AccounTech - Data Protection Policy

Providing assurance when handling your data!

Data Protection

1. In this clause the following definitions shall apply;

'client personal data' means any personal data provided to us by you, or on your behalf, for the purpose of providing our services to you, pursuant to our engagement letter with you;

'data protection legislation' means all applicable privacy and data protection legislation and regulations including Data Protection Act 2018 (DPA 2018), the General Data Protection Regulation (GDPR) as it applies in the UK and the Privacy and Electronic Communications Regulations (PECR) and any applicable national laws, regulations and secondary legislation in the UK relating to the processing of personal data and the privacy of electronic communications, as amended, replaced or updated from time to time;

'controller', 'data subject', 'personal data', and 'process' shall have the meanings given to them in the data protection legislation;

2. We shall each be considered an independent data controller in relation to the client personal data. Each of us will comply with all requirements and obligations applicable to us under the data protection legislation in respect of the client personal data.

3. If you have a data protection concern, please raise it with the person with day to day responsibility for the matter or with the partner or manager. If that does not resolve your concern to your satisfaction, or if you prefer, please contact our data protection compliance officer.

4. We shall only process the client personal data:

a) in order to provide our services to you and perform any other obligations in accordance with our engagement with you;

b) in order to comply with our legal or regulatory obligations; and

c) where it is necessary for the purposes of our legitimate interests and those interests are not overridden by the data subject's own privacy rights.

Our privacy notice contains further details as to how we may process client personal data. This explains how we use and process, and for how long we will retain, such personal data. It also explains the relevant individual's rights as data subject in respect of their personal data, including a right to request details of personal information which we hold about the individual. A copy of our privacy policy is available on request.

5. For the purpose of providing our services to you, we may disclose the client personal data to our regulatory bodies or other third parties (for example, our professional advisors or service providers). The third parties to whom we disclose such personal data may be located outside of the European Economic Area (EEA). We will only disclose client personal data to a third party (including a third party outside of the EEA) provided that the transfer is undertaken in compliance with the data protection legislation.

6. We may disclose the client personal data to other third parties in the context of a possible sale, merger, restructuring or financing of, or investment in, our business. In this event we will take appropriate measures to ensure that the security of the client personal data continues to be ensured in accordance with data protection legislation. If a change happens to our business, then the new owners may use our client personal data in the same way as set out in these terms.

7. We shall maintain commercially reasonable and appropriate security measures, including administrative, physical and technical safeguards, to protect against unauthorised or unlawful processing of the client personal data and against accidental loss or destruction of, or damage to, the client personal data.

8. In respect of the client personal data, provided that we are legally permitted to do so, we shall promptly notify you in the event that:

a) we receive a request, complaint or any adverse correspondence from or on behalf of a relevant data subject, to exercise their data subject rights under the data protection legislation or in respect of our processing of their personal data;

b) we are served with an information, enforcement or assessment notice (or any similar notices), or receive any other material communication in respect of our processing of the client personal data from a supervisory authority as defined in the data protection legislation (for example in the UK, the Information Commissioner's Officer); or

c) we reasonably believe that there has been any incident which resulted in the accidental or unauthorised access to, or destruction, loss, unauthorised disclosure or alteration of, the client personal data.

9. Upon the reasonable request of the other, we shall each co-operate with the other and take such reasonable commercial steps or provide such information as is necessary to enable each of us to comply with the data protection legislation in respect of the services provided to you in accordance with our engagement letter with you in relation to those services.