Privacy Policy

Last updated: 24 April 2026 · MMCA Services

Thank you for taking the time to read our privacy notice. We hope it answers your questions, but if you need more information, please contact us at privacy@mmcaservices.com or any local email address listed in Section 16.

We understand that your privacy and the security of your personal data are important to you - they're important to us too. We design our business strategies, products, services, websites, and apps with your privacy in mind.

This privacy notice explains how we handle your personal data. It applies to you if you are:

• Someone who visits our websites
• A customer who has ordered or requested a product or service from us (including trials)
• A user of our products or services (including trials)
• An employee, customer, or supplier of one of our customers who use our products or services
• A vendor or an employee of a vendor providing services to us
• Someone whose personal data we've collected as described in Section 3, including for marketing purposes ("Prospects")

Depending on where you live, additional regional information may apply to you. Please check Section 16 for details on how we handle personal data in your area. We may update this privacy notice from time to time and will post the new versions on our websites.

Who we are

For the purposes of the UK GDPR, the data controller responsible for personal data processed through this website and in connection with our services is MM Consulting & Accounting Ltd, trading as MMCA Services / HiveMTD, a company registered in England and Wales with its registered office at 20a Whinmoor Way, Leeds, West Yorkshire LS14 5NJ.

Company number: 09118765. ICO registration: ZB039817. Professional indemnity insurance: Available on request.

We are supervised for anti-money-laundering purposes by the Association of Accounting Technicians (AAT) under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, and we carry out customer due diligence checks before accepting new clients.

EU/EEA: We do not offer services to, or monitor the behaviour of, individuals located in the European Economic Area from the United Kingdom. We do not process EU-resident personal data on that basis, and are therefore not required to appoint an Article 27 EU representative under the EU GDPR.

1. Definitions

In this privacy notice, certain words have specific meanings:

• Solutions: Our software products, features, services, and applications, including any trials.
• Websites: hivemtd.com, mmcaservices.com, any linked pages, and any other websites we control.
• You / your: The person reading this notice or anyone whose personal data we process.
• We / us / our / MMCA Services / HiveMTD: MM Consulting & Accounting Ltd and its group companies (the Group). Depending on where you are, different companies in our group may handle your personal data. You can find a list of these companies on our website.

2. How to contact us

We have a Chief Data Protection Officer (DPO) and local privacy experts to help with any privacy-related questions or requests. You can contact our local privacy experts or DPOs using the details provided in Section 16 of this notice. If you're unsure, please email us at privacy@mmcaservices.com.

3. Providing us with someone else's personal data

If you give us personal data about someone else, you need to make sure you're allowed to share it and comply with any legal obligations. This might include explaining to them why you're giving us their data and what we'll do with it, and getting their consent if required by law. We also recommend asking them to read this privacy notice.

4. When we collect personal data

We may collect personal data about you or others, either directly or indirectly, as allowed by law. We collect your personal data when:

1. You interact with us directly: This could be through our websites, Solutions, forms (even if you don't complete them), surveys, competitions, social media, or when you contact us by phone, email, chat, fax, or mail.
2. You use our Websites and Solutions: We may collect data using cookies or similar technologies (see our Cookie Policy for details).
3. You or your organisation provide services to us: We may collect basic personal data about you, mainly professional contact details.
4. Third parties provide us with your personal data: This can happen when:
   • We work with a business partner who knows you.
   • Someone who uses our Solutions gives us your data.
   • You use our Solutions that require us to get your data from a third party you've authorised.
   • You're an employee of one of our customers, and your employer provides your contact details.
   • We receive data from government agencies, credit reporting agencies, marketing companies, or social media platforms.
5. We acquire another company: If we buy a business that had a relationship with you.
6. You participate in our events: When you attend seminars, training, or other events we organise, either virtually or in person.

