Privacy Notice

‍

This is the Privacy Notice for Ekstra Accounting Solutions Ltd.

The purpose of this notice is to inform you about how and why your personal data is used so that we are as transparent as we possibly can, and to ensure that you are aware of your rights under UK data protection legislation (UK General Data Protection Regulation, Data Protection Act 2018).

‍

The Company

Ekstra Accounting Solutions is a company registered with Companies House, registration number NI067186 and with the ICO under registration ZB165831. We are a data controller for the personal data we collect from you. The owner of Ekstra Accounting Solutions Mrs Janet Jensen is the designated data protection lead.

‍

Our correspondence address is Office 9 -The Foundry, East Belfast Enterprise Centre, 68-72 Newtownards Road, Belfast, Co Antrim, BT4 IGW.

‍

The purpose for processing your data and our basis for doing so.

We process personal data so we can provide business accounting and related services (such as company accounts, tax returns, business advice etc.) to clients and engage with prospective clients and partners. We also process personnel data where necessary to comply with legal and regulatory obligations, including UK anti-money laundering requirements, and for marketing purposes where permitted by applicable law.

‍

In processing your data, we must establish our legal basis for doing so and the legal basis can be different depending on circumstances in which we process it. References to the basis of processing e.g.,” (Article. 6.1.f)” are a reference to the article of the UK General Data Protection Regulation under which we undertake the processing in question.

‍

If you are a client, we may process the following types of personal data about you:

‍

• Your full name.
• Your postal address.
• Correspondence address.
• Your email address.
• Your contact telephone number(s)
• Alternative contact details.
• Your data of birth.
• Gender.
• Marital status and dependants.
• Next of Kin.
• Unique Tax Reference number.
• National Insurance number.
• Other government identifier.
• Photograph.
• Your signature.

You can contact us at contactus@ekstraas.co.uk or telephone 07458 302 512.

‍

We process this information so we can provide you with accounting services, invoice you and maintain our communication with you. Our legal basis for doing this is Article 6(1)(b) UK GDPR – performance of a contract, where processing is necessary to deliver the service to you. Where applicable , we may also rely on other lawful bases, such as legal obligation or legitimate interests, depending on circumstances.

‍

We will process your data to enable us to perform due diligence checks on you both at point of engagement and during our commercial relationship. This is necessary to comply with the requirements of UK anti-money laundering regulations. Our legal basis for doing this is Article 6(1)(c) UK GDPR – compliance with a legal obligation.

‍

Where we require personal data in order to enter into or perform a contract with you, if you fail to provide the information we reasonably require, we may not be able to provide our services or enter into a commercial agreement with you.

‍

If we have engaged with you as a prospective customer, we will process the following information about you:

‍

• Your full name.
• Your email address.
• Your contact telephone number(s).
• Postal address details.
• Government identifier.
• Photograph.

We will process this information where necessary for compliance with UK anti-money laundering legislation, tocommunicate with you about a potential engagement and, where permitted by applicable law, to send you occasional updates about our services.

‍

Marketing

Where we rely on legitimate interests for marketing, our legitimate interests include maintaining and developing client and prospective client relationships, communicating about our services and developing our business. Electronic marketing will be carried out in accordance with the Privacy and Electronic Communications Regulations 2003 (PECR), as amended. The rules differ depending on whether you are a corporate subscriber, sole trader or individual. Where consent is required, we will obtain it before sending marketing communications. You can object to direct marketing or ask us to stop sending marketing communications at any time.

‍

Recipients of your data

As a general principle, we will not transfer your personal data to other recipients without your permission. There are some exceptions to this:

‍

• If you do not pay your bills, we may choose to engage a third party to recover any money you owe us. Lawful basis Article 6.1.f, we have a legitimate interest to pursue money owed to us.
• It is possible, though unlikely, that we might be forced to disclose your information in response to a court order or other binding mandate. Lawful basis is Article 6.1.c Legal Obligation
• We are required to undertake due diligence by law for anti-money laundering purposes, as such we may be required to share your personal data with our professional supervisory authority and / or law enforcement agencies. Our lawful basis is Article 6.1.c – performance of a legal obligation.
• HM Revenue and Customs (HMRC) and Companies House may receive personal data where this is necessary to meet our legal or regulatory obligations. our lawful basis for such sharing is Article 6(1)(c) – Compliance of a legal obligation.

Data processed by third parties on our behalf.

‍

We use trusted third-party service providers to process personal data on our behalf, including cloud0based accounting, credit checking document storage, payroll, email, video conferencing and other services that support our accounting activities. We maintain a list of our principal data processors and can provide further information on request.

‍

Where required, organisations that process personal data on our behalf are subject to a written data processing agreement in accordance with Article 28 UK GPDR. These arrangements require appropriate safeguards for the processing and protection of your personal data.

‍

Transferring your data outside of the UK

We do not intentionally transfer your personal date outside of the United Kingdom. However, some of the third-party service providers we use may process data internationally. Where this occurs, we will ensure that any transfer is made in accordance with applicable UK data protection law and that appropriate safeguards are in place.

‍

Retention periods

We retain personal data only for as long as necessary for the purposes for which is was collected, to meet our legal and regulatory obligations, to resolve disputes and to establish, exercise or defend legal claims. Retention periods may vary depending on the type of information and the purpose for which it is held.

‍

If you are a client, we will generally retain relevant client records for the duration of the client relationship and for 7 years thereafter, subject to our legal, regulatory and professional obligations. This retention period supports our obligations in relation to taxation, accounting records, professional requirements and the establishment, exercise or defence of legal claims.

‍

If you are a prospective client, we will generally retain your information for 2 years from last meaningful contact, unless you have asked us to stop contacting you or a longer retention period is necessary for another lawful purpose. If you ask us to stop receiving marketing communications, we will remove you fro our mailing list bit retain the minimum information necessary to ensure that we do not contact you again for marketing purposes.

‍

Personal data collected for client due diligence and anti-money laundering purposes will be retained for at least 5 years, or longer where required by applicable legal, regulatory or professional obligations.

‍

Security

We do not currently use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

‍

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include appropriate access controls, secure systems, encryption where appropriate, anti-virus and anti-malware protection, secure cloud services, and procedures designed to protect personal data. We use SSL/TLS encryption for personal data submitted through our website where applicable.

‍

‍

Your rights

The UK GDPR provides you with a number of rights in relation to the personal data we process about you. Depending on the circumstances and lawful basis for processing, these may include:

‍

• You have the right to access your personal data and request a copy of the information we hold about you.
• You may, in certain circumstances, ask us to restrict the processing of your personal data or request that we erase it, although we may have to retain some information where we have a legal or other lawful reason to do so.
• You have the right to ask us to rectify any inaccurate or incomplete personal data.

You can exercise these rights by contacting us using the email address or telephone number provided above. We may need to verify your identity before dealing with a request. We will respond to requests within the time required by applicable data protection law.

‍

If you have any concerns about how we have handled your personal data, you can contact us using the details above or make a data protection complaint in accordance with our Data Protection Complaints Procedure which is available on our website. You also have the right to object to certain processing, including direct marketing, and you may have the right to data portability where applicable. You have the right to lodge a complaint about our processing with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection

‍

Information Commissioner's Office (ICO)

Information Commissioner’s Office – Northern Ireland

‍

10^th Floor

Causeway Tower

9 James Street South

Belfast

BT2 8DN

‍

Telephone: 0303 123 1114

Email: ni@ico.org.uk

Website: www.ico.org.uk/make-a-complaint/

You can contact the ICO thought it current online complaints service or by using the contact details published on its website.

‍

‍