User Research Privacy Notice

Version 1.1: This notice was last updated in August 2026. While we will never deviate from our overall philosophy of maintaining your privacy, we may update this notice again in the future and will publish any subsequent versions of it here.

“We”, “us” and “our” for the purposes of this notice means FreeAgent Central Limited, a member of NatWest Group plc and a data controller for the purposes of data protection law.

This privacy notice sets out the basis on which any personal information about you will be processed by us. This privacy notice may be updated from time to time and we will communicate any changes to you.

This privacy notice should be read with our Terms of Service, which, together, apply to your use of both the FreeAgent website and FreeAgent service.

Personal information and user research data that we collect about you

We will collect and process various types of personal information and user research data about you. This includes information that FreeAgent collects when it carries out research to test and improve services, both internally and in order to identify potential improvements for the future, and any recording or note-taking we’ll need to make. We will only collect information that you provide directly to us, and we will not source information from third parties.

When we say “personal data” or “personal information”, we mean any information that relates to and identifies a living person. Examples of this include name, email address, contact number, as well as any correspondence sent by you when you contact us

Further to this, we will also process the following information about your business, which may or may not be considered personal data depending on the type of business you have:

1. Background information about your business or accountancy practice such as:

   • purpose
   • sector
   • type
   • age
   • size
   • structure of your business
   • client/customer base

2. Information about your work routine/habits

   The user research data may include:

   • notes from research sessions
   • photos, audio and video recordings of you and/or your screen
   • information used in prototypes or test versions of services
   • any surveys that you refer to or respond to

Uses of your personal information

We collect and use your personal data to fulfil our user research requirements. All the processing we carry out is underpinned by a set of processing conditions. These are the legal bases under which we have the authority to collect, use and store your personal information. The following is a summary of how these could apply to you within the FreeAgent service.

Consent

We need some personal data from you to invite you to take part in user research. We only process your personal data with your consent. You can withdraw your consent at any time.

Legitimate interests

We will use personal data discussed with us to improve the services, products and functionality of FreeAgent. We will do this where it is in our legitimate interests to do so, and without prejudicing your interests or fundamental rights and freedoms. Examples include:

• carrying out research by asking for your opinion, details of your workflow and your understanding of our product to help us implement appropriate changes in FreeAgentʼs current and future products
• contacting you to carry out any follow-up research
• contacting you to invite you to participate in future research

If you contact us with a query, we may also store your data to aid our response to your request and any similar requests in the future.

The recording of our conversations helps us analyse the interview and refer back to the things you tell us. The recording may be shared within FreeAgent to highlight areas in the research.

Legal obligation

We will share your data if weʼre required to do so by law - for example, by court order, or to prevent fraud or other crime.

Special category data

FreeAgent has limited requirement to collect or process any special categories of personal data, as defined under GDPR and the Data Protection Act 2018, in order to provide the service.

We may record information about you that considers your welfare or vulnerability needs including any adjustments, support or different products or services which might be suitable for protections to be put in place. This could in some places be considered as Health Data.

Data relating to children

In addition there may be examples of children (those under 18 years of age) using FreeAgent as a customer or a user of our service. We do not target our services to children but acknowledge that some children may have a need for our service.

We perform Data Protection Impact Assessments and develop equivalent policy documentation to ensure we protect higher risk individuals and associated data in a secure and compliant manner.

Disclosure of your data to third parties

We would never need to share your personal data with third parties and no recordings containing personal data will be shared with third parties, ever.

We will occasionally share our user research findings with colleagues in the NatWest Group but before we do that, we will anonymise your personal data.

Retention of personal data

Your data will be retained in line with our internal records management policies and retention schedules. Your data will typically be retained for up to two years from when it was collected.

Data transfers

We will, from time to time, have to transfer your data to third parties or organisations in other countries. This will only happen on the basis that any party which we pass your data to will protect it in the same way that we would and in accordance with applicable laws.

In the event that we transfer data to countries outside of the United Kingdom (UK) and European Economic Area (which includes countries in the European Union as well as Iceland, Liechtenstein and Norway), we will only do so when:

• the UK has decided that the country or the organisation we are sharing your data with will protect your data adequately
• the transfer has been authorised by the relevant data protection authority
• we have entered into a valid contract with the third party or organisation with which we are sharing your data (on terms approved by the UK) to ensure your data is adequately protected

For a full list of sub-processors and details of the safeguards in place in respect of data transfers outside the UK and EEA, please see our FreeAgent subprocessors page.

Deleting your data

You can request us to delete personal data we hold on you by contacting us using the details set out in the ‘Contacting us’ section below. Using this option deletes your personal data. Some data may need to be retained for longer for legal purposes or in an anonymised form. Please note that this only relates to user research data - to request deletion of other personal data held by FreeAgent, please check the FreeAgent General Privacy Notice for further information.

How we store your data

We take security and privacy seriously. We will endeavour to take all reasonable steps to keep your personal data secure once it has been transferred to our systems. We adopt appropriate, industry-standard data collection, storage and processing practices and security measures to protect against unauthorised access, alteration, disclosure or destruction.

Where we utilise third parties to support our user research process, we will always ensure that, as a minimum, the security policies and confidentiality arrangements of those third parties adhere to the same requirements that we impose and expect.

We are bound by the UKʼs Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR) and fully respect the rights of individuals in compliance with the EU GDPR. FreeAgent does not sell, rent or share data with any third party unless previously agreed as part of any contractual arrangement (or any legal or regulatory requirement).

For further details of the security measures we have implemented, please see our security features page.

What are your rights?

Right to access your personal data

You can ask us to confirm if we are processing your personal data and you may request a copy of your personal data by contacting us at user-research@freeagent.com.

Right to change or withdraw your consent

Where you have given us consent to make use of your personal data for any of the purposes outlined in this notice, you may withdraw that consent by contacting us at user-research@freeagent.com.

Right to rectification

If you need to update out-of-date or inaccurate information we hold about you, please contact us at user-research@freeagent.com.

Right to erasure

If you would like us to delete your data, please contact us at user-research@freeagent.com.

Right to object

In certain circumstances, you may object to our processing of your personal data. If this is the case, please contact us at user-research@freeagent.com.

Right to restrict processing

You can ask us to restrict the processing of personal data we hold about you in certain circumstances. If you wish to do so, please contact us at user-research@freeagent.com.

Right to make a complaint

You may make a complaint about our data processing activities to a supervisory authority. In the UK this is the Information Commissioner’s Office (ICO). Further details can be found on their website.

Contacting us

Please direct any complaints to us in the first instance. You can raise a complaint by contacting us. We will acknowledge receipt of your complaint and aim to respond to you without undue delay, within 30 days. We will keep you updated on progress and provide you with an outcome. If you remain unhappy with our response, you have the right to make a complaint about our data processing activities to a supervisory authority. In the UK this is the Information Commissioner’s Office (ICO). Further details can be found on the ICO website.

Changes to the User Research Privacy Notice

We may modify or update the User Research Privacy Notice from time to time to reflect the changes in our business and practices, so you should review this page periodically.

Getting in touch

If you have any queries relating to the User Research Privacy Notice or FreeAgent’s use of your personal or financial data, please contact our support team at privacy@freeagent.com. Alternatively, our office address is noted below.