We are committed to protecting and respecting your privacy and complying with Data Protection Legislation including the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA).  This policy describes the personal data we collect from you and the legal basis for processing. It also describes your rights as a data subject.

Our role…

“Benee Consulting Limited” (and “we”, “us”, or “our”) is a ‘Controller’ when we decide how and why Personal Data is processed. When we process personal data on the explicit written instruction of our clients, we are a Processor. We conduct both these roles, in accordance with guidance issued by the Information Commissioner’s Office (ICO), the Institute of Chartered Accountants in England and Wales (ICAEW) and the Institute of Chartered Accounts in Scotland (ICAS).

Data Protection Officer

Sarah Flint is the Data Protection Officer and she can be contacted by email at sarah@beneeconsulting.com

How we obtain your personal data

We collect such Personal Data that is necessary for us to perform our services and we ask clients only to share such Personal Data as required for that purpose. Where we identify that a client has provided us with unnecessary Personal Data, we either return that information to its source or destroy it, considering the client’s preference wherever possible.

Personal data

Data is provided in a number of ways;

  1. Data that you provide to us by:
  • Communicating with us by either our or your secure portal;
  • filling in forms on our website https://www.beneeconsulting.com/, particularly the contact us page https://www.beneeconsulting.com/contact-us;
  • corresponding with us by telephone;
  • corresponding with us by email;
  • corresponding with us by letter;
  1. Data that we collect from publicly available sources:
  • from social media such as LinkedIn;
  • from our own research activities such as reviewing websites.
  1. Data that we receive from referrals:
  • We may receive unsolicited personal data in the form of a business-to-business referrals.

The personal data that we process about you

If you are a prospective customer, we process the following:

  • First name;
  • Last name;
  • Company name;
  • Web site address;
  • Email address;
  • Telephone number;
  • Any further personal data that you chose to provide in your initial enquiry;
  • Any further personal data that you choose to provide during subsequent discussions whether by phone, email or letter.

If you are a personal or sole trader customer, we also process the following:

  • Your name, home address and date of birth;
  • name, home address and date of birth of any family members, advocates or other beneficiaries and connected parties who are involved with your finances.

If you are a business customer, we also process the following:

  • Company name, registration number, business type and industry sector;
  • Name, home address and date of birth of officers of the company;
  • Name, address, job title, email address and telephone number(s) of all employees who engage directly with Benee Consulting.

If you are a supplier, we process the following:

  • Company name;
  • Business type and industry sector;
  • Company address(es);
  • Company registration number;
  • company telephone number(s);
  • name, address, job title, email address and telephone number(s) of all employees who engage with or will engage with Benee Consulting.

If you contact us concerning employment whether by letter, email or our contact page you may provide:

  • Your Curriculum Vitae (CV) containing extensive personal data;
  • Any further personal data that you may provide in a covering letter.

If a recruitment agency contacts us concerning employment whether by letter, email or via our contacts page they may provide:

  • Your Curriculum Vitae (CV) containing extensive personal data;
  • Any further personal data that you may have provided in a covering letter.

If you visit our website https://www.beneeconsulting.com we collect information about your computer:

  • IP address (where available);
  • Geographic location (if you allow this when prompted by your browser);
  • Operating system;
  • Browser type;
  • To enable our systems to recognise your device and to provide features to you, we use cookies.

If you receive emails from us and interact with them, we collect:

  • Time you received the email;
  • Time you opened the email;
  • Device you used to open the email;
  • Geographical location when you opened the email;
  • Which parts of the email you interacted with.

If you use social media accounts which are registered using the same email address you have provided to us elsewhere our systems enable us to link your social media accounts to your account and so we process:

  • Links to any social media accounts that you use.

Special Category Person Data

We always seek to minimise the collection and processing of Special Category Personal Data such as health, race or ethnic origin. However, for certain services or activities, and when required by law or with an individual’s consent this may be necessary.

Purpose for the processing and the legal basis for the processing

We process personal data for many different purposes:

Recruitment

The legal basis for processing personal data for the purpose of recruitment is our legitimate interest to develop our business.

When an applicant becomes an employee, their personal data is processed.

Personal data collected from unsuccessful applicants is retained for a maximum of 12 months after which it is securely destroyed.

Business Development

The legal basis for processing personal data for the purpose of business development is our legitimate interest to develop our business by undertaking sales and marketing activities.

The legal basis for sending electronic marketing messages to named individuals is consent. If we send such messages we would retain evidence of the details of consent which has been provided.

We retain personal data collected through our business development processes for as long as we believe our products and services may be of interest to prospective customers. Individuals and organisations can ask to be removed from our business development system at any time.

Provision of services to our customers

The legal basis for processing personal data for the purpose of providing services to our customers depends upon the context, we use one or more of the following legal bases for processing:

  • To perform our contract with our customers;
  • To address our legitimate interests which include maintaining accurate records relating to accounting and finance and monitoring the quality of our services;
  • To satisfy a legal obligation.

In the absence of specific legal, regulatory or contractual requirements, our standard retention period for records and other documentary evidence created in the provision of services is 7 years. The exceptions to the general 7-year retention period are records (except audit files) relating to trusts, estates, wills, pension schemes, taxation and financial services which we retain for periods up to 30 years.

Our standard email retention period is 7 years.

