Privacy Notice

The Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR) impose certain legal obligations in connection with the processing of personal data.

Oakridge Accounting Limited (trading as Oakridge Accounting), a company registered in England and Wales under company number 17115678, whose registered office is at 24-26 Regent Place, Birmingham, West Midlands, B1 3NJ, is a data controller within the meaning of the UK GDPR, and we process personal data. We are registered with the Information Commissioner's Office under number ZC140562. You can contact us about this notice at privacy@oakridge-accounting.com.

This notice covers our clients, the directors and owners of our company clients, and anyone who contacts us or starts an application through our website, whether or not they go on to become a client.

We may amend this privacy notice from time to time. If we do so, we will supply you with and/or otherwise make available to you a copy of the amended privacy notice.

We intend to process personal data for the following purposes:

• to enable us to supply professional services to you as our client
• to fulfil our obligations under relevant laws in force from time to time, including the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLR 2017), including customer due diligence (CDD), know-your-business (KYB) and politically exposed person (PEP) screening checks, which may be ongoing for the duration of our relationship with you
• to comply with professional obligations to which we are subject as a member of the Association of Accounting Technicians (AAT)
• to use in the investigation and/or defence of potential complaints, disciplinary proceedings and legal proceedings
• to enable us to invoice you for our services and investigate/address any attendant fee disputes that may have arisen
• to reply to questions and applications sent to us through our website, including from people who do not go on to become clients
• to run our client recommendation programme (see our Terms of Service)
• to keep our website and client portal secure and working properly

We do not send marketing emails or texts, and we do not share or sell your details for anyone else's marketing. We promote our services through our own website and social media pages, which does not involve using your personal data.

Our intended processing of personal data has the following legal bases:

• The processing is necessary for the performance of our contract with you, or to take steps you have asked us to take before entering into one (such as replying to your question or considering your application).
• The processing is necessary for compliance with legal obligations to which we are subject (e.g. MLR 2017).
• The processing is necessary for the purposes of the following legitimate interests which we pursue: investigating and/or defending legal, regulatory or disciplinary claims or proceedings; running our client recommendation programme; and keeping our website and client portal secure.
• For the face scan used in identity checks, and for telling the person who recommended you that you have joined us, we rely on your consent, which you can withdraw at any time (see "Withdrawal of consent" below).

It is a requirement of our contract with you that you provide us with the personal data that we request. If you do not provide the information that we request, we may not be able to provide professional services to you. If this is the case, we will not be able to commence acting or will need to cease to act.

When you ask us a question or start an application on our website, we collect what you give us: your name, email address, the package and add-ons you choose, your business details (such as its name, Companies House number and what it does), your question, and, if you ask us to call you, your phone number and a convenient time. If you enter a company number we look the company up on the public Companies House register to fill in its details. If you enter a recommendation code we record who recommended you.

We use these details only to reply to you, to consider your application and, if you become a client, to set up your account. To stop our forms being misused, we also keep a one-way coded version of the internet address a question was sent from, which cannot be turned back into the address. Our question forms also use a spam check provided by Cloudflare (Turnstile), which looks at how the visitor's browser behaves to tell people from automated software; Cloudflare acts as our data processor for this, and it is not used to track you across other websites.

If you do not go on to become a client, we keep these details for up to 12 months after our last contact with you, in case you come back to us, and then delete them. You can ask us to delete them sooner at any time.

To meet our customer due diligence duties under MLR 2017 we verify the identity of each individual client, and of the directors and the owners (anyone holding more than 25% of the shares or votes, or otherwise controlling the company) of each company client. We also screen them against sanctions lists, politically exposed person (PEP) lists and adverse media.

How it works

• You (or your company's representative) give us each person's name, email address, date of birth, role and ownership percentage through your client portal.
• We email each person a link of their own. Before they start, they are shown this notice and asked to agree to the face scan.
• They then photograph an identity document (a passport or driving licence, for example) and complete a short live face scan on the verification service's secure page. The face scan is compared with the photo on the document, and checks that a real person is present.
• The service screens the person against sanctions, PEP and adverse media sources and returns a result to us.
• A person at Oakridge Accounting reviews anything flagged, and records the decision we take.

