Last updated: 16 October 2026

1. Introduction

CRUDDU LTD (“we”, “us” or “our”) is committed to protecting your privacy and handling your personal information responsibly, securely and transparently.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, contact us or use our services.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who we are

Business name: CRUDDU LTD

Company number: 16988870

Business address: 5–7 High Street, London, E13 0AD

Email: cruddultd@gmail.com

Telephone / WhatsApp: +44 7448 116371

CRUDDU LTD provides Self Assessment tax return services, Construction Industry Scheme (CIS) support, Making Tax Digital (MTD) assistance, bookkeeping and general administrative support.

For the purposes of UK data protection law, CRUDDU LTD is generally the data controller of personal information collected and used in connection with its own business and client services.

3. Personal information we collect

We collect personal information that is reasonably necessary to provide our services, communicate with clients, manage our business and comply with legal obligations.

Depending on the services requested, this may include:

Personal and contact information

• Full name

• Address

• Email address and telephone number

• Date of birth

• National Insurance number

• Business or trading details

Tax and financial information

• Unique Taxpayer Reference (UTR)

• HMRC reference numbers

• Income and expenditure details

• Employment and self-employment information

• Invoices, receipts and bookkeeping records

• Bank statements and other relevant financial documents

• Payslips, CIS statements and HMRC correspondence

Identity verification information

• Identification documents and other information necessary to verify identity, where required

• Information required to comply with anti-money-laundering and other legal obligations

Communications

• Information provided through website contact forms

• Emails, messages and correspondence

• Information shared through telephone or WhatsApp communications

• Documents or attachments provided by clients

Website information

When you visit our website, certain technical information may be collected through cookies and similar technologies, depending on the website settings and your consent choices.

Further information is available in our Cookie Policy.

4. Why we use personal information

We use personal information for the following purposes:

• Responding to enquiries and providing information about our services.

• Registering and onboarding new clients.

• Verifying client identity where required.

• Preparing and submitting Self Assessment tax returns.

• Providing CIS and Making Tax Digital support.

• Maintaining bookkeeping and financial records.

• Communicating with HMRC on behalf of authorised clients.

• Providing agreed administrative services.

• Managing client relationships, appointments and deadlines.

• Issuing invoices and maintaining business records.

• Complying with tax, accounting, anti-money-laundering and other legal obligations.

• Handling complaints, disputes and legal claims.

• Maintaining the security and functionality of our website and business systems.

We do not sell personal information.

5. Lawful bases for processing personal information

Under UK GDPR, we must have a lawful basis for processing personal information.

Depending on the circumstances, we may rely on the following:

Performance of a contract

Where processing is necessary to provide services under an agreement with a client or to take steps requested before entering into an agreement.

Compliance with a legal obligation

Where processing is necessary to comply with applicable legal or regulatory requirements, including anti-money-laundering, tax and accounting obligations.

Legitimate interests

Where processing is necessary for our legitimate business interests, provided those interests are not overridden by the rights and freedoms of the individual.

This may include responding to business enquiries, maintaining appropriate records, protecting our business and improving our services.

Consent

Where consent is required for a particular activity, such as certain cookies or optional communications.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

The lawful basis used will depend on the purpose and circumstances of the processing.

6. Special category personal information

CRUDDU LTD does not routinely request or collect special category personal information, such as information about a person's health.

In limited circumstances, such information may be relevant to a particular service or legal requirement.

We will only process special category information where it is genuinely necessary, an appropriate lawful basis under Article 6 of the UK GDPR applies, and a separate condition under Article 9 is satisfied.

Where explicit consent is the applicable condition, we will obtain it before processing the relevant information.

We will limit the collection and use of sensitive information to what is necessary for the specific purpose.

Clients are encouraged not to send sensitive personal information unless it is relevant to the service requested or we have specifically asked for it.

7. Sharing personal information

We may share personal information with relevant organisations where necessary to provide our services or comply with legal obligations.

These may include:

• HM Revenue & Customs (HMRC): For tax submissions, authorisations and communications where appropriate.

• Tax and bookkeeping software providers: Where necessary to prepare records, manage accounts or submit tax information.

• Website and technology providers: Including Wix, email, cloud storage, document management and other IT service providers.

• Professional advisers: Including legal or accounting professionals where their assistance is necessary and sharing is lawful.

• Regulatory or law enforcement authorities: Where disclosure is required or permitted by law.

