PRIVACY NOTICE
Contact Details
The Data Protection officer is Michael Smith, FFA, who can be contacted about anything to do with your
personal data and data protection, including to make a subject access request, using the following details:
Email address: mike@cornelaccountants.com
Postal address: 129 Station Road, Amersham, Buckinghamshire, HP7 0AH
Telephone number: 01494 972 200
Introduction
The Data Protection Act 2018 (DPA) and the General Data Protection Regulation (GDPR) requires
organisations that process personal data to meet certain legal obligations. We are a data controller within
the meaning of the Act and we process personal data.
We are committed to complying with the requirements of the DPA and GDPR. As a result we confirm that
personal information we process will only be held (or otherwise processed) to the extent necessary in order
to provide the agreed professional services and for any other purpose specifically agreed.
Information Collected
We are entering into a contract with you and will be processing data in order to fulfil our contractual
obligations. In order to provide the agreed services we need to collect, retain and process personal data
about you. This data is needed in order to:
Take you on and retain you as a client according to the provisions of UK laws and professional
regulations (eg anti-money laundering requirements).
Prepare and file accounts and tax returns
Provide advice on tax and national insurance liabilities
Provide ad hoc advice.
If the information required is not provided, we may not be able to provide the required services which
would trigger the disengagement provisions in the terms and conditions.
The personal data that we will collect and process will include:
Names and addresses
Email addresses
Telephone numbers
Information held by HMRC
Information required to prepare tax returns
Information required to prepare your accounts
Correspondence between us
How Information is Collected
We collect information that is supplied about you from:
YouLetter of Engagement in relation to
Proposal #COR20959
CORNEL is the trading name of Cornel Accountants Limited which is a member of the IFA and is
registered in England & Wales as a Limited Company with registered office and trading address of
129 Station Road, Amersham, Buckinghamshire, HP7 0AH and Limited Company number 08948442
| Accountants | t. 01494 972 200 | e. hello@cornelaccountants.com | www.cornelaccountants.com
Page 20 of 25
A spouse/partner
HMRC
Your organisation
Electronic ID verification providers
Other third parties (eg banks, investment managers etc) as authorised by you.
How Your Information is Used
We may use information we hold about you:
to provide services under the contract in force between us
to contact you about other services we provide which may be of interest to you if you have
consented to us doing so.
to meet other legal and regulatory requirements.
for other legitimate interests.
We will retain records based on our retention policy so that we can defend ourselves against potential legal
claims or disciplinary action which can be brought within statutory time limits.
We may also use information from other people or organisations when carrying out these activities.
There is no automated decision-making involved in the use of your information and therefore no data
portability.
Where we use subcontractors they will comply with General Data Protection Regulation (GDPR)
requirements.
Your information may from time to time be transferred and/or processed outside the EEA. This will only be
done where we have confirmed that the country to which your data has been transferred provides a level
of personal data protection comparable to that provided in European law.
Lawful basis for processing personal data
Personal data may be processed on a contract basis under the engagement letter and provision of services
agreements.
Personal data may be processed on a consent basis when meeting clients’ wider expectations of my/our
professional relationship.
Personal data may be processed on the legal obligations and/or public interest bases in order to comply
with legal requirements.
Personal data may be processed in order to further our legitimate interests.
Information Which May be Given to Others
In order for us to provide the agreed services, we may provide personal data about you to:
HMRC
other third parties you require us to correspond with (for example, finance providers, pension
providers (including auto-enrolment) and investment brokers.
subcontractors who are bound by the same professional and ethical obligations as the principals
and employees of the practiceLetter of Engagement in relation to
Proposal #COR20959
CORNEL is the trading name of Cornel Accountants Limited which is a member of the IFA and is
registered in England & Wales as a Limited Company with registered office and trading address of
129 Station Road, Amersham, Buckinghamshire, HP7 0AH and Limited Company number 08948442
| Accountants | t. 01494 972 200 | e. hello@cornelaccountants.com | www.cornelaccountants.com
Page 21 of 25
an alternate appointed by us in the event of incapacity or death
tax insurance providers
professional indemnity insurers
our professional body Institute of Financial Accountants (IFA) or an external reviewer in relation to
quality assurance.
We need to give information to these other parties in order to fulfil our contractual obligations to you and
therefore it is not possible to opt out of the provision of information to these parties. If you ask us not to
provide information we may need to cease to act.
If the law allows or requires during the period of our contractual arrangements or after we have ceased to
act we may give information about you to:
the police and law enforcement agencies
courts and tribunals
the Information Commissioner’s Office (ICO).
In addition, after we have ceased to act we may give information about you to:
our professional indemnity insurers or legal advisers where we need to defend ourselves against a
claim
our professional disciplinary body where a complaint has been made against us in order to defend
ourselves against a claim.
your new advisers or other third parties you ask us to give information to.
Data Security
We have put in place appropriate and proportionate security measures to address the risk of personal data
being lost, used, altered or accessed in an unauthorised way. We limit access to personal data to those who
have a business need to access it, and who will only process the personal data on our instructions.