Who does this for us

The checks are carried out for us by Didit Identity Spain, S.L., of Calle Nápoles 227, P. 1, 08013 Barcelona, Spain ("Didit"), acting as our data processor under a contract that requires it to process the data only on our instructions and to protect it. Didit stores the data in the European Union by default. Separately, Didit may use limited information from these checks, after removing or masking the details that identify you, for its own security and fraud-prevention purposes, such as spotting forged documents and repeated fraud. For that limited purpose Didit is an independent controller of that information rather than acting on our instructions. Didit also publishes its own verification privacy notice, which explains how it handles the data it collects from you during the check.

The personal data involved

• name, email address, date of birth, role in the company and ownership percentage
• the details on your identity document (such as document type and number, nationality and expiry date) and an image of the document
• your home address, and a recent utility bill or bank statement that proves it
• your answers about the business, including whether you or someone connected with the business is a politically exposed person
• a face scan, which is biometric data used to confirm that you are the person on the document. This is a special category of personal data
• the results of sanctions, PEP and adverse media screening. Adverse media results can include information about alleged or proven criminal offences

Our legal basis

• Checking identity and screening are necessary for compliance with a legal obligation, MLR 2017.
• The face scan relies on your explicit consent. You do not have to agree: if you would rather not use the face scan, tell us and we will verify your identity another way, such as certified copies of your documents. You can withdraw your consent at any time.
• Where screening results include information about offences or alleged offences, we process it under the substantial public interest conditions in Schedule 1 of the Data Protection Act 2018 for preventing or detecting unlawful acts and for suspicion of money laundering or terrorist financing.

If you give us details about someone else

If you give us details about a director or owner of your company, please make sure they know to expect our email. We only ask for what we need. We will also email them directly with this notice before they are asked to do anything.

How long we keep it

We keep identity check and screening records for as long as you are our client and afterwards for the retention period set out below (currently six years from the end of the relationship, which is never less than the five years that MLR 2017 require). We repeat the checks when something changes, for example a change of directors or owners, new services, a concern we have, or when a periodic review falls due. Earlier results remain part of our record for the whole retention period. When that period ends, we delete the records we hold, and we delete the data held for us by Didit.

As part of our legally required anti-money laundering, customer due diligence, know-your-business and PEP checks, we may collect identity verification data, company and beneficial ownership information, and the results of sanctions and PEP screening.

This information may come from Companies House, credit reference agencies, sanctions and PEP screening databases, and specialist third-party identity verification services engaged for this purpose. Details of a company's directors and owners are usually given to us by the company's representative, and identity document images and face scans are collected directly from the individual by our identity verification provider on our behalf.

If you choose to connect a payment provider (SumUp, Square, Stripe or Zettle), you approve read-only access on that provider's own page. We never see your password for the provider, and we cannot take payments, refund anything or change anything in your account with it.

What we read and why

• your sales, refunds and the processing fees the provider took, with the date, amount, currency, a reference and the type of payment (for example card or cash)
• the name and identifier of the provider account that is connected, so we know which account the figures belong to
• the provider's own record of each payment, which can include limited details about your customers' payments, such as the type of card or its last four digits

We use this only to prepare your weekly sales postings in your accounting software and to check them against your records. We do not use it for marketing, and we do not sell it. The legal basis is the contract with you for our services.

How long we keep it, and how to stop it

The figures we post become part of your accounting records and are kept for the retention period set out below. You can disconnect the provider at any time from the Integrations tab of your portal; when you do, we delete the access we hold for your account straight away and stop reading your data. You can also remove our access from inside the provider's own settings. Your rights described in this notice, including the right to ask us to erase data, apply to what we hold, subject to the records we must keep by law.