5. What personal data we collect

We collect the following types of personal data:

1. Contact information: Name, address (business or personal), email address, phone number.
2. Billing and payment information: Payment details, amounts, dates, transaction history, bank details, tax data, user details, identification documents.
3. Online usage data: Services you've viewed or searched for, response times, errors, time spent on pages, interactions (like clicks and scrolling), username, IP address, browsing history, passwords, device type, time zone, browser type, social media profile info, device ID, location data, operating system.
4. Communication preferences: Marketing preferences, interests, preferred contact methods, consent records, business information like company name and number of employees.
5. Organisation details: Workplace, job title, and work contact information.
6. Physical access data: Details of visits to our premises, CCTV images or recordings, car registration data, event registration data, dietary requirements, access needs, photos taken at our events.
7. Voice recordings: When you contact us by phone or other voice platforms.
8. Correspondence: Any personal data you provide when contacting us (e.g., support requests, questions).
9. Data from using our Solutions: If you or your organisation use our Solutions, we may collect:
   • MMCA Services IDs: Email address, password, phone number.
   • HivePayroll, HiveMTD, and accounting products: Business details, contact info, business type, registration info, payment details, transaction data, invoices, expenses, VAT details, payroll information, usernames, product IDs, and data from integrations or added features.
   • HR products: Business details, contact info, images, payroll info, appraisals, absences, holidays, disciplinary records, job and salary history, emergency contacts, bank information, and data from integrations or added features.
   • Zucodu: Background checks, beneficiary details, education and skills, employment information, family and financial information, government IDs, recordings, travel and expenses, feedback, insurance details, marital status, memberships, user account info, workplace welfare, and data from integrations or added features.
   • Enterprise Resource Planning and Automation: Company names, registration numbers, addresses, bank details, contact info, payroll info, employee details, authentication details, inventory, orders, warehouse information, and data from integrations or added features.

6. Why we process your personal data

We process your personal data for the following reasons:

a. To provide our services (Solutions)

• Set up and manage your account: To establish you as a customer, provide the Solutions you've requested or purchased, and send you updates or service-related messages.
• Billing and payments: To handle billing, payments, and manage our relationship with you.
• Customer service and support: To help with troubleshooting, support requests, or any issues you may have.
• Create and manage MMCA Services IDs: To give you access to our Solutions through unique user IDs.

b. To improve and secure our Solutions

• Enhance user experience: To monitor, measure, and improve our content, websites, and Solutions.
• Security and testing: To test and improve the security and performance of our websites and services.
• Research and development: To develop new products and improve existing ones.
• Analyse usage: To understand how our websites and Solutions are used, so we can make them better.

c. To communicate and market to you

• Surveys and feedback: To conduct customer research and get your opinions on our services.
• Newsletters and marketing communications: To send you information about our business, products, and offers that may interest you (with your consent).
• Event management: To organise events you may attend and contact you afterward for feedback.

d. To operate our business

• Due diligence: To perform necessary checks for business purposes.
• Legal compliance: To comply with legal or regulatory obligations, including responding to law enforcement or regulatory requests.
• Protect legal rights: To detect, prevent, or investigate illegal activities, and to establish or defend legal rights.
• Business planning: To manage and deliver our global business strategies.
• Staff training: To train our employees and improve their performance.
• Business transactions: To manage any potential sale, purchase, restructuring, or merging of our business.

e. To perform analytics and digital advertising

• Targeted advertising: To deliver relevant ads and marketing campaigns based on your use of our websites and Solutions.
• Location-based services: To provide content relevant to your location (with your consent).
• Ad effectiveness: To ensure our advertisements are effective and relevant to users.

7. Profiling and automated decision-making

We may use your personal data to understand your interests and preferences, allowing us to offer better services and more relevant communications. This might involve analysing your interactions with our websites and Solutions to predict what you might be interested in. We do not make any automated decisions that have significant or legal effects on you.

Please note that we may update this privacy notice from time to time. Any changes will be posted on our websites. If you have any questions or need more information, feel free to contact us at privacy@mmcaservices.com.

8. Artificial Intelligence and Machine Learning

We are committed to innovation and continuously look for new ways to improve our Solutions. Using Artificial Intelligence (AI) and Machine Learning (ML) helps us enhance our services by offering new features and automating tasks like processing invoices automatically.

What is Machine Learning (ML)?

ML is a type of AI that uses data and algorithms to recognise patterns, similar to how humans learn. It allows systems to learn and improve from experience without being explicitly programmed. ML models are programs trained to identify patterns in data they've never seen before.

How we use ML

We use ML in some of our Solutions and may process personal data listed in Section 5(9), "Data from using our Solutions," to deliver these ML-powered services. Personal data is generally used for:

1. Building and continuously training ML models: We create and train ML models using data, including personal data, so they can perform specific tasks. For example, to automate invoice processing, we build an ML model that recognises specific data fields in invoices. We train it on many invoices so it learns where the fields are located and what they usually contain. We continually update and train the model with new invoices to ensure its accuracy.
2. Providing the Solution: Personal data entered into the Solution is used by the ML model to deliver its service. For instance, the trained ML model automatically recognises fields in new invoices and fills them into our Solutions.

