Introduction
We are committed to protecting personal data and to complying with the Data Protection Act 2018 (DPA) and the United Kingdom General Data Protection Regulation (UK GDPR). Cloud 10 Accounting is registered with the Information Commissioner’s Office as a data controller, with the registration number ZB656308.
This privacy statement explains how, as a data controller, we collect and use the personal data of individuals (‘data subjects’). Data subjects may be our clients or others whose data we collect during the course of our business interactions. We shall only use personal data for the purposes described in this privacy statement or for the purposes explained to the data subject at the point of collecting their personal data.
How we might receive personal data
We may obtain personal data directly from a data subject if and when they:
- request a proposal from us in respect of the services we provide;
- engage us to provide our services and also during the provision of those services;
- contact us, for whatever reason, by email, telephone, post, or via our website or social media.
We may also obtain personal data indirectly:
- from an employer,
- from third parties (for example, from the data subject’s bank or from HMRC),
- from publicly available sources (for example, from Companies House).
This list is not exhaustive. If and when it becomes necessary (or in the data subject’s interests) to obtain personal data from third parties, the data subject will usually have been made aware that we intend to do so.
The lawful bases on which we process personal data
The lawful bases on which we process personal data are as follows:
- consent – where a data subject has given consent to the processing of their personal data for one or more specific purposes;
- contract – where processing is necessary to meet our obligations under a contract to which the data subject is party (or to take steps at their request prior to entering into a contract);
- legal obligations – where processing is necessary for compliance with a legal obligation to which we are subject;
- public interest – where processing is necessary for the performance of a task carried out in the public interest;
- legitimate interests – where processing is necessary for the purposes of pursuing our legitimate interests, or the legitimate interests of another party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.
Why we process personal data
We process personal data to be able to:
- meet our responsibilities to a client under our engagement letter and the provision of services agreements that exist between us,
- meet a client’s wider expectations of our professional relationship, including providing information ancillary to the services agreed under the engagement letter and provision of services agreements,
- contact a client about other services we provide which may be of interest to them, if the client has consented to us doing so,
- comply with legal and regulatory requirements, including anti-money laundering and health and safety compliance, and
- further our legitimate interests.
The following sections relate the lawful bases on which we process personal data to the various reasons for which we expect to process personal data:
- Under the engagement letter and provision of services agreements: Contract
- Meeting clients’ wider expectations of our professional relationship: Consent
- Contacting a client about other services that may be of interest: Consent
- Complying with legal and regulatory requirements: Legal obligations, Public interest
- Furthering our legitimate interests: Legitimate interests
Our legitimate interests in processing personal data include the requirement that we comply with our legal and regulatory obligations and are seen to do so. We may also process personal data for the purposes of our practice management and development, including statistical analysis.
Data Security
We have put in place appropriate and proportionate security measures to address the risk of personal data being lost, used, altered or accessed in an unauthorised way. We limit access to personal data to those who have a business need to access it, and who will only process the personal data on our instructions.
Nevertheless, no data transmission over the internet, or any other network, can ever be regarded as wholly secure, and we have in place measures to deal with any suspected breach of data security. Those measures include clear policies and procedures, which are periodically reviewed to ensure they are effective and fit for purpose. Procedures include the training of employees and subcontractors in the areas of data privacy, confidentiality and information security.
Data Sharing
We share personal data with third parties when absolutely necessary for the purposes for which we process it. We may also share personal data, with the consent of the data subject, where it is necessary to administer the relationship between us, or where we have another legitimate interest in doing so.
‘Third parties’ includes third-party service providers, for example, providers of:
- IT services,
- professional advisory services,
- insurance, and
- administration services.
This list is not exhaustive. We only permit third-party service providers to process personal data for specified purposes and in accordance with our instructions, where appropriate contractual arrangements and security mechanisms are in place.
