Website Privacy Policy

This website is owned and operated by Caboodle Business Support Ltd.
Policy last updated: 28 August 2026 – Version 3

This policy explains what happens to personal information when you use our website or contact us through it. Our separate Cookie Policy explains our use of cookies, Google Analytics 4 and Google Tag Manager in more detail.

Download the approved Website Privacy Policy as a PDF

1. Who are we?

Caboodle Business Support Ltd (“Caboodle”, “we”, “us” or “our”) is a UK accountancy practice. For the personal information described in this policy, Caboodle Business Support Ltd is the data controller unless we say otherwise.

Contact details

If you have any questions about this privacy policy and/or how we handle the personal information collected during your interaction with our website, you can contact us by email, telephone, or post as follows:

Registration details

  • Company number: 11331669
  • VAT number: 405366706
  • Registered address: 15 Potters Way, Laverstock, Salisbury, Wiltshire SP1 1PY

Regulatory body / Memberships

Caboodle Business Support Ltd is a member of, and regulated by, the Association of Chartered Certified Accountants (ACCA).

We are also a member of the Chartered Institution of Taxation (CIOT).

Data Protection Officers

Data Protection Officer: Ian Rowe (ian@caboodlesupport.co.uk)
Deputy Data Protection Officer: Karen Eyers (karen@caboodlesupport.co.uk)

2. What is personal information?

Personal information is defined by the UK GDPR and the Data Protection Act 2018 (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal information is, in simpler terms, any information about you that enables you to be identified, such as your name and contact details. It also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.

3. Google Tag Manager

We use Google Tag Manager (GTM) to manage and deploy the Google Analytics tag on our website. GTM is a tag-management tool. Our current use of GTM is limited to managing Google Analytics; we are not currently using it to deploy advertising, remarketing or social-media tracking tags.

4. Information we collect through the website

The information we collect depends on how you use our website.

Information you give us

If you use our contact form, we collect your name, email address, where you heard about us, the service or services you are interested in, and whatever free-text message you choose to send (you might include your telephone number and/or business name, for example).

Website and analytics information

If you consent to analytics through our cookie controls, Google Analytics 4 (GA4) may collect information about your visit and interaction with our website. This can include pages viewed, interactions with website features, device and browser information, approximate geographic information, and information about how you arrived at our website, for example through a particular search engine like Google.

Google states that GA4 does not log or store individual IP addresses. IP information may be used to derive approximate location information before being discarded by Google.

5. How and why we use your information

Under the Data Protection Legislation, we must always have a lawful basis for using personal data. Examples are listed below.

Site management

This will include registering you on our site, providing and managing your account, providing and managing your access to our site, personalising and tailoring your experience on our site, and administering our site.

Responding to enquiries

We use information submitted through the contact form to read, manage and respond to your enquiry and, where appropriate, to then contact you to discuss the Caboodle services or products you have asked about. Depending on the circumstances, our lawful basis under UK data protection law will normally be taking steps, at your request, before entering into a contract, and/or our legitimate interests in responding to enquiries and developing our business.

Marketing

We do not treat submitting a contact form as consent to receive unrelated marketing communications.

Only with your permission and/or where permitted by law, will we use your personal data for marketing purposes, which may include contacting you by email, telephone, text message and/or post with information, news, and offers on our products and/or services.

We will never send you any unlawful marketing or spam. We will always work to fully protect your rights and comply with our obligations under the Data Protection Legislation and the Privacy and Electronic Communications (EC Directive) Regulations 2003, and you will always have the opportunity to opt-out.

We will always obtain your express opt-in consent before sharing your personal data with third parties for marketing purposes and you will be able to opt-out at any time.

Website analytics and improvement

We use ‘Google Analytics 4’ (GA4) to understand how people find and use our website and to help us improve the website and our services. We currently use GA4 for analytics only. We do not use it for Google Ads, remarketing, advertising personalisation or audience building.

Our chosen website configuration is consent-based: GA4 will not operate unless you have made the appropriate choice through our cookie consent mechanism. Where analytics processing involves personal information, we rely on your consent for this processing.

Privacy-minimised contact-form measurement

When a contact form is successfully submitted, GA4 may record a form-submission event and information about how the visitor arrived at our website. This helps us understand which sources generate enquiries.

We have configured this measurement on a privacy-minimised basis. We do not intentionally send to GA4 the name, email address, telephone number, free-text message, business details or other personal information entered into the contact form as part of the form-submission event.

6. Your analytics and cookie choices

When you first visit our website, our cookie controls allow you to accept or reject analytics technologies and to manage your preferences. Analytics will not operate unless you have made the appropriate choice through those controls.

