(Last Revised June 2018)
Privacy notice for Charles & Co
Charles & Co takes the protection of your privacy very seriously. We will only use your personal information to deliver the services you have requested from us, and to meet our legal responsibilities.
How do we collect information from you?
We obtain information about you when you engage us to deliver our services and/or when you use our website, for example, when you contact us about our services.
What type of information do we collect from you?
The personal information we collect from you will vary depending on which [products and/or] services you engage us to deliver. The personal information we collect might include your name, address, telephone number, email address, your Unique Tax Reference (UTR) number, your National Insurance number, bank account details, your IP address, which pages you may have visited on our website and when you accessed them.
How is your information used?
In general terms, and depending on which services you engage us to deliver, as part of providing our agreed services we may use your information to:
We are required by legislation, other regulatory requirements and our insurers to retain your data where we have ceased to act for you. The period of retention required varies with the applicable legislation but is typically five or six years. To ensure compliance with all such requirements it is the policy of the firm to retain all data for a period of 7 years from the end of the period concerned.
Who has access to your information?
We will not sell or rent your information to third parties.
We will not share your information with third parties for marketing purposes.
Any staff with access to your information have a duty of confidentiality under the ethical standards that this firm is required to follow.
Third Party Service Providers working on our behalf
We may pass your information to our third party service providers, agents, subcontractors and other associated organisations for the purposes of completing tasks and providing services to you on our behalf, for example to process payroll or basic bookkeeping. However, when we use third party service providers, we disclose only the personal information that is necessary to deliver the service and we have a contract in place that requires them to keep your information secure and not to use it for their own purposes.
Please be assured that we will not release your information to third parties unless you have requested that we do so, or we are required to do so by law, for example, by a court order or for the purposes of prevention and detection of crime, fraud or corruption.
How you can access and update your information
Keeping your information up to date and accurate is important to us. We commit to regularly review and correct where necessary, the information that we hold about you. If any of your information changes, please email or write to us, or call us using the ‘Contact information’ noted below.
You have the right to ask for a copy of the information Charles & Co holds about you.
Security precautions in place to protect the loss, misuse or alteration of your information
Whilst we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk.
Once we receive your information, we make our best effort to ensure its security on our systems. Where we have given, or where you have chosen, a password which enables you to access information, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.
Your data will usually be processed in our offices in the UK. However, to allow us to operate efficient digital processes, we sometimes need to store information in servers located outside the UK, but within the European Economic Area (EEA). We take the security of your data seriously and so all our systems have appropriate security in place that complies with all applicable legislative and regulatory requirements.
We may occasionally contact you by post, email or telephone with details of any changes in legal and regulatory requirements or other developments that may be relevant to your affairs and, where applicable, how we may assist you further. If you do not wish to receive such information from us, please let us know by contacting us as indicated under ‘Contact information’ below.
Access to your information:You have the right to request a copy of the personal information about you that we hold.
Correcting your information: We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Deletion of your information: You have the right to ask us to delete personal information about you where:
you consider that we no longer require the information for the purposes for which it was obtained
Restricting how we may use your information: In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where there is no longer a basis for using your personal information but you do not want us to delete the data. Where this right is validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Objecting to how we may use your information: Where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue. You have the right at any time to require us to stop using your personal information for direct marketing purposes.
Withdrawing consent to use your information: Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.
Please contact us in any of the ways set out in ‘Contact information’ below if you wish to exercise any of these rights.
Changes to our privacy notice
We keep this privacy notice under regular review. Paper copies of the privacy notice may also be obtained from 3 Murray Street, Llanelli, Carmarthenshire, SA15 1AQ.
This privacy notice was last updated on 28th February 2019.
We seek to resolve directly all complaints about how we handle your personal information but you also have the right to lodge a complaint with the Information Commissioner’s Office at:
Information Commissioner's Office
Telephone - 0303 123 1113 (local rate) or 01625 545 745
Appendix 1 – Processing of customer personal data
This Appendix gives more information on the processing of customer data in accordance with Article 28(3) of the General Data Protection Regulation.
In respect of the client personal data, unless otherwise required by applicable laws or other regulatory requirements, we shall:
A. process the client personal data only in accordance with your lawful written instructions, in order to provide you with the services pursuant to our engagement with you and in accordance with applicable data protection legislation;
B. disclose and transfer the client personal data to our regulatory bodies or other third parties (for example, our professional advisors or service providers) as and to the extent necessary in order to provide you with the services pursuant to our engagement with you in relation to those services;
C. disclose the client personal data to courts, government agencies and other third parties as and to the extent required by law;
D. maintain written records of our processing activities performed on your behalf which shall include: (i) the categories of processing activities performed; (ii) details of any cross border data transfers outside of the European Economic Area (EEA); and (iii) a general description of security measures implemented in respect of the client personal data;
E. maintain commercially reasonable and appropriate security measures, including administrative, physical and technical safeguards, to protect against unauthorised or unlawful processing of any client personal data and against accidental loss or destruction of, or damage to, such client personal data.
F. return or delete all the client personal data upon the termination of the engagement with you pursuant to which we agreed to provide the services;
G. ensure that only those personnel who need to have access to the client personal data are granted access to it and that all of the personnel authorised to process the client personal data are bound by a duty of confidentiality;
H. notify you if we appoint a sub-processor (but only if you have given us your prior written consent, such consent not to be reasonably withheld or delayed) and ensure any agreement entered into with the relevant sub-processor includes similar terms as the terms set out in this clause;
I. where we transfer the client personal data to a country or territory outside the EEA to do so in accordance with data protection legislation;
J. notify you promptly if:
i. we receive a request, complaint or any adverse correspondence from or on behalf of a relevant data subject, to exercise their data subject rights under the data protection legislation or in respect of the client personal data; or
ii. we are served with an information or assessment notice, or receive any other material communication in respect of our processing of the client personal data from a supervisory body (for example, the Information Commissioner’s Office);
K. notify you, without undue delay, in the event that we reasonably believe that there has been a personal data breach in respect of the client personal data;
L. at your cost and upon receipt of your prior written notice, allow you, on an annual basis and/or in the event that we notify you of personal data breach in respect of the client personal data, reasonable access to the relevant records, files, computer or other communication systems, for the purposes of reviewing our compliance with the data protection laws.
Without prejudice to the generality of clause 13.1, you will ensure that you have all necessary appropriate consents and notices in place to enable the lawful transfer of the client personal data to us.
Should you require any further details regarding our treatment of personal data, please contact our data head of privacy email@example.com.
The following details are also required by Article 28(3) of the GDPR
1. Subject matter and duration of the processing of client personal data
The subject matter and duration of the processing of the client personal data are set out in the engagement letter between us and relate to provision of payroll services.
2. The nature and purpose of the processing of client personal data
The processing of client personal data is in order to calculate payroll and deductions and arrange payments to HMRC and the employees.
3. The types of client personal data to be processed
4. The categories of data subject to whom the client personal data relates
The client personal data relates to employees.
5. Your obligations and rights
Your obligations and rights are set out in the engagement letter between us.