We shall not transfer personal data to any country outside the United Kingdom, unless we have advised the data subject accordingly in advance. A transfer of personal data outside the United Kingdom will only occur if we are satisfied that the country to which the data is to be transferred provides a level of personal data protection comparable to that provided by UK GDPR.
We shall share personal data to the extent necessary in order to:
- meet our responsibilities under our provision of services agreements with clients,
- fulfil our obligations to a regulator,
- enable effective quality control over our technical work, and
- comply with our legal obligations.
Use of Artificial Intelligence Tools
To help us deliver our services efficiently and to the highest standard, we may from time to time use artificial intelligence (AI) assisted tools as part of our internal workflow. Currently this includes Claude, developed by Anthropic.
These tools are used solely to assist our team and help us work more effectively on your behalf. Any AI tools we use are operated under commercial terms which include appropriate Data Processing Agreements, ensuring your data is handled in accordance with UK GDPR and our obligations as your accountant.
We want to be clear about how we use these tools:
- AI tools are used internally to assist with tasks such as drafting, research and analysis
- Your data is never shared with AI tools beyond what is necessary to deliver your services
- All work produced with AI assistance is reviewed, checked and approved by a qualified member of our team before being provided to you – we take full professional responsibility for all advice and work product
- We do not use AI tools to make autonomous decisions about your affairs
- Your data is not used to train AI models under the commercial terms we operate under
If you have any concerns or objections to your data being processed in this way, please let us know in writing and we will discuss how we can accommodate your requirements.
Our use of AI tools does not affect your rights under UK GDPR, including your right to access, correct or request deletion of your personal data. For full details of how we handle your data, please refer to our Privacy Notice.
Data Retention
When determining the appropriate period of retention for personal data, we shall consider the requirements of our business, the services provided, any legal and regulatory obligations, and the purposes for which we originally collected the data.
We shall only retain personal data for as long as there is a legal basis for doing so.
In accordance with recognised good practice within the accountancy profession, we usually retain records, including personal data, as follows:
- Tax return information and accounting records are retained for seven years from the end of the tax year to which that information relates.
- Information and records relating to advisory work are retained for seven years from the date the business relationship ceased.
- Where we have an ongoing client relationship, information that is of ongoing relevance to our engagement is retained throughout the period of the engagement and deleted seven years after the end of the business relationship.
Individuals’ Rights Regarding Their Data
It is important that the data we hold is accurate and current. Should a data subject’s personal information change, they should ensure that we are notified of those changes of which we need to be made aware.
Data subjects have certain rights over their personal data that we process as data controller. If a data subject exercises any of those rights we shall aim to respond promptly. However, please note that the length of time it will take us to respond will be dependent on the nature and extent of the request.
A data subject has a right to:
- request access to their personal data under Article 15 of UK GDPR – enabling them to receive a copy of their personal data that we hold;
- request rectification under Article 16 – of any errors or inaccuracies in their personal data that we hold;
- request erasure of their personal data under Article 17 – where there is no good reason for us continuing to process it, or where they have exercised their right to object to processing (see below);
- object to processing of their personal data under Article 21 – where we have been relying on a legitimate interest as the basis for processing their data, which they believe is overridden by their own interests or rights;
- request the restriction of processing of their personal data under Article 18 – asking us to suspend processing their personal data if, for example, they wish to establish its accuracy or the reason for processing it;
- withdraw consent under Article 7 – where we have been processing their personal data based on their consent;
- request the transfer of their personal data to them or to another data controller under Article 20.
If you wish to exercise any of your rights as data subject, please email Stuart Hurst at stuart@cloud10accounting.co.uk.
Contact Details
If you have any questions regarding this notice or if you would like to speak to us about the manner in which we process personal data, please email Stuart Hurst at stuart@cloud10accounting.co.uk, or telephone 07771969450.
A data subject also has the right to make a complaint to the Information Commissioner’s Office, whose address is:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: www.ico.org.uk/concerns