Privacy Notice

This privacy notice covers etctax.co.uk and the data we collect from you when you use our site, together with the personal data we process when you contact us using our online form, or contact details, and the personal data we process when we deliver our services to you.

These are our reasons for collecting it, what we do with it and what your rights are.

Who are we?

We are Enterprise Tax Consultants Ltd. Our registered address is 1st Floor, Market Court, 20-24 Church Street, Altrincham, Cheshire, United Kingdom, WA14 4DW (company registration number 08783235).

You can call us on 0161 711 1320, and email us at admin@etctax.co.uk .

We are the data controller for this processing and are registered with the Information Commissioner’s Office (ICO).  Our registration number is ZA267829.

Purpose of processing

We process your personal data:

• to respond to enquiries about our services,
• to take the necessary steps to enter into a contract with you,
• to deliver our services to you once we have a contract with you,
• to market our services to you.

Basis of processing

Where we are responding to enquiries about our services, we process your personal data because it is in our legitimate interest to do so in order to deal with your enquiry.

Where we are negotiating with you to provide our services to you then we process your personal data because we are taking the necessary steps, at your request, prior to entering into a contract with you personally.  Where you are negotiating with us to provide services to your organisation, rather than to you as an individual, or where we are dealing with your appointed intermediary then we process your personal data because it is in our legitimate interest to do so in order to take the necessary steps to provide our services.

Where we have a contract with you personally we process your personal data because it is necessary to fulfil the contract with you.  Where our contract is with your organisation or with your appointed intermediary, rather than with your personally, then we process your personal data because it is in our legitimate interest to do so in order to provide our services under the contract with your organisation or appointed intermediary.  We will also have some legal obligations to which we are subject when we are evaluating your needs as a potential client, or when we are delivering our services to you or your organisation as a client or your appointed intermediary, and we will process your personal data in accordance with those obligations.

Where we are directly marketing our services to you we process your personal data either because it is in our legitimate interest to do so and you have not opted out of receiving direct marketing (if you are a client, or have previously discussed becoming a client), or because we have your consent to do so (if you have opted in to receive our direct marketing).

Where we are relying on your consent to process your personal data you are free to withdraw that consent at any time.  Where we are relying on our legitimate interests to process your personal data you may object to that processing at any time.

What personal data do we collect?

We will collect and process the following data from our website’s contact form or when you get in touch with us to make an enquiry

• Your name
• Your email address
• Your telephone number
• Your organisation name

When we need additional information to deliver our services, or to take the steps necessary for us to do so, we collect a range of personal data depending upon the particular services being discussed or provided.

The personal data concerned will include some or all of the following:

• Your date of birth, age & gender
• Copies of passports and visas (or other ID documents required)
• Your nationality and citizenship status
• Your National Insurance number
• Your bank account and tax details
• Your career history
• Your assets and beneficiaries
• Your marital status, social circumstances and any other affairs where pertinent to the services we deliver
• Payment details when we process payment for our services
• Recordings and transcripts of our calls with you

When we are processing your personal data for our marketing activities we may process the following personal data, depending upon the nature of the activity,

• Information you provide to us for the purpose of attending meetings and events, including access and dietary requirements
• Your social media details when you interact with us on social media
• Your feedback when you reply to our feedback requests or participate in client surveys

Special category data

There are additional rules we must follow if we collect certain types of more sensitive data, known as Special Category Data.  These include details of your ethnicity, beliefs, health and sexuality.  We may need to process some special category data to deliver our services to you or evaluate which services are appropriate.  We may also process personal data relating to any pertinent criminal convictions you may have.

When we are inviting you to events, or to attend meetings, we will ask if you have any special access requirements or dietary requirements (some dietary requirements may indicate your beliefs or ethnicity and so are classed as special category data).

We will always seek your explicit consent for collecting any special category data from you. 

We may need to retain special category data where we need to establish, exercise or defend legal claims and the data are relevant.

Do we ever share personal data?

We will share your data if required to do so by a legitimate law enforcement agency. 

When you submit your personal data online your data is held by our partner who hosts our website.

We use a number of cloud based IT systems such as Microsoft Office 365, Krisp, Docusign, TaxFiler, Xero, Datto & Xama.  We ensure that we have appropriate contracts in place with these organisations to protect your rights, and that where data are transferred internationally there is a lawful mechanism to do so.

