Westcotts Business Recovery LLP’s Privacy Notice
Clients Data Controller
The data controller is:
Westcotts Business Recovery LLP 26-28 Southernhay East
Exeter EX1 1NS
Any reference to ‘Westcotts Business Recovery LLP’ or the ‘Firm’ as Data Controller within this privacy notice also refers to the wider firm which includes ‘Westcotts Chartered Accountants’, ‘Westcotts Business Recovery LLP’, ‘Westcotts Financial Management Limited’ trading as ‘Westcotts Chartered Financial Planners’ and ‘Westcotts Secretarial Limited’.
Data Protection Officer
To enquire about any aspect of this document or your associated data protection rights please contact Westcotts’ Data Protection Officer:
Mr P Tigwell
26-28 Southernhay East Exeter
Devon EX1 1NS
Email: patrick.tigwell@westcotts.uk
All initial contact should be in writing (by post or email).
General
Westcotts collects and processes personal data relating to its Clients to manage the client relationship. We are committed to being transparent about how we collect and use that data and to meet our data protection obligations.
Lawful reason for processing client personal data
Westcotts Business Recovery LLP may act as either the data Controller or Processor in accordance with GDPR.
Where an insolvency practitioner of Westcotts Business Recovery LLP is not appointed as office holder, Westcotts Business Recovery LLP acts as the data processor. The data controller is either the company/individual on whose instructions Westcotts Business Recovery LLP is acting or it is Westcotts Business Recovery LLP.
Where an insolvency practitioner of Westcotts Business Recovery LLP is appointed as office holder and the data processing is carried out as part of their statutory duties, the office holder(s)
is/are the data controllers. The data controller(s) can be contacted at the contact details above.
Categories of personal data collected by Westcotts Business Recovery LLP
We collect and process a range of information about you. This includes contact details, financial information and location.
The information held will depend upon the type of engagement. Some special categories of personal data are processed to carry out the terms of our contract.
The organisation may collect this information in a variety of ways. Most data will be supplied by the data subject (or the data controller in respect of engagements where the firm acts as data processor), representatives of the data subject or authorised third parties.
Intended recipients of the personal data
Personal data held by us may be transferred to:
Third party organisations that provide applications/functionality, data processing or IT services to us
We use third parties to support us in providing our services and to help provide, run and manage our internal IT systems. For example, providers of information technology, cloud based software as a service providers, identity management, website hosting and management, data analysis, data back-up, security and storage services. The servers powering and facilitating that cloud infrastructure are located in secure data centres in the United Kingdom, and personal data may be stored in any one of them.
Other professional advisers
We sometimes use other professional advisors such as solicitors or employment specialists who use certain data to assist in the sale/transfer of assets or to process employee claims to enable payment form the Redundancy Payments Office. We use these professional advisors to fulfil our role as an Insolvency Practitioner.
Law enforcement or other government and regulatory agencies or to other third parties as required by, and in accordance with, applicable law or regulation
Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, to establish, exercise or defend legal rights. We will only fulfil requests for personal data where we are permitted to do so in accordance with applicable law or regulation.
Legitimate interest of the controller
Most processing is carried out to comply with our legal obligations under statute and other regulatory obligations related to the insolvency process. We also believe our processing if for the legitimate interests of all stakeholders in the insolvency process, as they are entitled to be kept informed and may wish to engage in the insolvency process. Where Westcotts Business Recovery LLP has engaged with a client to perform a service, we will be required to process data to provide the service in accordance with the contractual terms.
The purpose for which personal information is processed may include any or all of the following:
• deliver services and meet legal responsibilities
• verify identity where this is required
• communication by post, email or telephone
• understand needs and how they may be met
• maintain records
• process financial transactions
• prevent and detect crime, fraud or corruption
may also need to use data to defend or take legal actions related to the above
What personal information we hold
The categories are: contact details, financial information and location. In rare cases, we may hold some special category date, e.g. trade union membership or information about individuals’ health, which will be necessary to administer the insolvency process in line with our legal obligations.
