Appendix 1 – External Privacy Statement – December 2021
Who we are
This is the privacy statement of Penn and Company (the trading name of Penn and Company (Suffolk) Limited), a firm of Chartered Accountants and Chartered Tax Advisers whose registered office is at Peak House, Gipping Road, Stowupland, Stowmarket, Suffolk, IP14 4AX.
This privacy statement explains how we collect and use personal information about you.
What personal information we collect
We collect personal information about our clients to enable us to act on their behalf such as:
- Name
- Address
- Telephone number(s) and email address
- National Insurance Number
- UTR (Unique Tax Reference)
- Date of birth
- Passport or Driving Licence
- Marital status, including proof of marriage and personal details of spouse
- Personal details of dependents and children
- Employment status including details of income and benefits and expenses
- Nationality and Residence status
- Details of directorships, trusteeships, partnerships, beneficial entitlements etc
- Self-employment income, pension income, partnership, trust, property, investment income (including interest and dividends from UK banks and building societies), life insurance gains, redundancy, UK patent royalty payments, compensation and other lump sums, and foreign income
- Details of ownership of property, capital gains on assets and inheritances
- Tax reliefs
- Maintenance payments
- Tax avoidance schemes
- Charitable donations
- Student loan repayments
- Trade Union membership
- Bank account details
- Details of other professional advisers
Where we collect personal information from
We collect most of this information directly from you as our client to enable us to advise you on your tax affairs and in most cases to complete your tax returns as instructed.
If you transfer your tax affairs from another firm of accountants, we may receive information from them.
We also collect personal information about you as our client directly from other sources such as HMRC, your brokers, your banks and building societies and other professional advisers.
How we use your personal information
We use your personal information to fulfil our contractual role as your accountant and tax advisers to complete your financial statements and/or tax returns, to advise you on your tax planning and other tax affairs. We also have a legitimate interest in processing your personal data to maintain our records accurately and to process financial transactions.
We also use your personal information to fulfil our legal obligations under Money Laundering regulations to verify your identity where required, including preventing and detecting crime, fraud and corruption.
We use some personal information such as name and address to communicate with you by post, email or telephone to discuss our role as your accountant and tax advisers and we have your consent to send you information for marketing purposes.
We may also process Special Categories of your personal data, such as trade union membership, race or ethnic origin, biometrics (for ID purposes), where we do so we will obtain your explicit consent to do so. We also process the information of our child clients under this Special Category.
Who we share your personal information with
We may share your information with third parties, such as HMRC, other professional advisers, our professional bodies for compliance purposes and other members of your family or business with your permission.
How we use your information to make automated decisions
Your information may be used to make automated decisions, eg. use of tax programmes to calculate the amount of tax will advise you to pay.
How long we retain your personal information for
Individuals, trustees and partnerships:
- with trading or rental income: five years and 10 months after the end of the tax year
- otherwise: 22 months after the end of the tax year.
Companies, Limited Liability Partnerships, and other corporate entities:
- six years from the end of the accounting period.
Although certain personal data may legally belong to you, we may hold and/or destroy correspondence and other documents that we store electronically or otherwise that are more than seven years old, except documents we think may be of continuing significance.
Holding personal information outside the United Kingdom of Great Britain and Northern Ireland
Personal information in the United Kingdom is protected by data protection laws but other countries do not necessarily protect your personal information in the same way.
Our website and some of our services or parts of them may also be hosted outside of the United Kingdom in the United States or the EEA (which means all the EU countries plus Norway, Iceland and Liechtenstein) (“EEA”) and this means that we may transfer any information which is submitted by you through the website or the application or service outside the United Kingdom to the EEA or the United States or to other territories outside of these areas. The UK has been granted an adequacy decision by the EU and therefore data can flow freely between the areas and your data is deemed to have an equivalent level of protection as within the EU.
We may use service providers based outside of the United Kingdom to help us provide our website and services to you (for example, client identification screening through US based providers) and this means that we may transfer your information to service providers outside the United Kingdom for the purpose of providing our services to you.
We take steps to ensure that where your information is transferred outside of the United Kingdom by our service providers and hosting providers, appropriate measures and controls in place to protect that information in accordance with applicable data protection laws and regulations. In each case, such transfers are made in accordance with the requirements of most recent Date Protection legislation and may be based on the use of the European Commission’s Standard Model Clauses for transfers of personal data.
By using our website and services or by interacting with us in the ways described in this Privacy Notice, you consent to the transfer of your information outside the United Kingdom in the circumstances set out in this Privacy Notice. If you do not want your information to be transferred outside the United Kingdom you should not use our website or our services.
Using our website
Please see our website Privacy Section for further details.
Your rights
Access to your information – You have the right to request a copy of the personal information about you that we hold.
Correcting your information – We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.
Deletion of your information – You have the right to ask us to delete personal information about you where:
- You consider that we no longer require the information for the purposes for which it was obtained.
- We are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information
- You have validly objected to our use of your personal information – see Objecting to how we may use your information
- Our use of your personal information is contrary to law or our other legal obligations.
Objecting to how we may use your information – You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.
Restricting how we may use your information – In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information but you do not want us to delete the data. Where this right to validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.
Automated processing – If we use your personal information on an automated basis to make decisions which significantly affect you, you have the right to ask that the decision be reviewed by an individual to whom you may make representations and contest the decision. This right only applies where we use your information with your consent or as part of a contractual relationship with you.
Withdrawing consent using your information – Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.
Please contact us in any of the ways set out in the Contact information and further advice section if you wish to exercise any of these rights.
Changes to our privacy statement
We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained from the office of Penn and Company
This privacy statement was last updated on 6th May 2024.
Contact information and further advice
If you require any further advice on this please do not hesitate to contact our Money Laundering Reporting Officer Kate Rosten at Peak House, Gipping Road, Stowupland, Stowmarket, Suffolk, IP14 4AX or by telephone on 01449 73355 or by email at kate@pennandcompany.co.uk .
Complaints
We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner’s Office, whose contact details are:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone – 0303 123 1113 (local rate) or 01625 545 745 Website – https://ico.org.uk/concerns