Privacy notice

Auriol Advisory Limited (“Auriol Advisory”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This privacy notice explains how we collect, use, store and protect personal data relating to clients, prospective clients, professional contacts, suppliers, website users and other individuals with whom we interact.

Auriol Advisory Limited is the controller of personal data to which this notice relates unless we expressly state otherwise.

Our details are:

Depending on the nature of our relationship with you, we may collect and process information including:

• your name, title and contact details;
• information about your business, employment or professional activities;
• identification and verification information, including copies of identification documents;
• date of birth and, where necessary, nationality or residency information;
• financial, accounting, tax and transactional information;
• bank account and payment information;
• company, partnership, trust, ownership and beneficial ownership information;
• information concerning directors, shareholders, partners, trustees and persons with significant control;
• correspondence and records of communications with you;
• information you provide when requesting a proposal, quotation or professional services;
• information required for anti-money laundering, sanctions, fraud prevention and client due diligence purposes;
• information obtained from Companies House, HM Revenue & Customs, credit reference or identity verification providers, sanctions databases and other publicly available or lawful third-party sources;
• technical information arising from your use of our website, including IP address, browser information and cookie information; and
• any other information reasonably required for the provision of our professional services.

In some circumstances, information provided to us in connection with client work may include personal data about individuals other than the client.

We may obtain personal data:

• directly from you;
• from our clients or prospective clients;
• from your employer, company, advisers or representatives;
• from Companies House, HM Revenue & Customs or other government bodies;
• from professional advisers or previous accountants;
• from identity verification, anti-money laundering, sanctions screening or credit reference providers;
• from publicly available sources, including professional networking platforms and company websites; and
• through your use of our website.

Where personal information has not been obtained directly from you, we will process it in accordance with applicable data protection legislation.

We may process your personal information for the following purposes:

Providing professional services

To provide accounting, tax, financial, business advisory, corporate and related professional services and to administer our relationship with you.

The lawful basis will normally be that processing is necessary for the performance of a contract or to take steps at your request before entering into a contract.

Legal and regulatory obligations

To comply with obligations imposed upon us by law, regulation or our professional bodies, including requirements relating to:

• anti-money laundering and counter-terrorist financing;
• sanctions;
• fraud prevention;
• tax and accounting;
• professional standards;
• regulatory supervision; and
• responding to lawful requests from government, regulatory, judicial or law enforcement authorities.

The lawful basis for this processing will normally be compliance with a legal obligation.

Client administration and business management

To operate our business, maintain appropriate records, manage our relationship with clients and suppliers, administer payments, recover debts, manage risk, maintain professional indemnity insurance and establish, exercise or defend legal claims.

We process this information where necessary for our legitimate interests in operating and protecting our business or where necessary to comply with legal obligations.

Client acceptance and risk management

To conduct client due diligence, verify identity and ownership, assess risk and determine whether we are able to accept or continue an engagement.

This may be necessary to comply with legal obligations and for our legitimate interests in maintaining appropriate professional and commercial risk controls.

Marketing and professional communications

We may use your business contact details to provide information about services, professional developments, events or other matters which we believe may be relevant to you.

We will do so only where permitted by law and you may ask us to stop sending marketing communications at any time.

Website administration and security

We may process technical data to maintain, protect and improve our website and systems, prevent misuse and understand how our website is being used.

The lawful basis for this processing is generally our legitimate interests in operating a secure and effective website. Where consent is required for cookies or similar technologies, we will obtain it before those technologies are used.

As a provider of professional accountancy and related services, we may be required to obtain and retain information about clients, beneficial owners and associated persons for anti-money laundering, sanctions and other regulatory purposes.

We may use electronic identity verification or screening services for these purposes.

Where information is processed in order to comply with our legal obligations, you may not be able to require us to delete that information while the relevant statutory or regulatory retention period continues.

Where appropriate, we may disclose personal information to:

• HM Revenue & Customs;
• Companies House;
• courts, tribunals and government authorities;
• regulators and professional bodies;
• anti-money laundering, sanctions screening and identity verification providers;
• banks and payment service providers;
• insurers and insurance brokers;
• legal advisers and other professional advisers;
• accountants, tax advisers or other professional firms working with us on your affairs;
• IT, software, cloud hosting, data storage and cybersecurity providers;
• document management and electronic signature providers;
• contractors or outsourced service providers assisting us in providing services;
• debt recovery providers; and
• law enforcement agencies where disclosure is required or permitted by law.

We require service providers processing information on our behalf to handle personal data appropriately and in accordance with applicable data protection requirements.

We do not sell your personal data.

Some of our technology or professional service providers may process personal information outside the United Kingdom.

Where personal data is transferred internationally, we will take appropriate steps to ensure that the transfer complies with applicable data protection legislation and that appropriate safeguards are in place where required.

Further information about relevant safeguards is available from us on request.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to satisfy applicable legal, regulatory, tax, accounting, insurance and professional requirements.

The precise retention period will depend upon the nature of the information and our relationship with you.

Client files and associated records will generally be retained for at least six years following the end of the relevant engagement, although certain information may be retained for longer where required or appropriate because of legal, regulatory, tax, professional indemnity or limitation requirements.

Anti-money laundering records will be retained for the period required by applicable legislation.

When information is no longer required, we will delete, destroy or anonymise it as appropriate.

We maintain appropriate technical and organisational measures designed to protect personal information from unauthorised access, alteration, disclosure, loss or destruction.

Access to personal information is restricted to individuals and service providers who reasonably require access for legitimate business or professional purposes.

No method of electronic transmission or storage can, however, be guaranteed to be completely secure.

Depending on the circumstances, you may have rights under data protection legislation including the right to:

• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of your personal information;
• object to particular processing;
• request restriction of processing;
• request transfer of certain information to you or another organisation;
• withdraw consent where processing is based upon consent; and
• object to direct marketing.

These rights are subject to exemptions and qualifications under applicable law and will not apply in every case.

To exercise any of these rights, please contact us at jorgina@aurioladvisory.com.

If you have concerns about the way we use your personal information, please contact us in the first instance so that we can investigate your concerns.

You also have the right to make a complaint to the Information Commissioner's Office (“ICO”), the UK supervisory authority for data protection.

Information about making a complaint is available at www.ico.org.uk.

We may update this privacy notice from time to time to reflect changes in our business, our services or applicable law and regulation.

The current version will be published on our website and the date of the latest revision will appear at the top of this notice.