Privacy Policy

1. Who we are

Dale-Harris & Co (“we”, “us”, “our”) is a firm of Chartered Certified Accountants and Registered Auditors with its principal place of business at Huxley House, 11 William Street, Redditch, Worcestershire B97 4AJ. We are regulated by the Association of Chartered Certified Accountants (ACCA), firm reference [TO CONFIRM].

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the data controller in respect of the personal data described in this notice. Our registration with the Information Commissioner’s Office is [TO CONFIRM].

Questions about this notice, or about how we handle your personal data, should be addressed to our data protection contact, [TO CONFIRM], at info@daleharris.co.uk or by post to the address above.

2. Scope of this notice

This notice explains what personal data we collect, why we collect it, the lawful bases on which we process it, how long we retain it, with whom we share it, and the rights available to you. It applies to visitors to this website, prospective clients, clients, and the officers, employees and beneficial owners of client organisations.

3. Personal data we collect

3.1 Information you give us

• Enquiry data — name, business name, telephone number, email address and the content of your enquiry, submitted through the forms on this website or by telephone, email or post.
• Identification data — copies of passports, driving licences, utility bills, bank statements and other documents obtained to satisfy our obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
• Engagement data — the information necessary to perform the services set out in your engagement letter, including accounting records, bank statements, invoices, payroll data, National Insurance numbers, Unique Taxpayer References, income and expenditure information, property and asset details, and correspondence with HM Revenue & Customs.
• Employee data — where we provide payroll services, personal data relating to your employees, including names, addresses, dates of birth, National Insurance numbers, bank details, salary and pension contribution information.

3.2 Information collected automatically

When you visit this website we may collect technical data including IP address, browser type and version, device type, operating system, referring website, and information about your interaction with our pages. Where this involves non-essential cookies, we collect it only with your consent. See our Cookie Policy.

3.3 Special category data

We do not routinely seek special category personal data. Where it is unavoidably disclosed to us in the course of our work — for example health information relevant to a statutory sick pay calculation, or a reasonable excuse claim to HM Revenue & Customs — we process it only where a condition under Article 9 of the UK GDPR is satisfied, and we restrict access accordingly.

4. Lawful bases for processing

Purpose	Lawful basis
Responding to your enquiry and providing a quotation	Steps taken at your request prior to entering a contract; legitimate interests
Providing the accountancy, tax, payroll and related services set out in your engagement letter	Performance of a contract
Verifying identity and conducting anti-money-laundering checks	Compliance with a legal obligation
Filing returns and documents with HM Revenue & Customs, Companies House and pension providers	Compliance with a legal obligation; performance of a contract
Retaining records after an engagement ends	Compliance with a legal obligation; legitimate interests in defending potential claims
Website analytics and service improvement	Consent
Sending you guidance and deadline reminders by email	Consent, or legitimate interests where you are an existing client

Where we rely on legitimate interests, we have carried out a balancing assessment and are satisfied that our interests are not overridden by your interests, rights and freedoms. You may object to processing carried out on this basis (see section 9).

5. Disclosure of your personal data

We do not sell personal data and we do not share it for third-party marketing. We may disclose personal data to:

• HM Revenue & Customs and Companies House, in the course of making the filings you have engaged us to make;
• Pension providers and The Pensions Regulator, where we provide auto-enrolment services;
• Software and IT providers who process data on our behalf under written contracts imposing UK GDPR Article 28 obligations, including accounting, payroll, tax filing, document storage and email providers;
• Our professional advisers, including insurers, legal advisers and, where required, the ACCA in connection with practice monitoring or a complaint;
• Your previous or subsequent accountant, on professional clearance, where you have authorised it;
• Law enforcement, regulators and the National Crime Agency, where we are under a legal duty to disclose. You should be aware that we may be required to make a suspicious activity report and are prohibited by law from informing you that we have done so.

6. International transfers

We seek to keep personal data within the United Kingdom or the European Economic Area. Where a service provider processes data outside those areas, we ensure an appropriate safeguard is in place, being either an adequacy decision or the International Data Transfer Agreement or Addendum approved for use in the United Kingdom.

7. Retention

We retain personal data for as long as necessary for the purposes for which it was collected, and thereafter as required by law or to defend potential claims. In particular:

• Client engagement and accounting records — a minimum of six years from the end of the accounting period or tax year to which they relate, reflecting statutory retention requirements and the limitation period for claims.
• Anti-money-laundering identification records — five years from the end of the business relationship or the completion of the occasional transaction, in accordance with the 2017 Regulations.
• Unsuccessful enquiries — up to twenty-four months from last contact, unless you ask us to delete them sooner.
• Marketing consents and suppression records — for as long as necessary to honour your preferences.

At the end of the applicable period, records are securely deleted or destroyed.

8. Security

We maintain appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include access controls and role-based permissions, encryption of data in transit, secure file transfer for client documents, multi-factor authentication on business systems, secure disposal of paper records, staff confidentiality obligations, and periodic review of our processors.

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will report it to the Information Commissioner’s Office without undue delay and, where required, notify affected individuals.

9. Your rights

Subject to the conditions and exemptions in data protection law, you have the right to: be informed about our processing; request access to the personal data we hold about you; have inaccurate data rectified; request erasure; request restriction of processing; object to processing carried out on the basis of legitimate interests or for direct marketing; receive certain data in a portable format; and withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Certain rights are limited where we are required by law to retain information — most notably records held under the anti-money-laundering regulations, which we cannot delete on request.

To exercise any right, contact us at info@daleharris.co.uk. We will respond within one month, which may be extended by up to two further months for complex requests. There is normally no fee.

10. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, at ico.org.uk.

11. Changes to this notice

We review this notice periodically and will publish any updated version on this page with a revised date. Material changes affecting existing clients will be notified directly.