Other records, which are not required to be retained as part of our professional services, are kept for a period of time depending on:

  • The type, amount and categories of Personal Data we have collected;
  • The requirements of our business and the services we provide;
  • The purposes for which we originally collected the Personal Data;
  • The lawful basis upon which we based our processing;
  • Any relevant legal or regulatory obligations;
  • Whether the purpose of the processing could be reasonably fulfilled by other means.

Procurement of services from suppliers

The legal basis for processing personal data for the purpose of procurement is our legitimate interest to maintain efficient and effective procurement processes.

We retain the personal data we collect from our suppliers for seven years after the contract ends unless some different retention period is warranted and documented in our procurement contract.

Data Sharing

As with any provider of professional services, we are subject to legal, regulatory and professional obligations. We process Personal Data as necessary to comply with those obligations. One example of such processing includes anti-money laundering activities such as carrying out searches (such as internet searches and sanctions lists) to identify politically exposed persons and heightened risk individuals and organisations, and to check that there are no issues that would prevent us from working with a particular client (such as sanctions, criminal convictions (including in respect of company directors), conduct or other reputational issues).

We are also obliged to keep certain records to demonstrate that our services are provided in compliance with our legal, regulatory and professional obligations.

Benee Consulting may share data with the following organisations and for the lawful reasons shown.

 

Organisation or category of organisation;

 

 Legal basis for data sharing;

 
Suppliers (references) Legitimate interest to obtain references before appointing a new supplier.
Banks, Mortgage companies/Building Societies, Independent Financial Advisers (IFAs), Other accountants Legal obligation (anti-fraud and anti-money laundering)
Targets and Introducers e.g. for Corporate Finance purposes Legitimate interest
Shareholders, Directors, Owner managers, Investors and other types of lenders Payroll Companies and Intermediaries, Grant Aid bodies, Other accountants Performance of a contract
Lawyers and barristers e.g. Forensics, Divorce, Family, Criminal,L Performance of a contract or legal obligation
Companies House, HMRC, Social Services, Department of Work & Pensions, Child Maintenance Services, Regulators ICAEW, ICAS, ACCA, FRC, The Pensions Regulator, Charities e.g. Give As You Earn, Pension Providers, Police and CPS e.g. criminal cases, Government bodies e.g. research or statistical offices, European bodies where we act for MEPs Legal obligation
Trade Unions Consent

 

Sub-contract Processing

Benee Consulting uses specialist sub-contact organisations to process personal data under a written contract which defines that they must comply with Data Protection legislation. We only employ organisations that comply with Data Protection Legislation.

The following processors or categories of processors are used:

Processor or category of processor;

 

 Sub-contract service provided;
Microsoft Data hosting
Salesforce Data Hosting and email sending
BACS providers Payment processing
Markel Tax Tax Investigation insurance
Specialist accountancy advisors and service providers Advice upon complex accountancy matters and assistance with large volume accountancy matters
Legal advisors Advice upon matters of law
Off-site storage providers Secure storage and destruction of paper documents
Specialist debt collectors Debt collection
Event management companies Facilitating events including catering for dietary requirements

 

Profiling and automated decision-making

Benee Consulting does not perform any profiling based on personal data that has a legal or significant effect. Benee Consulting does not perform any automated decision-making involving personal data.

International Transfers

We neither transfer nor process personal data outside the United Kingdom, nor do we permit personal data to be transferred or processed outside the United Kingdom, unless it is under one or more of the following conditions:

  • the territory into which the data are being transferred is one approved by the UK’s Information Commissioner;
  • the territory into which the data are being transferred is within the European Economic Area;
  • the territory into which the data are being transferred has an adequacy decision issued by the European Commission;
  • the transfer is to the United States of America and the recipient is registered under the EU/US Privacy Shield scheme;
  • the transfer is made under the unaltered terms of the standard contractual clauses issued by the European Commission for such purposes;
  • the transfer is made under the provision of binding corporate rules which have been approved and certified by the European Commission;
  • the transfer is made in accordance with one of the exceptions set out in Data Protection Legislation.

Your Rights

You have the following rights concerning your personal data:

Right of access You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to that personal data.
Right to rectification You have the right to oblige us to rectify inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed by providing a supplementary statement.
Right to erasure (right to be forgotten) You have the right (under certain circumstances, but not all) to oblige us to erase personal data concerning you.
Right to restriction of processing You have the right (under certain circumstances, but not all) to oblige us to restrict processing of your personal data. For example, you may request this if you are contesting the accuracy of personal data held about you.
Right to data portability You have the right (under certain circumstances, but not all) to oblige us to provide you with the personal data about you which you have provided in a structured, commonly used and machine-readable format.

You also have the right to oblige us to transmit those data to another controller.
Right to withdraw consent If the lawful basis for processing is consent, you have the right to withdraw that consent.
Right to object to direct marketing Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of your personal data for marketing, which includes profiling to the extent that it is related to such direct marketing.
Rights in relation to automated decision making and profiling We do not perform any automated decision-making based on personal data that produces legal effects or similarly significantly affects you.

 

Your right to lodge a complaint with a supervisory authority

If you wish to exercise any of your rights concerning your personal data, you should contact our Data Protection Office at the address shown above. If you are not satisfied with the response you receive, you have the right to lodge a complaint with the supervisory authority. In the United Kingdom this is:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

(t) 0303 123 1113

(e) casework@ico.org.uk

 

This Privacy Policy is version 12th January 2020.