Corporate Clients and Audited Entities

We aim to collect personal data only to the extent necessary for us to provide our services to our clients, audited entities and for other agreed purposes. Where personal data is required for us to provide services to our clients or audited entities, we request that these entities provide all necessary information to relevant individuals (known as “data subjects”) about our use of personal data. Our clients or audited entities may therefore refer data subjects to this Privacy Notice. We generally collect personal data directly from our clients, audited entities or from third parties acting on their instructions.

Such personal data may be used for the following purposes:

• Provision of professional services – We undertake a wide range of services, including Audit, Tax, Advisory and Outsourcing services. We may have to process personal data in order to perform such services and/or provide advice and deliverables to our clients (or audited entities in the case of audit services).
• Managing, administering and developing our business – We process personal data in order to manage our relationship with clients, develop our business and services, maintain and develop our IT systems, manage and host events, and to administer and manage our website, systems and applications.
• Quality and risk management and security – we use various measures to protect personal data and other client information, which include monitoring the services provided to clients and audited entities to detect, investigate and resolve security threats. Such monitoring may involve processing personal data, for example the automatic scanning of email correspondence for threats. Our client take-on procedures involve processing personal data that may be obtained from publicly available sources (such as sanctions lists, criminal convictions databases, and general internet searches) to identify any risks relating to individuals and organisations that may prevent us from working for a particular client, audited entity or on a particular engagement.
• Providing information about our services to our clients and audited entities – unless the relevant individual has opted-out, we may use client or audit entity business contact details to provide information about our services and activities and events that may be of interest.
• Compliance with legal obligations – as a regulated firm, we are subject to various legal obligations that may require us to process and/or retain personal data held on our client and audit files.

Certain services may also require us to process special categories of personal data such as race or ethnic origin, physical and mental health, criminal records, and political, religious and philosophical beliefs. We will only process such personal data with the individual’s consent or as required by law.

Where we process personal data for the above purposes, we rely on one or more of the following lawful bases:

1. Where it is necessary for our performance of contractual obligations.
2. Where it is necessary for our performance of legal obligations
3. Where it is in our, or a third party’s, legitimate interests, provided that:

i. the processing is necessary to pursue the legitimate interests;
ii. the data subject’s interests do not override the legitimate interests; and
iii. the data subjects have the right to:

a. request deletion of their personal data, provided they object to our processing and their interests override our own or those of a third party;
b. restrict processing of their personal data, provided they object to the necessity of the processing. In such circumstances, processing may be restricted for such time as to allow us to investigate their objections; and
c. object to the processing of their personal data in circumstances where such processing is necessary for a legitimate interest, or where processing is used for marketing purposes.