Client privacy notice

This Privacy Notice explains how Tenth Street Advisory Ltd (the “Firm”, “we” or “us”) collects, uses, discloses, retains and protects the personal and business data of clients, prospective clients and other individuals connected with client engagements, in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and applicable guidance issued by the Information Commissioner’s Office (the “ICO”).

Data controller

Tenth Street Advisory Ltd (company number 12692043)

Registered office

60 Tottenham Court Road, Office 2022, Fitzrovia, London W1T 2EW

Data Compliance Officer

Faizan Mehmood, Director

Contact details

contact@tenthstreetadvisory.com

In the course of providing accountancy, taxation, payroll, advisory and related professional services, we may collect and process the following categories of personal data relating to clients and to their officers, employees, family members and other connected individuals:

Identity data

Full name, date of birth, National Insurance number, photographic identification and proof of address, obtained for client due diligence purposes. Our standard identity checks do not use biometric data. Only where a particular check requires it may our identity verification provider compare your face with the photograph in your identity document, which involves biometric data. We will do so only with your explicit consent and, if you do not wish to give it, we will offer you an alternative means of verification.

Contact data

Postal address, email address, telephone numbers and, where you contact us that way, your WhatsApp name and number.

Financial and other data

Income, expenditure, assets, liabilities, bank account details, tax reference numbers (UTR, PAYE reference, VAT registration number) and financial statements.

Employment and payroll data

Salary, pension, benefits in kind, statutory payments and HMRC submission data processed on a client’s behalf.

Engagement data

Correspondence, meeting notes, advice given and records generated in the course of an engagement.

Special category data

Health data required for statutory sick pay or benefits administration, trade union membership data contained in payroll records, and information revealing the political opinions of politically exposed persons identified through client due diligence. This data is processed only where strictly necessary, and only where a lawful basis and a condition under Article 9 of the UK GDPR have been identified.

Criminal offence data

Information relating to criminal convictions and offences obtained through sanctions and adverse media screening carried out for client due diligence purposes under MLR 2017, processed in accordance with Article 10 of the UK GDPR and Schedule 1 to the Data Protection Act 2018.

Technical data

Login and access data, where our services are delivered through client portals or cloud accounting software, and the technical data described in section 8 when you visit our website.

• —Directly from you or your representatives, including through our website’s contact and booking pages, engagement documentation, meetings, telephone calls, WhatsApp messages, email and client portals.
• —From third parties acting on your instructions or by operation of law, including HMRC, Companies House, The Pensions Regulator, banks and financial institutions, previous accountants or advisers, and public registers.
• —From identity verification and anti-money laundering screening providers engaged for client due diligence purposes under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (“MLR 2017”).

We process personal data only where a lawful basis under Article 6 of the UK GDPR (and, where applicable, a condition under Article 9) applies, as set out below.

Provision of personal data. Where we request personal data in order to comply with a legal obligation, including client due diligence under MLR 2017, or to perform our engagement with you, you are required to provide it. If you do not provide it, we may be unable to act, or to continue to act, for you.

Automated decisions and artificial intelligence. We do not make decisions about you based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you. Where we use artificial intelligence tools in delivering our services, we use only tools approved by the Firm and provided under written data processing agreements that do not permit the provider to use your personal data to train its models. Any output is reviewed by the Firm before it is relied upon.

We disclose personal data only where necessary, and only to the following categories of recipient:

• —HMRC, Companies House, The Pensions Regulator and other regulatory or statutory bodies, as required by law or on your instructions.
• —Banks, mortgage providers, lenders or other third parties, where you have authorised us to correspond on your behalf.
• —Our professional indemnity insurers and our anti-money laundering supervisor (HM Revenue & Customs), for supervision, monitoring and complaints-handling purposes.
• —IT, website hosting, online booking, cloud accounting, practice management, document storage and artificial intelligence tool providers, acting as our data processors under written data processing agreements.
• —Other professional advisers, including solicitors and independent financial advisers, where you have instructed us to work jointly with them.
• —A successor practice, in the event of a merger, acquisition or sale of some or all of the Firm’s business.
• —Law enforcement or other authorities, where required or permitted by law.

We do not sell personal data to third parties. Every recipient is required to handle personal data in accordance with data protection law.

