CC VIRTUAL BOOKKEEPING

 

Privacy Notice

 

Contact Details

​

The Data Protection officer is Caroline Cant, who can be contacted about anything to do with your personal data and data protection, including to make a subject access request, using the following details:

​

Email address: caroline@ccvirtualbookkeeping.com

Postal address: 11 West Way, Goring, Reading, RG8 0BX

Telephone number: 07540929116 

 

Introduction

​

The Data Protection Act 2018 (DPA) and the General Data Protection Regulation (GDPR) requires organisations that process personal data to meet certain legal obligations. I am a data controller within the meaning of the Act and I process personal data.

I am committed to complying with the requirements of the DPA and GDPR. As a result I confirm that personal information I process will only be held (or otherwise processed) to the extent necessary in order to provide the agreed professional services and for any other purpose specifically agreed.

 

Information Collected

​

I am entering into a contract with you and will be processing data in order to fulfil our contractual obligations. In order to provide the agreed services I need to collect, retain and process personal data about you. This data is needed in order to:

​

• Take you on and retain you as a client according to the provisions of UK laws and professional regulations (eg anti-money laundering requirements).

• Prepare and file accounts and tax returns

• Provide advice on tax and national insurance liabilities

• Provide ad hoc advice.

 

If the information required is not provided, I may not be able to provide the required services which would trigger the disengagement provisions in the terms and conditions.

The personal data that we will collect and process will include:

 

• Names and addresses

• Email addresses

• Telephone numbers

• Information held by HMRC

• Information required to prepare tax returns

• Information required to prepare your accounts

• Correspondence between us

 

How Information is Collected

 

I collect information that is supplied about you from:

 

• You

• A spouse/partner

• HMRC

• Your organisation

• Electronic ID verification providers

• Other third parties (eg banks, investment managers etc) as authorised by you.

 

How Your Information is Used

 

I may use information I hold about you:

 

• to provide services under the contract in force between us

• to contact you about other services we provide which may be of interest to you if you have consented to us doing so.

• to meet other legal and regulatory requirements.

• for other legitimate interests.

 

We will retain records based on our retention policy so that I can defend ourselves against potential legal claims or disciplinary action which can be brought within statutory time limits.

​

I may also use information from other people or organisations when carrying out these activities. 

​

There is no automated decision-making involved in the use of your information and therefore no data portability.

​

Where I use subcontractors they will comply with General Data Protection Regulation (GDPR) requirements.

 

Lawful basis for processing personal data

 

Personal data may be processed on a contract basis under the engagement letter and provision of services agreements.

 

Personal data may be processed on a consent basis when meeting clients’ wider expectations of my/our professional relationship.

 

Personal data may be processed on the legal obligations and/or public interest bases in order to comply with legal requirements.

 

Personal data may be processed in order to further our legitimate interests.

 

Transferring Personal Data Outside the United Kingdom (UK)

 

We will not transfer the personal data we collect about you outside of the UK.

 

Information Which May be Given to Others

 

In order for me to provide the agreed services, I may provide personal data about you to:

 

• HMRC

• other third parties you require me to correspond with (for example, finance providers, pension providers (including auto-enrolment) and investment brokers.

• subcontractors who are bound by the same professional and ethical obligations as the principals and employees of the practice

• an alternate appointed by me in the event of incapacity or death

• tax insurance providers

• professional indemnity insurers

• our professional body Institute of Certified Bookkeepers (ICB) or an external reviewer in relation to quality assurance.

 

I need to give information to these other parties in order to fulfil my contractual obligations to you and therefore it is not possible to opt out of the provision of information to these parties. If you ask me not to provide information I may need to cease to act.

 

If the law allows or requires during the period of my contractual arrangements or after I have ceased to act I may give information about you to:

 

• the police and law enforcement agencies

• courts and tribunals

• the Information Commissioner’s Office (ICO).

 

In addition, after I have ceased to act I may give information about you to:

 

• my professional indemnity insurers or legal advisers where I need to defend ourselves against a claim

• my professional disciplinary body where a complaint has been made against me in order to defend ourselves against a claim.

• your new advisers or other third parties you ask me to give information to.

 

Data Security

 

I have put in place appropriate and proportionate security measures to address the risk of personal data being lost, used, altered or accessed in an unauthorised way. I limit access to personal data to those who have a business need to access it, and who will only process the personal data on our instructions.

 

Nevertheless, no data transmission over the internet, or any other network, can ever be regarded as wholly secure, and I have in place measures to deal with any suspected breach of data security. Those measures include policies and procedures, which are periodically reviewed to ensure they are effective and fit for purpose.