You can change or withdraw your choice at any time using the Cookie Settings link on our website. Withdrawing consent does not affect the lawfulness of processing that took place before you withdrew it.

Please see our separate Cookie Policy for more information.

7. Who can access or receive your information

We limit access to personal information to people who have a legitimate need to use it. Depending on the information concerned, this may include authorised Caboodle personnel, our GDPR-compliant external SEO/website manager where access is necessary to provide services to us, and Google as the provider of Google Analytics and Google Tag Manager.

We may also disclose personal information where required by law, regulation, a court order or a competent authority, or where reasonably necessary in connection with legal claims.

If our business or relevant assets are sold, transferred or reorganised, information may be transferred as part of that transaction, subject to applicable data protection requirements.

We do not sell personal information.

8. How long will we keep your information?

We keep personal information only for as long as we reasonably need it for the purpose for which it was collected. This includes meeting legal, regulatory, accounting or reporting requirements. Different categories of information may therefore have different retention periods.

Personal information submitted through the contact form is retained in accordance with the retention arrangements that apply to enquiries, prospective clients and, where an enquiry leads to an engagement, our client records.

How long do we keep analytics information?

We have set Google Analytics to retain detailed information about website interactions for 14 months, after which information covered by that setting is automatically deleted. Google may retain aggregated statistics – for example, the total number of people who visited a page during a particular month – for longer. These aggregated reports do not contain the same detailed information about individual website interactions.

9. International processing and transfers

We store some of your personal information in the UK, where it is protected under UK data protection law.

We may also store or process some of your personal information within the European Economic Area (the “EEA”), which consists of the EU member states together with Norway, Iceland and Liechtenstein. The UK has adequacy arrangements covering the EEA, which means that personal information can generally be transferred from the UK to the EEA without additional transfer safeguards.

Some of our service providers, including Google and Microsoft, operate internationally and maintain infrastructure in a number of countries. This means that personal information processed through services such as Google Analytics and Microsoft 365 may, in some circumstances, be processed outside the UK.

Where personal information is transferred outside the UK, we ensure that an appropriate lawful transfer mechanism is available. Depending on the destination, recipient and circumstances, this may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

We take reasonable steps to ensure that our service providers provide appropriate protection for personal information in accordance with applicable UK data protection law.

You can contact us if you would like more information about the safeguards relevant to a particular transfer.

10. Keeping your information secure

The security of your personal information is very important to us. While no internet-based system can be guaranteed to be completely secure, we regularly review our arrangements and take proportionate steps to protect the personal information entrusted to us.

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure or access. These measures include paying for specialist IT support, using encryption and secure servers, and limiting access to authorised people with a legitimate need to know.

We maintain procedures for responding to personal data breaches.

11. Your data protection rights

Depending on the circumstances, UK data protection law gives you rights in relation to your personal information. These can include the rights to access your information, correct inaccurate information, request erasure, restrict processing, object to certain processing, receive certain information in a portable format, and withdraw consent where we rely on consent.

Not every right applies in every situation. We may need to confirm your identity before acting on a request.

12. Accessing your information

You are entitled to make a ‘Subject Access Request’ (SAR) for a copy of the personal information we hold about you. You do not have to use a particular form, though we will provide one on request.

Requests can be sent by phone, email or post using the contact details in Section 1. Ideally, please email our Data Protection Officer, Ian Rowe (ian@caboodlesupport.co.uk).

We will endeavour to respond within the period required by data protection law, currently one month. In certain circumstances, the law allows additional time, for example where a request is complex or a person submits multiple separate rights requests. If that applies, we will tell you.

There is normally no charge for handling a SAR. However, if your request is ‘manifestly unfounded or excessive’ (for example, if you make repeated requests), a fee may be charged to cover our administrative costs in responding.

13. Complaints

If you have concerns about how we use your personal information, please contact us in the first instance so that we have an opportunity to address your concerns.

You also have the right to complain to the Information Commissioner’s Office (ICO) which is the UK supervisory authority for data protection.

ICO website: https://ico.org.uk

Please also see our Data Protection Complaints Policy.

14. Changes to this policy

We may update this Website Privacy Policy from time to time to reflect changes to our website, services, suppliers or legal and regulatory requirements. The latest version will be published on our website with its ‘Last updated’ date clearly displayed.

Where a change requires a new consent choice, we will ask for that choice rather than treating continued use of the website as consent.

15. Contact us

If you have a question about this policy, your personal information or your data protection rights, please contact us using the details in Section 1.