• Other parties: Where you have requested or authorised a relevant disclosure, or where another lawful basis applies.

Where third-party providers process information on our behalf, we take appropriate steps to ensure suitable data protection arrangements are in place.

We do not share personal information for unrelated purposes without an appropriate lawful basis.

8. International transfers

CRUDDU LTD does not routinely transfer clients' personal information outside the United Kingdom as part of its ordinary business activities.

However, some third-party service providers used for website hosting, communications, cloud storage or business software may process or store personal information outside the United Kingdom.

Where an international transfer takes place, we will ensure that it complies with applicable UK data protection law and that any required safeguards are in place.

Where relevant, further information about the safeguards used may be requested using the contact details in this Policy.

9. How we protect personal information

We take appropriate technical and organisational measures to protect personal information against unauthorised access, accidental loss, misuse, alteration or disclosure.

Depending on the information and systems involved, these measures may include:

• Secure electronic storage and document management.

• Password protection and account access controls.

• Restricting access to information to authorised individuals.

• Using reputable software and service providers.

• Maintaining appropriate confidentiality arrangements.

• Reviewing records and securely disposing of information when it is no longer required.

Although we take reasonable precautions, no method of electronic storage or internet communication can be guaranteed to be completely secure.

Clients should take appropriate care when sending sensitive documents electronically.

10. How long we keep personal information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, taking account of applicable legal, regulatory, tax and accounting requirements.

Our usual retention periods are:

Client tax records and supporting documents

Generally, at least five years after the relevant 31 January tax return filing deadline, where that period applies to the records concerned. Different legal requirements may apply depending on the type of records and the client's circumstances.

Anti-money-laundering and identity verification records

Generally, five years after the end of the business relationship or completion of the relevant transaction, in accordance with applicable anti-money-laundering requirements.

Engagement letters, contracts, invoices and related business records

Generally, up to six years after the end of the relevant financial year or business relationship, where necessary for accounting, contractual or legal purposes.

General enquiries that do not result in a client relationship

Generally, up to 12 months after the last communication, unless there is a legitimate or legal reason to retain the information for longer.

Complaints and disputes

For as long as reasonably necessary to resolve the matter and comply with applicable legal requirements or deal with potential legal claims.

Website and cookie information

In accordance with the purposes and retention periods of the relevant technologies, as explained in our Cookie Policy or associated cookie information.

Records may be retained for longer where required by law, an ongoing HMRC enquiry, a regulatory investigation, an unresolved dispute or another lawful reason.

When personal information is no longer required, we will securely delete or anonymise it, unless further retention is legally justified.

11. Your data protection rights

Under UK data protection law, you may have the following rights, depending on the circumstances:

• Right of access: To request information about the personal data we hold about you and obtain a copy.

• Right to rectification: To request correction of inaccurate or incomplete information.

• Right to erasure: To request deletion of personal information in circumstances where this right applies.

• Right to restrict processing: To request that we limit how your information is used in certain circumstances.

• Right to object: To object to certain processing, including processing based on legitimate interests.

• Right to data portability: To receive certain personal information in a structured, commonly used and machine-readable format where the legal conditions apply.

• Right to withdraw consent: Where processing is based on consent, to withdraw that consent at any time.

These rights are subject to applicable legal conditions and exemptions.

For example, we may be required to retain certain information to comply with tax or anti-money-laundering legislation, even where deletion is requested.

To exercise your rights, please contact us using the details provided in this Policy.

We may request reasonable information to verify your identity before responding.

We will respond within the timescales required by applicable data protection law.

12. Cookies and website technologies

Our website uses cookies and similar technologies for website functionality and, where enabled, other purposes.

Where consent is required for non-essential cookies, we will seek that consent through the website's cookie consent arrangements.

For further information about the types of cookies used and how to manage your preferences, please read our Cookie Policy.

13. Complaints and concerns

If you have any questions or concerns about how we handle your personal information, please contact us.

We will take privacy concerns seriously and aim to resolve them appropriately.

You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Information Commissioner's Office

Website: https://ico.org.uk

Complaints: https://ico.org.uk/make-a-complaint/

Postal address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business practices or legal requirements.

The latest version will be published on our website, together with the date of the most recent update.

15. Contact us

For any questions, requests or concerns relating to this Privacy Policy, please contact:

CRUDDU LTD

Address: 5–7 High Street, London, E13 0AD

Email: cruddultd@gmail.com

Telephone / WhatsApp: +44 7448 116371