You can contact us on WhatsApp, through our WhatsApp Business account or the WhatsApp button on our website. The button is only a link: our website does not load any WhatsApp software or set any cookies, and nothing is shared with WhatsApp until you choose to start a chat.

When you message us on WhatsApp, we receive your name and profile picture as shown on WhatsApp, your telephone number, and the content of your messages and any files you send. We use this information to reply to your enquiry and, if you become a client, to provide our services. Our lawful basis is our legitimate interests in responding to enquiries or, where you are a client or have asked us to take steps before engaging us, the performance of a contract.

WhatsApp is operated by WhatsApp, a Meta company, which handles your data in line with its own terms and privacy policy. Messages are end-to-end encrypted, but WhatsApp may process related data outside the United Kingdom.

We keep WhatsApp conversations only for as long as we need them to deal with your enquiry. Where a conversation forms part of a client engagement, we keep a record of it on your client file and retain it as described in section 10.

Please do not send identity documents, bank details or other sensitive information by WhatsApp. We will give you a secure way to share them. If you would prefer us not to contact you by WhatsApp, tell us and we will use email or telephone instead.

Hosting. Our website is hosted by Cloudflare, Inc., which delivers the pages to your browser and protects the site against attacks. To do so, Cloudflare processes technical data such as your IP address, your browser and device, and the pages requested, as our data processor. Our lawful basis is our legitimate interests in running a secure and reliable website.

Visitor statistics. We use Cloudflare Web Analytics to count visits and see which pages are read, so that we can improve the site. It does not use cookies or store anything on your device, does not follow you across other websites, and gives us only totals, such as the number of visits to a page and the countries and devices visitors use. It does not tell us who you are. Our lawful basis is our legitimate interests in understanding how our website is used.

Booking a call. When you book a call, the details you enter on our contact page (your name, email address and, if you give them, your telephone number, business name and message) are passed to Calendly, LLC, which provides our booking calendar and sends the meeting invitation. Calendly’s calendar loads only when you reach the booking step, and Calendly sets its own cookies there, as described in its cookie notice. After you book, your browser keeps a note of the time of the booking so that the page can confirm it; this note stays on your device and is not sent to us. Our lawful basis is taking steps at your request before you engage us.

Cookies. Our website sets no cookies of its own and uses no advertising or tracking technologies, so we do not ask for cookie consent. If this changes, we will ask for your consent first and update this notice.

Where any of our service providers store or process personal data outside the United Kingdom, we ensure that an adequate level of protection is in place, either because the destination country is covered by UK adequacy regulations or through the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with supplementary technical and organisational measures where required. Details of specific transfers are available on request.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting or reporting requirements. Retention periods are determined in accordance with the Firm’s Data Retention Policy, which reflects HMRC record-keeping requirements, Companies Act 2006 requirements and the five-year minimum retention period for client due diligence records under MLR 2017. A summary of key retention periods is available on request.

Subject to applicable exemptions, you have the following rights in relation to your personal data:

• —The right to be informed about how your data is used.
• —The right of access to a copy of your personal data (a “subject access request”).
• —The right to rectification of inaccurate or incomplete data.
• —The right to erasure of your data in certain circumstances.
• —The right to restrict processing, and to object to processing (including the right to object to direct marketing at any time).
• —The right to data portability, where processing is based on consent or contract and carried out by automated means.
• —The right to withdraw consent at any time, where consent is the lawful basis relied upon.
• —The right to lodge a complaint with the Information Commissioner’s Office.

Requests to exercise any of the above rights should be sent to our Data Compliance Officer at contact@tenthstreetadvisory.com. We will respond within one calendar month of receipt, in accordance with the Firm’s Data Subject Access Request procedure. This period may be extended by a further two months for complex requests, in which case we will tell you.

If you are unhappy with how we have handled your personal data or your request, you may make a complaint to us. We will acknowledge complaints within 30 days and provide a substantive response without undue delay. You also have the right to complain directly to the ICO at ico.org.uk.

We maintain appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage, as set out in the Firm’s Data Protection & Information Security Policy.

We may update this notice from time to time to reflect changes in law, regulatory guidance or our practices. The current version is available on request and, where appropriate, on the Firm’s website. We will bring any material changes to your attention.