This notice applies to clients, prospective clients, website visitors, their owners, officers, employees, workers, representatives and other individuals whose personal information we receive while providing professional services or operating our website. It explains our processing as an independent controller. Where we process payroll or similar information solely on a client’s instructions, the separate data-processing schedule also applies.

JPW Accountancy & Advisory Ltd, company number 16998757, is the controller. Our address is Collingwood Buildings, 38 Collingwood Street, Newcastle upon Tyne NE1 1JF. Our Data Protection Officer is Jonathan Williamson. You can contact him at jonathan@jpwaccountancy.co.uk or on 0191 213 5540. Our ICO registration number is ZC113878.

• identity, contact, signature and authentication information
• business, employment, ownership, directorship, partnership, trust and beneficial-ownership information
• financial, accounting, banking, payroll, pension, tax, benefits and transaction information
• identification documents, verification results, sanctions and PEP screening information and information about source of funds or wealth where relevant
• communications, instructions, approvals, complaints, service history and information contained in documents supplied to us
• technical, access and audit-log information generated when portals, websites or software are used
• website information such as IP address, browser and device information, pages visited, cookie choices and information submitted through an enquiry or booking form
• special-category or criminal-offence information where necessary and lawful, for example health information used for payroll statutory payments or information relevant to AML and legal obligations

Connected software: Where our internal software connects to accounting platforms or HMRC, additional information about the information accessed and how those connections operate is provided in our Practice Assistant Privacy Notice at quickbooks.jpwaccountancy.co.uk/privacy.

We obtain information directly from you and from people acting for you. We may also receive it from employees, directors, shareholders, partners, trustees, previous or successor advisers, banks, pension providers, cloud-accounting systems, payroll systems, HMRC, Companies House, identity and screening providers, public registers and other lawful public or commercial sources.

• To provide and administer professional services: contract or steps requested before a contract, and legitimate interests where we serve an organisation rather than the individual concerned.
• To prepare accounting, tax, payroll and company filings: contract, legal obligation or legitimate interests in accurate administration, depending on the work and the person whose information is involved.
• To verify identity, comply with anti-money-laundering and sanctions requirements and prevent fraud: legal obligation and, where applicable, legitimate interests in protecting clients and the practice.
• To communicate, collect fees and manage the relationship: contract or legitimate interests in administration and debt recovery.
• To meet professional, regulatory and insurance requirements and address complaints or claims: legal obligation or legitimate interests in demonstrating compliance and defending claims.
• To secure, back up and improve our systems and respond to incidents: legal obligation or legitimate interests in reliable and secure services.
• To operate the website and respond to enquiries: legitimate interests; consent where required for non-essential cookies and analytics.
• To send optional marketing: consent where required; otherwise legitimate interests for proportionate business-to-business communications with an opt-out.

Consent is not the general basis for routine accounting, tax or payroll work. Where we specifically rely on consent, it may be withdrawn for future processing without affecting processing already carried out or processing supported by another lawful basis.

Some information is required by law or necessary to enter into or perform the engagement. If requested information is not supplied, we may be unable to start or continue work, meet a filing deadline or provide a service. We will explain the consequence where practicable.

• HMRC, Companies House, the National Crime Agency, courts, law-enforcement bodies and other public authorities where authorised or required
• AAT, OPBAS and other professional or regulatory bodies
• professional indemnity insurers, brokers, legal advisers, auditors and other professional advisers
• banks, pension providers and other persons you ask or authorise us to contact
• identity-verification, sanctions-screening, cloud-accounting, payroll, document-management, email, hosting, backup, security, IT-support and payment-service providers
• Reign Accounting Ltd to the limited extent required under our continuity arrangement
• a successor adviser where you authorise professional clearance or transfer of information
• debt-recovery providers and courts where reasonably necessary to recover unpaid fees

Some technology or support providers may store or access information outside the UK. Before making a restricted transfer, we use a lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another permitted safeguard. We also consider appropriate supplementary technical and organisational measures. Contact us for information about the relevant safeguard for a particular transfer.

We use proportionate technical and organisational measures designed to protect personal information against unauthorised or unlawful processing and accidental loss, destruction or damage. These include access controls, confidentiality obligations, multi-factor authentication where supported, encryption in transit, appropriate protection at rest, backups, patching, malware protection, incident response and supplier assessment. No system can be guaranteed completely secure.

Our website uses strictly necessary cookies to operate and remember privacy choices. With consent, it may also use analytics cookies, including Google Analytics, to help us understand visits and improve the site. Analytics information may include device, browser, approximate location and page-interaction information. You can accept, reject or change non-essential cookie choices through the website cookie controls and can also manage cookies in your browser. Withdrawing consent does not affect earlier lawful processing.

Information sent through the website, email or a booking service is used to respond to the enquiry, arrange contact and decide whether we can provide services. Do not send highly sensitive financial or identity documents through an unsecured website form unless we have asked you to use that method.

We retain information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, regulatory, professional, insurance and dispute requirements. The period may be extended where a complaint, enquiry, investigation, litigation hold or other legal requirement applies.

• Client engagement files, working papers, correspondence and advice: normally seven years after the relevant engagement or client relationship ends.
• Accounting and tax records held in the client file: normally seven years after the relevant accounting period or tax year, subject to any longer statutory or dispute requirement.
• AML identity, verification and due-diligence records: normally five years after the business relationship ends or an occasional transaction, unless longer retention is lawfully required or permitted.
• Payroll processing records held for service delivery: for the engagement and normally up to seven years afterwards where needed for legal claims, professional obligations or agreed controller instructions.
• Complaints, claims and regulatory matters: normally seven years after closure, or longer where the limitation period or authority requires.
• Unsuccessful enquiries and prospective-client records: normally 12 months after the last substantive contact unless a longer period is justified.
• Optional marketing preferences: until consent is withdrawn or an objection is made, with a minimal suppression record retained to respect that choice.

Secure backups may retain residual copies for a limited period after deletion from live systems. They remain protected and are not routinely accessed.

• to be informed about processing and to request access to personal information
• to request correction of inaccurate or incomplete information
• to request erasure where there is no lawful reason for continued processing
• to request restriction of processing in applicable circumstances
• to object to processing based on legitimate interests and to object at any time to direct marketing
• to receive certain information in a structured commonly used machine-readable format and transmit it to another controller where data portability applies
• to withdraw consent where consent is the basis of processing
• to complain to the Information Commissioner’s Office

Rights are subject to statutory conditions and exemptions. We may need to verify identity and may retain information where law or professional obligations require it. We normally respond within one month, although the law permits an extension for complex or numerous requests.

We may use automated tools to assist with verification, screening, categorisation, checking or drafting, but we do not currently make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. If that changes, we will provide the information and safeguards required by law.

If you give us information about another person, you must be authorised to do so and must provide that person with any privacy information required by law. This is particularly important for payroll, company ownership and jointly owned property information.