SPV Accounts

Terms of service

Last updated 20 October 2026. Questions: support@spvaccounts.co.uk

These terms are the agreement between Northside Software Ltd (“we”, “us”) and you, for your use of SPV Accounts. They have two parts: Part A, the terms of the service, and Part B, the data processing terms, which apply when the records you keep with us include personal data about other people. How we use your details is in the privacy notice.

Part A. The service

1. Who we are and who these terms bind

SPV Accounts is run by Northside Software Ltd, registered in England and Wales, company number 17527774, 114 Clapham Common North Side, London SW4 9SW. If you create an account you are bound by these terms. If you use SPV Accounts for a company or an association (“the company”), these terms bind the company as well, and by accepting them you confirm that you are authorised to accept them, and to bind the company, and if you are not you are personally responsible for any loss that causes. If you are not authorised, do not accept them.

2. The service

SPV Accounts prepares micro-entity accounts and a corporation tax return for UK private limited companies whose only business is letting residential property, from the company’s bank statements. We may add to or change the service. If we remove something you have already paid for during the period you paid for, we will refund the unused part.

3. General information, not advice

SPV Accounts gives general information and software tools. It is not legal, tax, accounting or other professional advice, and using it does not make us your adviser. The company and its directors stay responsible for its records, accounts, tax returns, filings and deadlines, and for checking anything you approve or sign. We take care that the information we give is right and say where it comes from, but the law changes, so check anything important with a qualified professional.

4. Your account

  • Give us accurate details and keep them up to date.
  • Keep your password secret and do not share your login. Each person who needs access should have their own account.
  • You are responsible for what is done with your account. Tell us at once if you think someone else has used it.

5. What you put in

  • You confirm that the records you enter, upload or import are accurate as far as you know, and that you have the right to put them into SPV Accounts, including any personal data about other people.
  • You confirm you are entitled to act for each company you add.
  • You keep your rights in your records. You give us permission to store, process and display them, and to send the emails and documents you ask for, only so that we can provide the service.

6. Signing and filing

When a director approves or signs something online, that is a real approval by that person, recorded with the date, time and a fingerprint of what they saw. Where filing through SPV Accounts is available, filing with Companies House or HMRC sends only what the company’s directors have approved, on the company’s instruction. We do not control how quickly Companies House or HMRC accept, process or reject a filing, or what they charge.

7. Fees and payment

Nothing is charged for using SPV Accounts today. Before you are asked to pay for anything, the price, including VAT, and what it covers will be shown to you, and you will only pay if you choose to. We will update these terms before we start taking payments.

8. Using the service properly

Do not break the law, put other people’s data in without the right to, try to get into records that are not yours, interfere with the service or its security, overload it with automated requests, or copy it to build a competing service. We may suspend an account that does.

9. Availability and changes

We provide the service with reasonable care and skill. We cannot promise it will always be available or error-free, and we may pause it for maintenance. We may change these terms. For a change that matters we will email you before it takes effect, and you can stop using the service if you do not accept it.

10. Our responsibility to you

  • Nothing in these terms limits our liability for death or personal injury caused by our negligence, for fraud, or for anything else the law does not allow us to limit. If you are using SPV Accounts as a consumer, nothing here affects your legal rights, including the right to have a service performed with reasonable care and skill.
  • Otherwise, we are not liable for loss of profit, loss of opportunity, or indirect loss, and not for a penalty, fine or late-filing charge that arises because information was given to us late or wrong.
  • The free parts of the service are provided as they are, at no charge, and to the extent the law allows we are not liable for loss from using them.
  • For anything you pay for, our total liability for it in any year is limited to the fees you paid for it in the 12 months before the claim.

11. Ending

You can delete your account at any time on your account page. It is carried out 30 days later, as the privacy notice explains. We may suspend or close an account that breaks these terms, after warning you where we reasonably can. When an account ends, Part B says what happens to the company’s records, and the privacy notice says what happens to your own details.

12. General

  • Our software and content. We own SPV Accounts, its software, design and the guides and templates we write. We give you a personal, non-transferable right to use them for the service while your account is open. You keep your own records (see section 5).
  • Events beyond our control. We are not in breach if we are delayed or prevented by something outside our reasonable control, such as a failure of the internet, our hosting provider, Companies House or HMRC.
  • The whole agreement. These terms, the privacy notice and anything we show you before you pay are the whole agreement between us about the service. If a part of these terms cannot be enforced, the rest still applies. Only you and we can enforce these terms: nobody else has a right to under the Contracts (Rights of Third Parties) Act 1999. You may not transfer your rights under them without our agreement; we may transfer ours to a business that takes over SPV Accounts.

13. Law and contact

These terms are governed by the law of England and Wales, and its courts have jurisdiction (if you are a consumer living elsewhere in the UK, you keep any right to use your local courts). Questions or complaints: support@spvaccounts.co.uk, or write to us at the address above.

