Your information.
Handled carefully.

1. Who we are

AAY Financial Services Limited is the controller of personal information described in this policy. We are registered in England and Wales under company number 17332654 and operate across London and Edinburgh, United Kingdom.

Privacy enquiries or complaints can be sent to arian.yazdi@aayfinancialservices.com.

2. Information we collect

Depending on how you interact with us, we may collect:

• your name, role, organisation and contact details;
• the contents of enquiries, correspondence and meeting notes;
• service interests, proposal information and engagement history;
• billing, contractual and business contact information;
• technical information made available by our website or hosting infrastructure, such as IP address, browser type, device information, timestamps and security logs;
• information supplied during a client engagement under the applicable agreement.

Please do not send sensitive, payroll, employee or confidential financial information through the general website enquiry form.

3. How we use information

We use personal information to respond to enquiries, arrange consultations, prepare proposals, take steps towards a contract, deliver and administer services, maintain records, issue invoices, protect our systems, improve our website and comply with legal obligations.

4. Lawful bases

We rely on one or more of the following lawful bases:

• Legitimate interests: responding to business enquiries, operating and improving our services, maintaining business relationships and protecting our systems;
• Contract: taking requested steps before entering into a contract and performing a contract;
• Legal obligation: complying with accounting, tax, regulatory, fraud-prevention and other legal requirements;
• Consent: where we specifically ask for consent, including any optional electronic marketing that requires it.

5. Sharing information

We may share information with trusted providers supporting website hosting, email, document storage, accounting, IT security and professional advice. We may also disclose information where required by law, to protect legal rights or in connection with a business reorganisation.

Providers may only use information for the agreed purpose and must protect it appropriately. We do not sell personal information.

6. International transfers

Some technology providers may process information outside the United Kingdom. Where this occurs, we use an appropriate legal safeguard, such as UK adequacy regulations or approved contractual protections, where required.

7. Retention

We keep information only for as long as reasonably necessary for the purpose collected, including responding to enquiries, maintaining business records, establishing or defending legal claims and meeting accounting or legal obligations.

Unsuccessful or inactive enquiry records will normally be reviewed and deleted within 24 months. Contract, invoice and core engagement records may be retained for up to seven years after the relevant financial year or engagement, unless a longer period is required for a legal claim or other obligation.

8. Security

We use proportionate organisational and technical measures to protect information. No online transmission or storage system can be guaranteed completely secure, so confidential engagement data should be shared only through the method agreed with AAY.

9. Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict your information, object to processing, receive portable data and withdraw consent. You may also complain about how your information is handled.

Contact us first so we can investigate and respond. You may also complain to the Information Commissioner’s Office at ico.org.uk.

10. Marketing

We will not treat acceptance of this policy or submission of a service enquiry as consent to unrelated direct marketing. Where consent is required, marketing choices will be presented separately and can be withdrawn at any time.

11. Cookies and analytics

The current website does not intentionally use non-essential advertising or behavioural-tracking cookies. If analytics or other non-essential technologies are introduced, we will update this policy and provide any consent controls required by law.

12. Updates

We may update this policy when our services, technology or legal obligations change. The latest version will be published on this page.