Legal
Privacy Policy
1. Who we are
Harwood Accountants Limited ("we", "us", "our") is a company registered in England and Wales, company number 17490420. We are the data controller in respect of the personal data described in this policy.
For any data protection matter, including a request to exercise your rights, contact us at jack@harwoodaccountants.com. Our registered office address is set out in our engagement letter and on the Companies House register, and we will provide it on request.
2. Scope
This policy explains how we collect, use, store and share personal data when you:
- visit this website;
- complete the enquiry form on this website;
- correspond with us by email, telephone or post;
- engage us to provide accountancy or related professional services; or
- apply to work with us as a contractor or consultant.
3. Legal framework
We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018. Some of the qualified professionals who deliver our services are based in the Isle of Man, and where personal data is shared with them we also have regard to Isle of Man data protection law. Where both regimes apply, we apply the higher standard.
4. Personal data we collect
Website visitors and enquirers
| Category | Examples | Source |
|---|---|---|
| Identity data | Name, job title, employer | You |
| Contact data | Email address, telephone number, postal address | You |
| Enquiry data | The content of your message and anything you choose to include | You |
| Technical data | IP address, browser type and version, device type, operating system | Server logs |
This website does not run analytics or tracking software. Technical data of the kind above is recorded in standard server logs by our hosting provider for security and diagnostic purposes.
Clients and prospective clients
Where you engage or seek to engage our services we may also collect financial and accounting records, ledgers, invoices, bank statements and supporting documentation; tax reference numbers and correspondence with tax authorities; company records, shareholder and director details and beneficial ownership information; identity verification documents required for anti money laundering purposes, including passport, driving licence, proof of address and, where applicable, source of funds and source of wealth information; payment and billing information; and correspondence and records of our engagement with you.
Contractors and applicants
Where you apply to provide services to us we may collect your CV, professional qualifications and membership details, references, right to work documentation, professional indemnity insurance details, self employment and tax registration details, and bank details for payment.
Special category data
We do not routinely seek special category personal data. Where such data is unavoidably contained within client records supplied to us, we process it only to the extent necessary to deliver our services and on the basis that processing is necessary for the establishment, exercise or defence of legal claims or for reasons of substantial public interest.
5. How we use personal data, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries sent through this website or by email | Legitimate interests (responding to a request directed to us); steps prior to entering a contract |
| Client onboarding, engagement letters and scoping | Performance of a contract; steps prior to entering a contract |
| Delivering accountancy, bookkeeping, tax and related services | Performance of a contract |
| Identity verification and customer due diligence | Legal obligation (anti money laundering legislation) |
| Invoicing, collecting payment and credit control | Performance of a contract; legitimate interests (recovering sums owed) |
| Maintaining our own accounting and statutory records | Legal obligation |
| Engaging and paying contractors | Performance of a contract; legal obligation |
| Website security, fraud prevention and diagnostics | Legitimate interests (protecting our systems and users) |
| Marketing communications to business contacts and clients | Legitimate interests; consent where required |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your interests, rights and freedoms. You may request details of that assessment using the contact details in section 1.
6. Marketing
We may send information about our services to existing clients and to business contacts who have expressed interest in them. You can opt out at any time using the unsubscribe link in any message, or by contacting us. Opting out of marketing does not affect communications sent to you in connection with services we are providing.
7. Who we share personal data with
- Contracted professionals. Qualified accountants and other professionals engaged by us as independent contractors to deliver services. Each is bound by written confidentiality and data protection obligations.
- Software and IT providers. Providers of cloud accounting, document capture, practice management, payroll, electronic signature, payment collection, email, file storage and communications services, each engaged under a written data processing agreement.
- Professional advisers. Our own lawyers, auditors, insurers and brokers.
- Regulators and authorities. Tax authorities, our anti money laundering supervisory body, the UK Information Commissioner's Office, the Isle of Man Information Commissioner where data has been shared with a contractor based there, law enforcement agencies and courts, where required by law.
- Banks and payment providers.
- Prospective purchasers. In connection with any sale, merger or reorganisation of our business, subject to confidentiality undertakings.
We do not sell personal data.
8. International transfers
We are established in the United Kingdom and your data is held here. Some of the qualified professionals who deliver our services are engaged as contractors in the Isle of Man, so personal data may be shared with them. The Isle of Man is recognised as providing an adequate level of protection for personal data transferred from the United Kingdom, so no additional transfer mechanism is required.
Where personal data is transferred to a country that has not been recognised as providing adequate protection, we put in place appropriate safeguards, normally the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, together with a transfer risk assessment. You may request a copy of the relevant safeguards.
9. How long we keep personal data
| Record type | Retention period |
|---|---|
| Website enquiries that do not become engagements | 24 months from last contact |
| Client engagement files and working papers | 7 years from the end of the engagement |
| Anti money laundering identity and due diligence records | 5 years from the end of the business relationship, or longer where required by law |
| Statutory accounting records | 6 years from the end of the financial year |
| Contractor agreements and payment records | 7 years from termination |
| Marketing preferences and opt out records | Retained indefinitely so that we can honour your opt out |
| Server access logs | Retained by our hosting provider for a short period, normally no more than 12 months |
Once a retention period has expired we securely delete or anonymise the data, unless we are required to retain it in connection with an actual or anticipated legal claim, investigation or regulatory requirement.
10. Security
We maintain technical and organisational measures appropriate to the risk, including access controls and role based permissions, multi factor authentication on business systems, encryption of data in transit and at rest, secure backup, contractual confidentiality and security obligations on contractors and suppliers, and an internal procedure for identifying and reporting personal data breaches.
No system is entirely secure. Please do not send sensitive documentation to us by unencrypted email. We will provide a secure method on request.
11. Your rights
Subject to the conditions and exemptions in the applicable legislation, you have the right to:
- Access a copy of the personal data we hold about you.
- Rectification of inaccurate or incomplete personal data.
- Erasure of personal data where there is no continuing lawful basis to hold it.
- Restriction of processing in certain circumstances.
- Portability of personal data you have provided to us, where processing is based on consent or contract and carried out by automated means.
- Object to processing based on legitimate interests, and to object at any time to direct marketing.
- Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us using the details in section 1. We will respond within one month and will tell you if we need to extend that period. We may need to verify your identity before acting on a request.
Certain rights are limited where we are required by law to retain records, in particular anti money laundering records, or where the data forms part of professional working papers subject to legal or professional privilege.
12. Complaints
If you are not satisfied with how we have handled your personal data you may complain to the UK Information Commissioner's Office at ico.org.uk. We would ask that you raise the matter with us first so that we have the opportunity to resolve it.
13. Automated decision making
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.
14. Cookies
Our use of cookies and similar technologies is described in our Cookie Policy.
15. Third party websites
This website may contain links to third party sites. We are not responsible for their content or their privacy practices, and we encourage you to read their policies.
16. Changes to this policy
We may update this policy from time to time. The current version is always the one published on this website and is identified by the "Last updated" date above. Material changes will be notified to clients directly.