Our use of AI and ML is not intended to make decisions about individuals. Our goal is to automate manual and time-consuming tasks for the benefit of our customers and users.

9. The MMCA Services Network

We have created a trusted network called the MMCA Services Network to connect our Solutions and those of our partners. The aim is to provide you with additional, innovative, and integrated Solutions (the "MMCA Services Network Services") to help automate your workflows and improve your experience. To do this, data you input into our Solutions, as listed in Section 5(9), "Data from using our Solutions," may be shared with other Solutions and platforms (collectively, the "MMCA Services Network Platform").

In this context, we mostly act on behalf of our customers (as a data processor under UK data protection law). Processing personal data to provide MMCA Services Network Services is covered by our Data Protection Agreements.

However, we may process data in the MMCA Services Network Platform as a data controller for the following purposes:

• Building and training ML models, as described in Section 8.
• Providing ML-powered services, as described in Section 8.
• Purchasing data sets from third parties to improve the accuracy of data held in the MMCA Services Network Platform.
• Research and development to improve our Solutions based on data processed by the MMCA Services Network Platform.

Any processing of personal data by us as a data controller will be carried out in accordance with this privacy notice.

10. Mobile data

We may collect personal data through mobile apps that you or your users install to access our Websites or Solutions, or to provide services related to those apps (like syncing information).

These apps might be our own Solutions or provided by third parties. If you're using a third-party app, please read their privacy notice. We're not responsible for those apps or how they use your personal data.

Mobile apps may provide us with data related to your use of the app and our Websites or Solutions accessed through it. We may use this data to provide and improve the app or our own services. For example, activities within the app may be logged for review.

You can adjust privacy settings on your mobile device, but this may affect how the app works and interacts with our Websites and Solutions.

11. How long do we keep personal data?

We keep your personal data during and after your relationship with us, as long as allowed for legal, regulatory, fraud prevention, and legitimate business purposes, in line with our internal policies. For more information on data retention, please contact the MMCA Services Privacy Office at privacy@mmcaservices.com.

12. How is personal data shared?

Sometimes we need to share your personal data with third parties, usually because:

• You've asked us to.
• We're required by law.
• A third party integrates with our Solution or provides a service to us or you.

Here's who we may share your data with and why:

• Service providers and agents: Companies that process data on our behalf (like cloud storage providers, payment processors, or those who help us communicate with you). Reason: To help us provide you with the Solutions and information you've requested or that we think may interest you.
• Partners: System implementers, resellers, software vendors, and developers. Reason: To allow them to provide you with Solutions, services, and information you've requested or that they believe may interest you.
• Other companies in our Group: Reason: To help provide you with Solutions and information you've requested or that we think may interest you, or in case of a restructuring.
• Payment facilitators: Such as banks or financial institutions. Reason: To help us process payments for our Solutions.
• Other controllers: Like academic or research organisations. Reason: For research necessary for our or another organisation's legitimate interests. We take steps to protect your data, like anonymising it before sharing.
• Third parties you have a relationship with: Such as social media providers or partners. Reason: For marketing and targeting purposes.
• Legal and regulatory bodies: Government agencies, regulators, or law enforcement. Reason: To comply with laws and regulations and to protect our business.
• In case of business transactions: If we sell or buy any business or assets. Reason: In the context of an acquisition, sale, or restructuring.

When we share data with third parties providing services to us or you, we have agreements in place to ensure your data is protected and used only for agreed purposes, in accordance with applicable laws.

Sub-processors for this website

The website itself uses three sub-processors. All relate to your visit to mmcaservices.com:

Tools used for client engagements

If you engage us for professional services, we may use accounting software (such as Sage, Xero or SAP) and our own product HiveMTD to deliver that engagement. The data flows, sub-processors and Data Processing Agreements for those services are set out in your engagement letter — separately from this website privacy notice. HiveMTD has its own privacy policy published on the HiveMTD website.

Statutory regulators and other legal recipients

As a regulated firm we are required to share certain information with our anti-money-laundering supervisor (the Association of Accounting Technicians) and other UK statutory bodies (for example, HMRC and the Information Commissioner's Office). These are recipients we are obliged to disclose to by law and are not data processors.

This list will be updated if we add, replace or remove a website sub-processor. If you would like to be notified of changes, please email privacy@mmcaservices.com.

