Under the General Data Protection Regulations (GDPR), we are required to update the data protection references in our engagement letters with clients and, in the case of individual clients, provide certain details regarding the Firm and collection and use of your personal data. This is set out in more detail below.

Carpenter Keen LLP is a limited liability partnership registered in England and Wales.

The registered office of Carpenter Keen LLP is 1 Church Terrace, Richmond, Surrey TW10 6SE. Our Data Protection Officer/Head of Privacy can be contacted at dataprotection@ckllp.co.uk.

What are your rights?

If at any point you believe the information we process on you is incorrect you can request to see this information and even have it corrected or deleted. If you wish to raise a complaint on how we have handled your personal data, you can contact our Head of Privacy who will investigate the matter.

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).

Unless otherwise agreed with you, we will only collect basic personal data about you, which does not include any ‘sensitive personal data’. This information does, however, include details such as your name, work address, email address and job title.

A full list of your rights under GDPR is as follows:

1.       The right to access the personal data we hold on you

2.       The right to correct and update the personal data we hold on you

3.       The right to have your personal data erased

4.       The right to object to processing of your personal data

5.       The right to data portability

6.       The right to withdraw your consent to the processing at any time for any processing of personal data to which consent was sought.

7.       The right to object to the processing of personal data where applicable

8.       The right to lodge a complaint with the Information Commissioners Office. You can contact the Information Commissioners Office via email, on 0303 123 1113,  or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Data Collection

We need to know basic personal data in order to provide you with our services, and to claim our right to be paid in return for our services, under our standard terms of business / contract we have with you. If you do not provide this information then we will be unable to provide the services you have requested. We will not collect any personal data from you that we do not need in order to provide and oversee the services we have agreed to provide you with.

Use of Data

All the personal data we hold about you will be processed by our staff in the United Kingdom and no third parties will have access to your personal data unless there is a legal obligation for us to provide them with this. We have set out below the legal bases for the Firm to process your data.

Some of our processing is necessary for compliance with a legal obligation. For example the Firm is a regulated entity and therefore has a duty to act as a data controller and is obliged to report certain matters to its regulators or law enforcement agencies.

We may also process data if it is necessary for the performance of a contract with you, or to take steps to enter into a contract. An example of this would be processing your data in connection with providing you with services.

We may also communicate with you information about other services we can offer you and update you about our activities.

Where your information is used other than in accordance with one of these uses, we will first obtain your consent to that use.

We take all reasonable steps to ensure that your personal data is processed securely.

How long we keep it

We will generally keep your personal data for a minimum of 6 years, after which time it will be destroyed if it is no longer required for the lawful purpose(s) for which it was obtained. If you consent to marketing, any information we use for this purpose will be kept with us until you notify us that you no longer wish to receive this information.

Sharing your personal data

Your personal data will only be shared with third parties including other data controllers where it is necessary for the performance of the data controllers’ tasks or where you first give us your prior consent. It is possible that we will need to share your data with our agents, suppliers and contractors. For example, we may ask a supplier to maintain our database software, or to provide us with administration, IT and other related services.

Any personal data transferred to countries or territories outside the European Union will only be placed on systems complying with measures giving equivalent protection of personal rights either through international agreements or contracts approved by the European Union.