GDPR and UK Data Protection

For the records we hold about our own clients and their contacts we act as a data controller. Where we process personal data on your instructions as part of a service, most commonly payroll data about your employees or contact records in your sales ledger, we act as your processor and you remain the controller. In that situation we only use the data to deliver the agreed service, and never for our own purposes.

• We collect only the information we actually need to deliver your work and meet our statutory duties
• We are clear at the outset about why we hold it and we do not repurpose it without telling you
• We keep records accurate and update them when you tell us something has changed
• We hold information no longer than our retention schedule allows
• We keep it secure with role based access, restricted sensitive fields and an audit trail
• We can demonstrate how we meet these duties if you or a regulator asks

When we process personal data on your behalf, we commit to the following.

• We act only on your documented instructions and within the scope of the engagement letter
• We keep the data confidential and make sure our staff are bound by the same duty
• We apply appropriate technical and organisational security measures
• We do not appoint a subprocessor without informing you, and any subprocessor is bound by equivalent terms
• We assist you in responding to requests from individuals about their data
• We help you meet your own breach reporting and impact assessment duties
• At the end of the engagement we return or securely delete the data, subject to any legal duty to retain it

Our client system applies access control at record level, so staff see only the clients they are responsible for, and at field level for sensitive items. Fees and rates, bank details, Companies House authentication codes and personal tax references such as National Insurance numbers, dates of birth and personal Unique Taxpayer References are restricted to the roles that need them. Financial data is never visible in client facing views. Every create, update and delete on a core record is logged with the user and timestamp.

Where we run your payroll we handle data about your employees, including names, addresses, National Insurance numbers, pay, deductions and pension contributions. You are the controller for that data and are responsible for telling your employees that a payroll bureau processes it on your behalf. We use it only to run the payroll, make the required Real Time Information submissions to HM Revenue and Customs, and meet automatic enrolment duties.

We investigate any suspected breach immediately and record what happened, the data involved and the action we took. Where a breach is likely to result in a risk to individuals we report it to the Information Commissioner's Office without undue delay and within 72 hours of becoming aware of it. Where we are acting as your processor we will tell you without undue delay so that you can meet your own reporting duty, and we will give you the information you need to do so.

Our data is held in the United Kingdom or the European Economic Area wherever possible. Where a supplier stores data elsewhere, we rely on UK adequacy regulations or on the International Data Transfer Agreement together with a transfer risk assessment, so that the level of protection travels with the data.

Requests for access, correction, deletion, restriction, portability or objection should be sent to info@acumenaccountants.co.uk. We log every request, confirm the identity of the person making it and respond within one month. Where we cannot comply in full, for example because tax law requires us to keep a record, we explain which part we can act on and why the rest must remain.

Everyone in the practice receives data protection and anti money laundering training when they join and at regular intervals afterwards. Access rights are reviewed when a role changes and removed on the day someone leaves. Responsibility for data protection sits with the partners, who review our retention schedule and security arrangements annually.

For detail on the specific categories of information we hold, our lawful bases and retention periods, see our privacy policy. For the contractual basis of our work, see our terms and conditions.

Data protection queries should be addressed to Acumen+, London, United Kingdom, or emailed to info@acumenaccountants.co.uk. You may also contact the Information Commissioner's Office at ico.org.uk.