Nevertheless, no data transmission over the internet, or any other network, can ever be regarded as wholly
secure, and we have in place measures to deal with any suspected breach of data security. Those measures
include policies and procedures, which are periodically reviewed to ensure they are effective and fit for
purpose.
Retention of Information
When acting as a data controller and in accordance with recognised good practice within the tax and
accountancy sector we will retain all of records relating to you as follows:
Where tax returns and accounts have been prepared it is our policy to retain information for seven
years from the end of the tax year to which the information relates.
Where ad hoc advisory work has been undertaken it is our policy to retain information for seven
years from the date the business relationship ceased.
Where we have an ongoing client relationship permanent information (the data supplied by you and
others which is needed for more than one year’s tax and accounts compliance) including, for
example, capital gains base costs and claims and elections submitted to HMRC, are retained
throughout the period of the relationship but will be deleted seven years after the end of the
business relationship unless we are asked to retain it for a longer period by our clients.
Under the Money Laundering Regulations (MLR 2017) personal data must normally be destroyedLetter of Engagement in relation to
Proposal #COR20959
CORNEL is the trading name of Cornel Accountants Limited which is a member of the IFA and is
registered in England & Wales as a Limited Company with registered office and trading address of
129 Station Road, Amersham, Buckinghamshire, HP7 0AH and Limited Company number 08948442
| Accountants | t. 01494 972 200 | e. hello@cornelaccountants.com | www.cornelaccountants.com
Page 22 of 25
within specified time limits but where contractual agreement is in place this is taken as agreement
under Regulation 40 (5) MLR 2017 to retain records for the longer period of seven years.
Requesting Information Held About You (the Right to Access)
Requests to see records and other related information that the firm holds about you are known as ‘subject
access requests’ (SAR). We have set out further details on SARs below.
Requests in Writing
Please provide all requests in writing to the individual at the top of this notice.
To help provide the information on a timely basis you may need to provide copies of id and proof of
address.
Asking someone else to make a subject access request on your behalf
You can ask someone else to request information on your behalf – for example, a friend, relative or
solicitor. We must have your authority to do this. This is usually a letter signed by you stating that you
authorise the person concerned to write to for information about you, and/or receive our reply.
When We Won’t Release Information
The law allows us to refuse your request for information in certain circumstances – for example, if you have
previously made a similar request and there has been little or no change to the data since the original
request.
The law also allows us to withhold information where, for example, release would be likely to:
prejudice the prevention or detection of crime
prejudice the apprehension (arrest) or prosecution of offenders
prejudice the assessment or collection of any tax or duty
reveal the identity of another person, or information about them.
Where we are unable to consent to your request we will set out the reasons in writing.
Putting Things Right (the Right to Rectification)
Should information you have previously supplied to us be incorrect, please inform us immediately so we
can update and amend the information we hold.
Deleting your Records (the Right to Erasure)
In certain circumstances it is possible for you to request us to erase your records and further information is
available on the ICO website (www.ico.org.uk). If you would like your records to be erased, please inform us
immediately and we will consider your request. In certain circumstances we have the right to refuse to
comply with a request for erasure and if applicable we will supply you with the reasons for refusing your
request.
Restrictions on Processing (the Right to Restrict Processing and the
Right to Object)
In certain circumstances you have the right to ‘block’ or suppress the processing of personal data or toLetter of Engagement in relation to
Proposal #COR20959
CORNEL is the trading name of Cornel Accountants Limited which is a member of the IFA and is
registered in England & Wales as a Limited Company with registered office and trading address of
129 Station Road, Amersham, Buckinghamshire, HP7 0AH and Limited Company number 08948442
| Accountants | t. 01494 972 200 | e. hello@cornelaccountants.com | www.cornelaccountants.com
Page 23 of 25
object to the processing of that information. For further information refer to the ICO website
(www.ico.org.uk). Please inform us immediately if you want us to cease to process your information or you
object to processing so that we can take the appropriate action.
Withdrawal of Consent
Where you have consented for us to contact you with details of other services we provide we may continue
to process your data and contact you for that purpose after our contractual relationship ends. You may
withdraw consent for the firm to contact you in relation to details of other services we provide at any time
during the performance of the contract or thereafter. We will then cease to process your data but only in
connection with contacting you with details of other services we provide. Note that the withdrawal of
consent does not make the other bases on which we are processing your data unlawful. We will therefore
still continue to process your data under the terms of our contract and for other reasons set out in this
privacy notice.
Obtaining and Reusing Personal Data (the Right to Data Portability)
The right to data portability only applies:
to personal data an individual has provided to a controller;
where the processing is based on the individual’s consent or for the performance of a contract; and
when processing is carried out by automated means
You may be able to request your personal data in a format which enables it to be provided to another
organisation. We will respond to any requests made without undue delay and within one month. We may
extend the period by a further two months where the request is complex or a number of requests are
received but we will inform you within one month of the receipt of the request and explain why the
extension is necessary.
Complaints
If you have any questions or concerns regarding our processing of personal data, you can complain to us as
set out in the terms and conditions. If you are dissatisfied with the response, then you can refer to the ICO.
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
You can also complain to our professional body – Institute of Financial Accountants (IFA) as set out in the
terms and conditions.