Client Privacy Notice

This notice explains how Officium Business Services Ltd uses personal data in providing our services to you. It forms part of your engagement letter and terms of business. If you visit our website, our Website Privacy Policy also applies.

1. Who we are

Officium Business Services Ltd, Top Floor, 108 Bradshawgate, Leigh, Greater Manchester, WN7 4NP. Company number 17464098. Registered with the Information Commissioner’s Office under number ZC251471.

Data Protection Officer: Dean Ainslie, Director — dean@officiumbusinessservices.co.uk, 01942 644864.

2. Our role

• We are the controller of personal data we use to run our relationship with you and to meet our own legal duties — for example your contact details, our engagement and billing records, anti-money laundering checks, and work we do as your agent with HMRC.
• We are your processor where we process personal data on your behalf and on your instructions — in particular your employees’ data when we run your payroll and auto-enrolment, and data in your bookkeeping records. You are the controller of that data and are responsible for having a lawful basis to share it with us and for telling your employees how it is used. We process it only to provide the services you have engaged us for, keep it confidential and secure, use only approved sub-processors, help you respond to data protection requests, and return or delete it when our engagement ends (subject to our legal retention duties).
• Where we work as a subcontractor for another firm, that firm is the controller of its clients’ data and its own privacy notice applies. We act as its processor on its instructions.

3. Whose data we use

• You, and where you are a business, your directors, partners, owners, beneficial owners and contacts.
• Your employees, workers and pensioners, where we provide payroll, auto-enrolment or HR services.
• Other people named in your records or tax affairs, such as family members, tenants, customers and suppliers, where relevant to the work.

4. What data we use

• Identity and contact details: name, address, date of birth, email, telephone, identity documents.
• Tax and financial information: National Insurance and tax references, income, bank details, transactions, accounts and tax records.
• Payroll data: pay, hours, tax codes, pension details, student loans, starter and leaver information.
• Special category data where needed for payroll — for example sickness absence for Statutory Sick Pay, pregnancy and family leave for statutory pay, and trade union subscriptions where deducted from pay. We use this only to calculate and administer pay and statutory payments.
• Anti-money laundering information: identity verification, politically exposed person and sanctions screening results, source of funds where required.

5. Why we use it, and our lawful basis

We do not use your data for marketing and we do not sell it.

6. Identity checks

To meet our anti-money laundering duties we verify identities electronically and screen against politically exposed person, sanctions and adverse media lists. These checks are reviewed by a member of staff; no decision about you is made solely by automated means.

7. Who we share it with

We share personal data only where necessary, with these categories of recipient:

• HMRC, Companies House, pension providers and the Pensions Regulator, to carry out the services and meet legal requirements.
• Service providers who process data on our behalf, such as our payroll, accounting and practice management software, identity verification, secure file sharing, email and cloud storage providers.
• Our anti-money laundering supervisor, the National Crime Agency, regulators, the police and courts, where the law requires or permits it.
• Our professional indemnity insurers and professional advisers.
• Debt recovery agencies, solicitors and the courts, if we need to recover unpaid fees.
• A business that acquires or takes over our business, if that happens, subject to confidentiality.
• Anyone else you ask us to share information with, including tax authorities outside the UK where we act for you in relation to another country.

Service providers act only on our instructions under written contracts that require them to keep data secure.

8. International transfers

Some of our service providers, and some of the clients and firms we work with, are based outside the United Kingdom. Where personal data is transferred outside the UK, we make sure it is protected by one of the safeguards UK law allows, such as:

• a UK adequacy decision — for example for the European Economic Area, or the UK–US data bridge for organisations certified under it;
• the UK International Data Transfer Agreement; or
• the UK Addendum to the EU Standard Contractual Clauses.

Where we act as processor for a client outside the UK, we follow that client’s instructions and the data processing terms in our engagement, and give the client the information it needs to meet the data protection law that applies to it.

You can ask us for details of the safeguards used for any transfer, using the contact details in section 1.

9. How long we keep it

• Client files, tax, accounts and payroll records: 7 years from the end of the tax year to which they relate.
• Anti-money laundering records: 5 years from the end of our business relationship with you, as required by the Money Laundering Regulations 2017.
• Records relating to a claim or dispute: until the matter is concluded and any limitation period has passed.

We then securely delete or destroy the data.

10. Keeping it secure

We use encryption, multi-factor authentication, strict access controls, secure file exchange rather than ordinary email for documents, and regular staff training. Only staff who need access to your data have it, and all staff are screened and bound by confidentiality.

11. Your rights

You have the right to access your personal data, to have it corrected, to have it erased or its use restricted in certain circumstances, to object to processing based on legitimate interests, and to data portability. Some rights are limited by our legal duties — for example we cannot delete records we are required to keep, or tell you about a report we have made under anti-money laundering law.

Where we act as your processor, requests from your employees about their payroll data should go to you as their employer; we will help you respond.

To exercise your rights, contact our Data Protection Officer using the details in section 1. We will respond within one month.

12. Complaints

Please contact us first so we can try to put things right — see how to make a complaint. You can also complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. If you live or are based outside the UK, you may also be able to complain to the data protection authority in your own country.

13. Changes

We may update this notice from time to time. The current version is always available on our website.