We may share your personal data with:

• Companies House, Charity regulators and HMRC
• any third parties with whom you require or permit us to correspond
• subcontractors
• an alternate appointed by us in the event of incapacity or death
• professional indemnity insurers
• our professional body, the Association of Accounting Technicians (AAT), and/or the Office for Professional Body Anti-Money Laundering Supervisors (OPBAS), in relation to practice monitoring and/or the requirements of MLR 2017 (or any similar legislation)
• our accounting and payment-processing software providers, acting as data processors on our behalf, including Xero, QuickBooks (Intuit), Microsoft 365 and, for the payment provider you choose to connect, SumUp, Square, Stripe or Zettle, in order to deliver our services to you. Payment providers only ever give us read-only access to your sales, refunds and fees
• the service that turns our letters and agreements into PDF documents for you to sign and keep, PDFShift, acting as our data processor. It receives the text of the document being made, such as your name, address and fees, and any signature you drew
• the services that help us work out your mileage claims, acting as our data processors: a postcode lookup service and a route-distance service, which receive the postcodes of the start and end of each journey, and a vehicle lookup service, which receives the number plate you give us
• our email providers, acting as data processors on our behalf: IONOS, which hosts our email and sends the automatic emails from our website and client portal, and Microsoft 365, which sends some of our automated reminders
• the providers that host our website and client portal, acting as data processors on our behalf: Supabase (our database, file storage and log-in system, hosted in Ireland) and Netlify (which serves our website)
• Cloudflare, which runs the spam check on our question forms (Turnstile), acting as our data processor, and receives how the visitor's browser behaves and the internet address the question is sent from
• Didit Identity Spain, S.L., our identity verification and screening provider, acting as our data processor (and, for its own limited security and fraud-prevention purposes, as an independent controller) (see "Identity checks and screening" above)

If the law allows or requires us to do so, we may share your personal data with:

• the police and law enforcement agencies
• courts and tribunals
• the Information Commissioner's Office (ICO)

We may need to share your personal data with the third parties identified above in order to comply with our legal obligations, including our legal obligations to you. If you ask us not to share your personal data with such third parties, we may need to cease to act.

Most of your personal data is processed and stored within the UK/EEA. Our client portal's database and files are held in Ireland. However, some of the third-party providers we use (in particular Intuit, the provider of QuickBooks, Stripe and Square, the payment providers, and Netlify, which serves our website, all US-based companies) may process or store data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, such as adequacy regulations or the international data transfer agreement or addendum, as required under UK GDPR. Our identity verification provider stores identity check data in the European Union by default.

Our website does not use advertising, tracking or analytics cookies, and we do not use social media pixels or similar tools. We only store the small pieces of information on your device that the site needs to work or that you ask it to remember, so we do not ask for your consent to them. They are:

• your log-in session, so you stay signed in to the client portal (kept in your browser's local storage until you sign out)
• whether you chose the light or dark theme (local storage, until you clear it)
• whether you left the portal's side menu open or closed (a cookie that expires after 7 days)
• files you are part-way through uploading in the portal (session storage, cleared when you close the tab)
• if you arrived through a client's recommendation link, their recommendation code, so it is applied when you sign up (local storage, removed after 30 days or when you sign up)

Our website's fonts are served from our own website, not from a third party. Our hosting providers record technical information such as your internet address in their server logs, which they use to run the service securely. You can clear or block cookies and local storage in your browser settings, but you may then not be able to stay signed in to the portal.

When acting as a data controller and in accordance with recognised good practice within the tax and accountancy sector, we will retain our records relating to you for six years, whether from the end of the tax year to which a tax return relates, from the date an ad hoc advisory engagement ceased, or from the end of an ongoing client relationship, as applicable.

Where our engagement with you ends before this six-year period has elapsed, your working papers and records will ordinarily be passed to your new accountant or adviser upon receipt of a proper professional clearance request, at which point that successor firm becomes responsible for deciding what is relevant to retain.

Our contractual terms provide for the retention of records on this basis, and agreement to our contractual terms is taken as agreement to this policy.

You are responsible for retaining information that we send to you (including details of capital gains base costs and claims and elections submitted), and this will be supplied in the form agreed between us. Documents and records relevant to your tax affairs are required by law to be retained by you as follows:

Individuals, trustees and partnerships:

• with trading or rental income: five years and 10 months after the end of the tax year
• otherwise: 22 months after the end of the tax year

Companies, LLPs and other corporate entities:

• six years from the end of the accounting period

Identity check and screening records are kept on the basis described under "Identity checks and screening" above.