13. Do we use cookies and similar technologies?

Yes, our Websites and Solutions may use cookies and similar technologies. These help us:

• Verify information from your device to ensure our services are used correctly and to troubleshoot issues.
• Obtain information about technical errors or problems with our Websites and Solutions.
• Comply with legal or regulatory obligations.
• Understand how you use our Websites and Solutions.
• Collect statistical information about the operating system and environment from which you access our Solutions.

You can find more details in our specific cookie policies. The cookie policy for this site is available here; the HiveMTD cookie policy is published at hivemtd.com. For Solutions that use cookies, a policy will be available within the Solution, usually in the Help Centre.

If you follow a link from our Website or Solutions to another site, our privacy notice doesn't apply there. We're not responsible for how other sites handle your personal data. Please read the privacy information of any third-party sites you visit.

14. What data privacy rights do you have?

Data privacy rights vary by region. Please refer to Section 16 below, which covers data privacy rights specific to your location.

15. How is your personal data kept secure?

We take appropriate technical and organisational measures to protect your personal data from unauthorised access, use, loss, destruction, or damage.

While we strive to protect your data, we can't guarantee its security during transmission over the internet or similar networks. If we've given you (or you've chosen) a password to access certain areas of our Websites or Solutions, please keep it safe. Choose a strong password, don't reuse old ones, and don't share it with unauthorised people.

If you believe your personal data has been compromised in connection with our Websites or Solutions, please contact us at privacy@mmcaservices.com.

16. If you are based in the United Kingdom

Key data protection laws

• United Kingdom: UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, and the Privacy and Electronic Communications Regulations.

Controllers and processors

This privacy notice describes how we process your personal data as a "data controller" under UK law. A data controller decides how and why your data is processed.

Depending on where you are, a different MMCA Services company may be the data controller. You can find a list of our companies by region on our website.

Sometimes we process personal data on behalf of someone else (like our customers or partners). In those cases, we're a "data processor," and we use your data according to the controller's instructions, including the terms of the product or service you're using and our Data Processing Agreement.

If we're processing your data as a data processor, you should also read the privacy notice of the data controller (e.g., your employer or service provider).

Your data protection rights

If you're in the UK, you have the following rights:

• Right to be informed: About how we process your personal data.
• Right of access: To obtain a copy of your personal data.
• Right to rectification or erasure: To correct or delete your data, or restrict how it's processed.
• Right to object: To processing your data for certain purposes, like direct marketing or when processing is based on our legitimate interests.
• Right to data portability: To have your data transferred to you or another company in a structured, commonly used format.
• Right to withdraw consent: If processing is based on consent, you can withdraw it, subject to legal or contractual restrictions.
• Right against automated decision-making: To object to decisions made solely by automated means, including profiling.
• Right to complain: To the data protection authority in your location. In the UK, this is the Information Commissioner's Office (ICO).

Please note that some rights may be limited by legal restrictions. We'll explain any limitations when responding to your request.

If you believe we hold incorrect personal data about you, or if your information changes, please let us know so we can update our records.

To exercise your data protection rights, please contact us at privacy@mmcaservices.com.

If you don't want us to use your personal data as described, we may not be able to provide you with full access to our Websites or Solutions.

International transfer of personal data

Personal data in the United Kingdom is protected by the UK GDPR and the Data Protection Act 2018. Some countries may not offer the same level of protection. The UK Government maintains a list of countries assessed as providing adequate protection.

Our websites and some Solutions may be hosted outside the UK, meaning we might transfer your data to countries without a UK adequacy decision. We may also use service providers outside the UK.

We take steps to ensure appropriate measures are in place to protect your data when it is transferred internationally, in accordance with UK data protection law. This may include using the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

If you have given consent to Analytics cookies, we use Google Analytics 4 (provided by Google LLC, a US-based company and a separate controller for its own aggregated product-improvement purposes). Where this involves a transfer of your data to the United States, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses together with Google's own contractual commitments as the transfer mechanism. You can withdraw analytics consent at any time using the "Cookie preferences" link in the footer of this site; no Analytics cookies are set until you opt in.

For more information on international data transfers, please contact privacy@mmcaservices.com.

How can you contact us?

If you have any questions about this privacy notice or wish to exercise your data privacy rights, please contact our Chief Data Protection Officer by emailing privacy@mmcaservices.com.

Thank you for reading the MMCA Services / HiveMTD privacy policy.