If you consent to the use of analytics and tracking cookies from our website we will share data with those third party cookie providers (please see our separate cookie policy)

If we are communicating with you via email or social media channels we will be sharing your personal data with those email and social media providers.

We will occasionally use external service providers to support the provision of service to you, where we do so we will always ensure we have appropriate Data Processing Agreements in place with the provider.

How do we keep your data secure?

We take sensible steps to keep your data secure:

• All data sent between your browser and our website are encrypted in transit
• All data we hold in our computers are encrypted at rest
• Paper records are held in locked cabinets within secure premises

Your Rights

You have a number of rights relating to the processing of your data, if you would like to use them or have any questions then please contact us.

We won’t charge you for doing any of the following, however we may make a charge in the case of frequent repeat requests:

• Awareness: You have the right to be fully informed about why and how we process your information.  This privacy notice is intended to meet that requirement, but please do contact us if you have any questions
• Access: You have the right to a copy of the data we hold about you
• Rectification: If you think some of the data we hold is wrong then you have the right to ask us to correct it
• Erasure: You have the right to ask us to delete the data we hold about you.  Where we are holding the data to fulfil a contract with you or for a lawful basis other than consent then we will need to retain the data in accordance with the data retention requirements shown below
• Restriction: You have the right to ask us to restrict the processing of personal data whilst we check its accuracy, if you think the processing is unlawful, if you believe we no longer need to process the data but you need us to store it due to pending legal claims, or when you object to our processing based upon our legitimate interests and we are assessing the validity of that.
• Object: Where we are processing your personal data based upon our legitimate interests you have the right to object to that.  If your objection is valid (for instance in the case of any direct marketing activity) then we will stop processing your personal data for that purpose.
• Data portability: You can request a copy of your data in a digital format which you can then supply to another provider
• Automated decisions and profiling: You have the right, in certain circumstances, not to be subject to decisions based on automated processing (including profiling) if it has a significant or legal impact on you.  This doesn’t apply if the processing is necessary to fulfil a contract with you, or if you have given us your consent to do so.

How long do we keep your data for?

Where we are relying on your consent or our legitimate interests to process your data then we will keep your personal data until you withdraw your consent for us to use it, or object to the processing in our legitimate interests and we agree with your objection.

Where are processing your data for the purposes of performing a contract with you, or taking the necessary steps to do so, then we will keep the personal data for 7 years after the end of the contract.

We will also retain your personal data according to other applicable UK laws and regulations, depending upon the nature of the services we have provided to you.

Cookies – How do we use cookies on our website

We utilise cookies on our website.  Some are required for our site to work, these are known as essential cookies, and we also use others for analytics and marketing purposes.

We will ask for your consent to use any cookies which aren’t essential, and we won’t deploy any non-essential cookies without your consent. 

Please see our separate cookie policy for more information.

What happens when I follow links to other sites?

If you follow a link from our site to another site then you should read the privacy notice on the other site prior to providing your data to them.

Where do we process data?

We process data at the address shown above.  Our web hosting provider processes data in the UK and EU.

Our cloud based software providers process data as follows:

• TaxFiler –  UK
• Xero –  UK
• Datto –  USA (registered with UK Extension to the EU-US Data Privacy Framework to enable the lawful international transfer of personal data)
• Xama –   UK
• Krisp –  USA (Using the UK Addendum to Module 2 of the European Commission’s Standard Contractual Clauses to enable the lawful international transfer of personal data)
• Docusign – USA (Using the UK Addendum to Module 2 of the European Commission’s Standard Contractual Clauses to enable the lawful international transfer of personal data)

Our contracts with our software providers include the necessary provisions required by UK GDPR to further protect your rights.

If we are using an external service provider based outside of the UK to support our delivery of service to you then, in addition to the Data Processing Agreement in place with them, we will only transfer your data to them where we have an approved mechanism in place.  For example the provider is based in a nation deemed to be adequate by the UK authorities or if the nation lacks adequacy status and the provider has not already enabled a lawful transfer mechanism then we will put in place an International Data Transfer Agreement as per the ICO’s guidance.

Making a complaint

Please contact us at the above address.  You can also contact the Information Commissioner’s Office (ICO) on their helpline 0303 123 1113 or online at www.ico.org.uk.  If you should contact the ICO they will normally ask you to contact us first.