Retention period
We retain personal data for as long as is necessary to achieve the purpose listed above and for any other permissible related purpose. For example, we retain most records until the time limit for claims arising from the activities has expired or otherwise to comply with statutory or regulatory requirements regarding the retention of such records.
In considering whether documents should be destroyed the DPO will consider, amongst other things, the legal retention period set out by statute and the firm’s professional indemnity insurance provisions.
What if you do not provide personal data?
You are under no statutory or contractual obligation to provide data to the Firm during the engagement period. However, if you do not provide the information, the Firm may not be able to complete the process as set out within the engagement terms.
Use of Data Processors
In performing our engagement we may appoint additional data processors such as accountants or solicitors to undertake certain tasks. Data processors will only be used where GDPR compliance has been verified by the office holder.
Your rights as data subject
Right of access – where Westcotts Business Recovery LLP is processing or has processed your personal data you have rights as an individual to get a copy of the information that we hold about you. This is known as a subject access request.
For these to be managed effectively, subject access requests must be made in accordance with the guidance issued by the Information Commissioner’s Office (www.ico.org.uk/for-the-public/). All requests should be submitted to Westcotts’ Data Protection Officer.
Failure to submit a subject access request in this format may result in the request being rejected.
The right to rectification – you have the right to request rectification of your personal data where errors have been identified.
Any such request must be made verbally or in writing by post or via email to the Firm and a response will be issued within one month of receipt.
Please note that there may be instances where such requests cannot be fully satisfied and in such cases a full explanation will be provided within the response.
The right to erasure – you have the right to request erasure (also known as ‘the right to be forgotten’) of your personal data.
Any such request must be made verbally or in writing by post or via email to the Data Protection Officer and a response will be issued within one month of receipt.
Please note that there may be instances where such requests cannot be fully satisfied and in such cases a full explanation will be provided within the response.
Right to restriction of processing – you have the right to obtain from us a restriction of processing where one of the following applies:
a) The accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data.
b) The processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead.
c) We no longer need the personal data for the purposes of processing, but you require us to retain the data for the establishment, exercise or defence of legal claims.
d) An objection to the processing of personal data has been raised by you, for a period enabling us to consider whether your rights are overridden by our legitimate reasons to retain the data.
Right to data portability – where it is practicable to do so we will provide an active secure self-service system to provide your personal data held by us.
Where it is not practicable to provide an active self-service system, upon receipt of a ‘right of access request’ information held will be made available via a secure self-service system and direct access will be granted to you.
Where possible the data will be provided in a suitable electronic format which complies with the GDPR guidelines on data portability. Where this is not possible this will be explained.
Please note that the right to obtain access to personal data through a remotely accessed secure system should not adversely affect the rights and freedoms of others.
The right to object – you have the right to object to:
• processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
• direct marketing (including profiling); and
• processing for purposes of scientific/historical research and statistics.
Westcotts Business Recovery LLP will adhere to the guidelines set by the Information Commissioner’s Office upon receipt of an objection.
The objection can be made verbally or in writing to the firms marketing department or Data Protection Officer.
All processing will cease upon receipt of a relevant objection. The Data Protection Officer will issue a formal response to the objection within one month of receipt.
Automated decision making and profiling
The firm does not perform any tasks which rely solely on automated decision making or profiling.
Complaints or queries
Westcotts Business Recovery LLP tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
This privacy notice has been drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of Westcotts Business Recovery LLP’s collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address above.
If you want to make a complaint about the way we have processed your personal information, in the first instance please contact the Data Protection Officer. If the Data Protection Officer is unable to satisfactorily deal with your complaint, or you are not satisfied with our response or believe our processing of your personal data is not in accordance with the law you can complain to the Information Commissioner.
Links to other websites
This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.