Privacy Policy

1.Who we are

Trueman Brown Chartered Accountants is the data controller for the personal data described in this policy. That means we decide how and why it is used, and we are responsible for looking after it in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Practice

Trueman Brown Chartered Accountants

Address

7 Foxglove Road, South Ockendon, Essex RM15 6EU

Data controller

Mark Hewitt

Contact

mark@truemanbrown.co.uk · +44 (0)1708 397262

If you are a client, please also read our letter of engagement, which sets out the terms on which we act for you.

2.Information we collect

When you get in touch

If you use one of our enquiry forms, email or phone us, we receive what you choose to tell us: usually your name, phone number, email address, the service you are interested in and your message.

When you become a client

• Contact details for you and, where relevant, your business, directors, partners or family members.
• Identity information we are legally required to check, such as a passport or driving licence and proof of address.
• Tax and financial information, such as your Unique Taxpayer Reference, National Insurance number, income, bank statements, payroll records, accounts and investment details.
• Information about your employees where we run payroll, including salary, tax codes, pension and statutory pay details.
• Information needed for estate or succession planning, such as details of family members and beneficiaries.
• Our correspondence and meeting notes.

When you visit this website

We do not use analytics, advertising or tracking tools. Our hosting provider briefly processes technical details such as your IP address and browser type to deliver pages and keep the site secure. Our Cookie Policy explains this in full.

3.How our enquiry forms work

The consultation forms on our home and contact pages do not store anything on this website. When you press send, your own email app opens with your message addressed to mark@truemanbrown.co.uk. Nothing is shared with us until you send that email yourself. It is then kept as described under how long we keep information.

4.Our lawful basis for processing

The UK GDPR requires a lawful basis for each use of personal data. We rely on:

Contract

To provide the accounting, tax, payroll and advisory services set out in our engagement letter, and to take steps you ask for before we agree terms.

Legal obligation

To meet our duties under the Money Laundering Regulations 2017, tax legislation, the Companies Act 2006, employment and pensions law, and our professional rules.

Legitimate interests

To reply to enquiries, manage our practice, keep proper records, defend legal claims and keep this website secure, where those interests are not outweighed by your rights.

Consent

For anything else, such as sending you newsletters. You can withdraw consent at any time.

Where we handle special category data (for example health information needed to process statutory sick pay) or information about criminal convictions revealed by identity checks, we do so only where the Data Protection Act 2018 allows, such as to meet employment law or anti-money laundering obligations.

We never sell personal data, and we do not make decisions about you by automated means.

5.Client onboarding and anti-money laundering checks

Before we start work for a new client, the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 require us to confirm who you are and, for businesses, who owns and controls them.

• We will ask for identity documents and proof of address, and may use an electronic identity verification service, which can leave a search footprint that does not affect your credit rating.
• Information collected for these checks is used only to prevent money laundering and terrorist financing, unless another law allows otherwise or you agree to a different use.
• We must keep these records for five years after our business relationship ends, even if you ask us to delete them.
• If we are required to report a suspicion to the National Crime Agency, the law may prevent us from telling you.

The Regulatory Information page explains our wider anti-money laundering obligations.

6.Who we share it with

Only where needed, and only as much as is needed:

• HMRC, Companies House, The Pensions Regulator and pension providers, when we file returns or act on your behalf.
• Service providers who help us run the practice, such as accounting and payroll software, secure document storage, email and website hosting. They act only on our instructions under contracts that require them to keep data secure.
• Our professional body, insurers and professional advisers, where necessary for regulation, quality reviews or claims.
• Banks, lenders or other advisers, only with your agreement.
• The National Crime Agency, courts, regulators or other authorities, where the law requires us to.

Some providers may store data outside the UK. When they do, we make sure it is protected by UK adequacy regulations or approved safeguards such as the UK International Data Transfer Agreement.

7.How we protect it

• Client information is confidential, and our professional duty of confidentiality continues after our work together ends.
• Access is limited to the people who need it for your work.
• Records are kept in password-protected systems and sent over encrypted connections or secure client portals.
• If a personal data breach is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you without undue delay.

8.How long we keep information

Enquiries

Deleted within 12 months if you do not become a client.

Client files and correspondence

Kept for at least six years after our engagement ends, in line with tax enquiry windows and legal limitation periods.

Identity check (AML) records

Kept for five years after our business relationship ends, as the Money Laundering Regulations 2017 require.

Payroll records

Kept for at least three years after the end of the tax year they relate to, as HMRC requires, and longer where pension rules apply.

Website technical data

Kept only briefly by our hosting provider for security.

After these periods we securely delete or destroy the information.

9.Your rights

Under UK data protection law you have the right to:

• Access: ask for a copy of the personal data we hold about you (a subject access request).
• Rectification: have anything inaccurate or incomplete corrected.
• Erasure: ask us to delete your data where we no longer have a legal reason to keep it.
• Restriction and objection: ask us to limit or stop using your data in certain circumstances.
• Portability: receive data you gave us in a reusable format, or have it sent to another organisation.
• Withdraw consent: where we rely on consent, at any time.

To make a request, contact Mark Hewitt at mark@truemanbrown.co.uk or on +44 (0)1708 397262, or write to us at 7 Foxglove Road, South Ockendon, Essex RM15 6EU. There is normally no charge, and we will reply within one month. We may need to confirm your identity first.

10.Complaints and the ICO

If you are unhappy with how we have handled your personal data, please tell Mark Hewitt first so we can put it right.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:

Online

ico.org.uk/make-a-complaint (opens in a new tab)

Helpline

0303 123 1113

Post

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

11.Changes to this policy

We review this policy regularly and will post any changes on this page. Please also see our Terms & Conditions.