Part B. Data processing terms

These terms apply to the personal data about other people that is in the company’s records on SPV Accounts. “Personal data”, “controller”, “processor”, “data subject” and “personal data breach” have the meanings they have in the UK GDPR. “The company” is the company or association you accept these terms for. They are the contract that Article 28 of the UK GDPR requires between a controller and a processor.

B1. Who is who

  • For the company’s records, the company is the controller and Northside Software Ltd is its processor. We process them only to provide SPV Accounts to the company.
  • For our own data (accounts, the waiting list, security counters, website analytics, and payments), we are the controller, as the privacy notice explains. Part B does not apply to that data.

B2. What we process

  • Subject matter and purpose: providing SPV Accounts to the company.
  • Duration: while the company’s records are on the service, and until they are deleted as set out in B3(g).
  • Nature of the processing: storing, organising, displaying, calculating with, emailing, generating documents from and, where the company instructs it, filing the records.
  • Types of personal data: names and email addresses of directors; bank statement lines (dates, amounts, balances and the descriptions your bank gives them, which can include the names of tenants, payers and suppliers); the names of people and companies a loan is with; mortgage lenders; property addresses; the company’s accounts and tax figures; and the records of directors’ approvals (typed name, email address, time, document fingerprint, internet address and browser details).
  • Data subjects: the company’s directors, the tenants, payers, suppliers and lenders named in its bank statements and records, and the individuals and companies it has loans with.

B3. What we will do

  1. (a) Instructions. We process the company’s records only on its documented instructions. These terms, and the company’s use of the features of SPV Accounts, are its instructions, and it can give more in writing by emailing us. That includes instructions about transfers outside the UK. We process otherwise only if the law requires, and will tell the company first unless the law forbids it. We will immediately tell the company if, in our opinion, an instruction breaks data protection law.
  2. (b) Confidentiality. Everyone we allow to process the records is bound to keep them confidential.
  3. (c) Security. We use appropriate technical and organisational measures to keep the records secure. They include: passwords stored only as salted hashes; sign-in, email and signing tokens stored only as hashes; every request checked against the accounts allowed to see that company’s records; encrypted connections; limits on repeated attempts; and hosting and storage with Cloudflare. We review them as the service changes.
  4. (d) Sub-processors. The company agrees that we may use these sub-processors for its records: Cloudflare (hosting, database and file storage) and Resend (sending emails). We will tell the company by email in good time before adding or replacing one. The company may object on reasonable data protection grounds within that time, and if we cannot meet the objection it may close its account. We put a written contract on each sub-processor that gives the same protection as this Part, and we stay fully liable to the company for it. Our sub-processors are large providers that work from their own standard terms: where they offer audit reports or certifications rather than inspections, we will pass those on to the company. Companies House and HMRC are not our sub-processors: when the company files, it is sending its records to them on its own instruction.
  5. (e) Helping with people’s rights. If a data subject asks us about their data in the company’s records, we will tell the company promptly and not reply except to say we have passed it on. We will do the same with any complaint about the company’s handling of its records. We will help the company reply, including by giving it the relevant records in a usable form.
  6. (f) Breaches and other help. We will tell the company without undue delay after we become aware of a personal data breach affecting its records, with what we know to help it meet its own duties. We will give the help it reasonably needs with security, data protection impact assessments and consulting the regulator.
  7. (g) Deletion and return. When we stop providing the service for the company’s records, we will, at the company’s choice, delete them or return them to it, and delete any copies, unless the law requires us to keep them. On request, and at any time, we will give the company a copy of its records in a usable form. When the last person managing the company’s records deletes their account, we delete the records at the end of the 30-day period the privacy notice describes, unless the company has asked us to return them first.
  8. (h) Proof and audits. We will make available to the company all information necessary to demonstrate that we are meeting this Part, and allow for and contribute to audits, including inspections, by the company or by an auditor it appoints. To keep this workable, we will first answer written questions and give our current description of our security; an inspection, on reasonable notice and in working hours, covers what those do not. It is limited to our handling of the company’s records (not other customers’ data), and the auditor must keep what they see confidential. Each side bears its own costs.

B4. What the company is responsible for

The company is responsible for having a lawful reason to put the records in, for their accuracy, for telling the people in them what it does with their data (the privacy notice helps with this, but does not replace it), and for giving us lawful instructions.

B5. Transfers outside the UK

Some of our sub-processors process data outside the UK, including in the United States. We make sure each such transfer is covered by a UK adequacy decision or by the safeguards that the UK GDPR requires, and tell the company the details if it asks.

B6. Liability and which terms win

Section 10 applies to this Part. If anything in Part A conflicts with Part B about personal data in the company’s records, Part B wins.