Where we act as a data processor as defined in DPA 2018, we will delete or return all personal data to the data controller at the termination of the contract, as agreed with the controller.

You have a right to request access to your personal data that we hold. Such requests are known as 'subject access requests' (SARs).

Please provide all SARs in writing to privacy@oakridge-accounting.com.

To help us provide the information you want and deal with your request more quickly, you should include enough details to enable us to verify your identity and locate the relevant information. For example, you should tell us:

• your date of birth
• previous or other name(s) you have used
• your previous addresses in the past five years
• personal reference number(s) that we may have given you, for example your national insurance number, your tax reference number or your VAT registration number
• what type of information you want to know

If you do not have a national insurance number, you must send a copy of:

• the back page of your passport or a copy of your driving licence, and
• a recent utility bill

DPA 2018 requires that we comply with a SAR promptly and in any event within one month of receipt. There are, however, some circumstances in which the law allows us to refuse to provide access to personal data in response to a SAR (e.g. if you have previously made a similar request and there has been little or no change to the data since we complied with the original request).

In some circumstances the law prevents us from telling you about reports or enquiries we have made to the authorities under the anti-money laundering rules, and exempts that information from subject access requests.

We will not charge you for dealing with a SAR.

You can ask someone else to request information on your behalf — for example, a friend, relative or solicitor. We must have your authority to respond to a SAR made on your behalf. You can provide such authority by signing a letter that states that you authorise the person concerned to write to us for information about you and/or receive our reply.

Where you are a data controller and we act for you as a data processor (e.g. by processing payroll), we will assist you with SARs on the same basis as is set out above.

You have a right to obtain the rectification of any inaccurate personal data concerning you that we hold. You also have a right to have any incomplete personal data that we hold about you completed. Should you become aware that any personal data that we hold about you is inaccurate and/or incomplete, please inform us immediately so we can correct and/or complete it.

In certain circumstances, you have a right to have the personal data that we hold about you erased. Further information is available on the ICO website. If you would like your personal data to be erased, please inform us immediately and we will consider your request. In certain circumstances, we have the right to refuse to comply with a request for erasure. If applicable, we will supply you with the reasons for refusing your request.

In certain circumstances, you have the right to 'block' or suppress the processing of personal data or to object to the processing of that information. Further information is available on the ICO website. Please inform us immediately if you want us to cease to process your information or you object to processing so that we can consider what action, if any, is appropriate.

In certain circumstances, you have the right to be provided with the personal data that we hold about you in a machine-readable format, e.g. so that the data can easily be provided to a new professional adviser. Further information is available on the ICO website.

The right to data portability only applies:

• to personal data an individual has provided to a controller
• where the processing is based on the individual's consent or for the performance of a contract
• when processing is carried out by automated means

We will respond to any data portability requests made to us without undue delay and within one month. We may extend the period by a further two months where the request is complex or a number of requests are received but we will inform you within one month of the receipt of the request and explain why the extension is necessary.

Where you have consented to our processing of your personal data, you have the right to withdraw that consent at any time. Please inform us immediately if you wish to withdraw your consent.

Please note:

• the withdrawal of consent does not affect the lawfulness of earlier processing
• if you withdraw your consent to the face scan, tell us and we will verify your identity another way; where we can, we will also delete the face scan data held for us by our identity verification provider
• if you withdraw your consent, we may not be able to continue to provide services to you
• even if you withdraw your consent, it may remain lawful for us to process your data on another legal basis (e.g. because we have a legal obligation to continue to process your data)

Our identity verification provider produces an automated result for each identity check (for example approved, in review or declined). We do not take any decision about you based solely on that result: a person at Oakridge Accounting reviews anything that is flagged or declined before any decision is made, and you can ask us to explain it or to review it again. Apart from this, we do not intend to use automated decision-making in relation to your personal data.

If you have requested details of the information we hold about you and you are not happy with our response, or you think we have not complied with the UK GDPR or DPA 2018 in some other way, you can complain to us. Please send any complaints to complaints@oakridge-accounting.com.

If you are not happy with our response, you have a right to lodge a complaint with the ICO.