 

Retention of Information

 

When acting as a data controller and in accordance with recognised good practice within the tax and accountancy sector I will retain all of records relating to you as follows:

 

• Where tax returns and accounts have been prepared it is my policy to retain information for seven years from the end of the tax year to which the information relates.

• Where ad hoc advisory work has been undertaken it is my policy to retain information for seven years from the date the business relationship ceased.

• Where I have an ongoing client relationship permanent information (the data supplied by you and others which is needed for more than one year’s tax and accounts compliance) including, for example, capital gains base costs and claims and elections submitted to HMRC, are retained throughout the period of the relationship but will be deleted seven years after the end of the business relationship unless I am asked to retain it for a longer period by our clients.

• Under the Money Laundering Regulations (MLR 2017) personal data must normally be destroyed within specified time limits but where contractual agreement is in place this is taken as agreement under Regulation 40 (5) MLR 2017 to retain records for the longer period of seven years.

 

Requesting Information Held About You (the Right to Access)

 

Requests to see records and other related information that the firm holds about you are known as ‘subject access requests’ (SAR). I have set out further details on SARs below.

 

Requests in Writing

 

Please provide all requests in writing to the individual at the top of this notice.

 

To help provide the information on a timely basis you may need to provide copies of id and proof of address.

 

Asking someone else to make a subject access request on your behalf

 

You can ask someone else to request information on your behalf – for example, a friend, relative or solicitor. I must have your authority to do this. This is usually a letter signed by you stating that you authorise the person concerned to write to for information about you, and/or receive my reply.

 

When We Won’t Release Information

 

The law allows me to refuse your request for information in certain circumstances – for example, if you have previously made a similar request and there has been little or no change to the data since the original request.

 

The law also allows me to withhold information where, for example, release would be likely to:

 

• prejudice the prevention or detection of crime

• prejudice the apprehension (arrest) or prosecution of offenders

• prejudice the assessment or collection of any tax or duty

• reveal the identity of another person, or information about them.

 

Where I am unable to consent to your request I will set out the reasons in writing.

 

Putting Things Right (the Right to Rectification)

 

Should information you have previously supplied to me be incorrect, please inform me immediately so I can update and amend the information I hold.

 

Deleting your Records (the Right to Erasure)

 

In certain circumstances it is possible for you to request me to erase your records and further information is available on the ICO website (www.ico.org.uk). If you would like your records to be erased, please inform me immediately and I will consider your request. In certain circumstances I have the right to refuse to comply with a request for erasure and if applicable I will supply you with the reasons for refusing your request.

 

Restrictions on Processing (the Right to Restrict Processing and the Right to Object)

 

In certain circumstances you have the right to ‘block’ or suppress the processing of personal data or to object to the processing of that information. For further information refer to the ICO website (www.ico.org.uk). Please inform me immediately if you want me to cease to process your information or you object to processing so that I can take the appropriate action.

 

Withdrawal of Consent

 

Where you have consented for me to contact you with details of other services I provide I may continue to process your data and contact you for that purpose after my contractual relationship ends. You may withdraw consent for the firm to contact you in relation to details of other services I provide at any time during the performance of the contract or thereafter. I will then cease to process your data but only in connection with contacting you with details of other services I provide. Note that the withdrawal of consent does not make the other bases on which I am processing your data unlawful. I will therefore still continue to process your data under the terms of my contract and for other reasons set out in this privacy notice.

 

Obtaining and Reusing Personal Data (the Right to Data Portability)

 

The right to data portability only applies:

 

• to personal data an individual has provided to a controller;

• where the processing is based on the individual’s consent or for the performance of a contract; and

• when processing is carried out by automated means

 

You may be able to request your personal data in a format which enables it to be provided to another organisation. I will respond to any requests made without undue delay and within one month. I may extend the period by a further two months where the request is complex or a number of requests are received but I will inform you within one month of the receipt of the request and explain why the extension is necessary.

 

Complaints

 

If you have any questions or concerns regarding my processing of personal data, you can complain to me as set out in the terms and conditions. If you are dissatisfied with the response, then you can refer to the ICO.

 

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

 

You can also complain to our professional body - Institute of Certified Bookkeepers (ICB) as set out in the terms and conditions.

 

Privacy Notice Confirmation

 

• I have read, understand and accept the basis on which my information will be dealt with as set out in the privacy notice provided.

• I agree to your appointed alternate having access to my records in the event of your illness or permanent incapacity.

• I understand that you will communicate or transfer data with me using any or all of the following:

​

1. Post/Hard-copy documents

2. Password-protected emails

3. Encrypted emails 

4. Unencrypted emails (without attachments)

5. Secure Portals

6. Cloud-based software

 

• I accept the risks of you corresponding with me by email that is not encrypted or password protected.