email address, phone number and business address.
• Client and billing data: the details we need to agree, deliver and invoice our work, such as contracts and invoice details.
• Website data: how you use our website, collected through cookies (see section 12).
• Due diligence data: for our clients' owners and directors only (see section 6).

We do not collect special category data, such as health information. The only time we may come across information about criminal offences is during the due diligence checks described in section 6.

If you do not give us information we need, we may not be able to provide our services.

Data we handle for our clients. When a client gives us access to its own systems or records, such as its accounting software, any personal data in them is handled on the client's behalf under our client agreement. The client is responsible for telling those people how their data is used.

• Directly from you: through forms, email, phone, meetings, newsletter sign-ups and enquiries.
• From public sources: for due diligence checks only (see section 6).
• From our website: through cookies (see section 12).

Why we use it	Our legal basis
To respond to enquiries and provide our services	To take steps before, and to perform, a contract with you or your organisation
To run our business, for example invoicing and keeping records	Legal obligation, and our legitimate interests in running our business
To send our newsletter and updates about our services	Your consent, or our legitimate interests where you are an existing client. You can unsubscribe at any time using the link in our emails or by emailing hello@agensi.co.uk
To carry out due diligence checks	Legal obligation (see section 6)
To understand how our website is used	Your consent, where the law requires it (see section 12)

As a firm providing accountancy services, we must check who our clients are before and during our work, under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. The Chartered Institute of Management Accountants (CIMA) supervises us for this.

• What we collect: for our clients' owners and directors: name, date of birth, home address, a copy of photo ID and proof of address; how the business is owned, controlled and funded; and whether anyone is a politically exposed person (someone in a prominent public role, or their family or close associates).
• Where it comes from: from you and your organisation, and from public sources such as Companies House, sanctions lists and news reports.
• The checks we run: we check names against sanctions lists and lists of politically exposed persons, and search for relevant news reports. These checks can sometimes reveal information about criminal offences or allegations. We use it only to decide whether we can act for a client.
• How we use it: only to meet our legal duties to prevent money laundering and terrorist financing, unless you have agreed to another use or the law allows it.
• Who we may share it with: CIMA, as our supervisor; the National Crime Agency, HMRC, the Office of Financial Sanctions Implementation and other authorities where the law requires; and the identity verification providers we use for these checks.
• How long we keep it: five years from the end of our relationship with the client. We then delete it, unless another law requires us to keep it or you have agreed that we can.

• people within Agensi who need it for their work;
• IT and software providers, such as cloud storage, email, e-signature and website analytics providers (including Google and Hotjar);
• professional advisers, such as our accountants, lawyers, bankers and insurers;
• regulators and authorities, where the law requires (see section 6);
• a buyer or new owner, if all or part of our business is sold or merged.

Anyone we share data with must keep it secure and use it only as we instruct.

Personal data is processed mainly in the UK. Some of our service providers may process personal data outside the UK. Where they do, we rely on a safeguard recognised by UK data protection law, such as an adequacy decision, the UK-US data bridge or approved contract terms. You can ask us for more information.

Only people who need your data for their work can access it, and they must keep it confidential. We have procedures for dealing with a suspected data breach, and we will tell you and the ICO where the law requires.

Data	How long we keep it
Client contracts, invoices and financial records	Six years after our work ends, for tax and accounting purposes
Due diligence records	Five years after our relationship with the client ends, then deleted (see section 6)
Newsletter details	Until you unsubscribe
Everything else	Only as long as we need it for the purpose we collected it

We may keep anonymised information, which can no longer identify you, without time limit.

You can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete your data;
• stop or limit how we use it, including where we rely on our legitimate interests;
• send your data to you or another organisation in a usable format.

Where we rely on your consent, you can withdraw it at any time. Some rights are limited by law, for example we cannot delete due diligence records before the end of the five-year period.

To make a request, email privacy@agensi.co.uk. We do not normally charge a fee, but we may if a request is clearly unfounded, repetitive or excessive.

Our website uses:

• Strictly necessary cookies: needed for the site to work, for example for navigation and secure access;
• Analytics cookies: Google Analytics and Hotjar, to help us understand how visitors use the site;
• Functionality cookies: to remember your preferences, where used.

Google and Hotjar set their own cookies, and their websites explain how to opt out. You can also manage or block cookies in your browser settings, although some parts of the site may then not work properly.

If you have a question or concern, please contact us at privacy@agensi.co.uk or write to us at 679 High Road, Leyton, London, England, E10 6RA. You also have the right to complain to the ICO at any time, at ico.org.uk.

We will post any changes on this page and update the date at the top. Please let us know if your personal details change.