Privacy Policy

Who we are

This is the privacy statement of David Marshall Associates, an unincorporated Chartered Accountancy firm, regulated by The Institute of Chartered Accountants of Scotland, and having a business address at CBC House, 24 Canning Street, Edinburgh, EH3 8EG.

This privacy statement explains how we collect and use personal information about you.

What personal information we collect.

David Marshall Associates (“DMA”) collects personal information in its role as external accountant, tax agent or payroll processer to clients in performing the duties of a Chartered Accountancy practice. As our role varies from client to client so too will the information requested and collected.

The personal information most commonly collected from clients is as follows:

Name.
Contact details (including home and business addresses, email, telephone number).
Date of birth.
Unique Tax Reference (UTR) number.
National Insurance number.
Employment details (including current and previous employers).
Business accounts details.
Bank account details.
Investment and savings income details.
Pension details.
Records of enquiries, meetings and other direct engagement.
Copies of physical and electronic correspondence.
Financial information.

Where we collect personal information from

DMA is committed to protecting your data whilst using our services. This privacy Policy relates to our use of personal information we collect from you via;

Meetings and discussions in person;
Email and written correspondence;
Telephone discussions;
All electronic data;
Any cloud applications (for example Xero accounts or Sage One Accounts);

In nearly all instances, it should be obvious to you that DMA is collecting your personal data.

How we use your personal information

We will use your data in performing our duties as outlined in our Engagement Letter. The purposes for which personal information is processed may include any or all of the following (the list is non-exhaustive);

Deliver services and meet legal responsibilities;
Verify identity where this is required;
Communication by post, email or telephone;
Understand needs and how they may be met;
Maintain records;
Process financial transactions;
Prevent and detect crime, fraud or corruption.

Who we share your personal information with

Some of the processing activities set out above require DMA to share personal information with the UK Tax Authorities (HMRC). Whenever we share personal data, we take all reasonable steps to ensure the communication is secure.

We do not share your personal data with any other organisations unless you have expressly requested for us to do so; for example, you may ask us to supply your mortgage broker with details of your last tax return or your bank with a copy of your last set of accounts.

We will not sell or rent your information to third parties.

We will not share your information with third parties for marketing purposes.

Any staff with access to your information have a duty of confidentiality under the ethical standards that this firm is required to follow.

How you can access and update your information

Keeping your information up to date and accurate is important to us. We commit to regularly review and correct where necessary, the information that we hold about you. If any of your information changes, please email or write to us, or call us using the ‘Contact information’ noted below.

You have the right to ask for a copy of the information that DMA holds about you.

Security precautions in place to protect the loss, misuse or alteration of your information

Whilst we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk.

Once we receive your information, we make our best effort to ensure its security on our systems. Where we have given, or where you have chosen, a password which enables you to access information, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Your data will usually be processed in our offices in the UK. However, to allow us to operate efficient digital processes, we sometimes need to store information in servers located outside the UK, but within the European Economic Area (EEA). We take the security of your data seriously and so all our systems have appropriate security in place that complies with all applicable legislative and regulatory requirements.

Your choices

We may occasionally contact you by post / email / telephone with details of any changes in legal and regulatory requirements or other developments that may be relevant to your affairs and, where applicable, how we may assist you further. If you do not wish to receive such information from us, please let us know by contacting us as indicated under ‘Contact information’ below.

You have the right to ask for a copy of the information that DMA holds about you.

Security precautions in place to protect the loss, misuse or alteration of your information

Whilst we strive to protect your personal information, we cannot guarantee the security of any information you transmit to us, and you do so at your own risk.

Your choices

How long we retain your personal information for

We will retain your personal information on file for as long as you remain our client to continue to deliver services to you. In addition, we may retain personal information for a period of up to six years after you cease to become a client in fulfilment of our statutory obligations. In cases of probate we are required to retain information on our files for periods of up to twenty years.

Your rights

Access to your information – You have the right to request a copy of the personal information about you that we hold.

Correcting your information – We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.

Deletion of your information – You have the right to ask us to delete personal information about you where:

You consider that we no longer require the information for the purposes for which it was obtained.
We are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below.
You have validly objected to our use of your personal information – see Objecting to how we may use your information below.
Our use of your personal information is contrary to law or our other legal obligations.

Objecting to how we may use your information – You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.

Restricting how we may use your information – In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information, but you don’t want us to delete the data. Where this right to validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Automated processing – If we use your personal information on an automated basis to make decisions which significantly affect you, you have the right to ask that the decision be reviewed by an individual to whom you may make representations and contest the decision. This right only applies where we use your information with your consent or as part of a contractual relationship with you.

Withdrawing consent using your information – Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.

Please contact us in any of the ways set out in the Contact information and further advicesection if you wish to exercise any of these rights.

Changes to our privacy statement

We keep this privacy statement under regular review and will place any updates on our website. Paper copies of the privacy statement may also be obtained from us on request.

This privacy statement was last updated on 1 May 2018.

Contact information and further advice

Should you require any further information or advice please do not hesitate to contact us by writing to our office address; David Marshall, Data Processing Officer, David Marshall Associates, CBC House, 24 Canning Street, Edinburgh, EH3 8EG.

Complaints

We seek to resolve directly all complaints about how we handle personal information, but you also have the right to lodge a complaint with the Information Commissioner’s Office, whose contact details are as follows:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Telephone – 0303 123 1113 (local rate) or 01625 545 745

Website – https://ico.org.uk/concerns