Privacy Policy

We ask that you read this privacy notice carefully as it contains important information on who we are, how and why we collect, store, use and share personal information, your rights in relation to your personal information and on how to contact us and supervisory authorities in the event you have a complaint.

Who we are

Dafferns LLP collects, uses and is responsible for certain personal information about you. When we do so we are regulated under the General Data Protection Regulation which applies across the European Union (including in the United Kingdom) and we are responsible as ‘controller’ of that personal information for the purposes of those laws.

The personal information we collect and use

Information collected by us

In the course of our business activities as the providers of professional business support services, we collect the following personal information when it is provided to us:

Clients: Contact details (individual name, business address, telephone number and/or email address, date of birth), financial details, information pertaining to clients’ personal circumstances, and data to prove clients’ identity, as provided to us by our clients;
Suppliers: Contact details of suppliers who provide/have provided goods or services to us as individuals or on behalf of their employer’s business (“the Supply Contract”);
Contacts: Contact details of individuals who are or have been connected with us and have given personal information to enable us to stay in contact with them.

Information collected from other sources

Except for information on public record (e.g. Companies House, client’s website), we do not obtain personal information from sources other than the individuals mentioned above.

How we use your personal information

If you are a client and you have given us personal information we only use that data to enable us to provide our services to you;
If you are a supplier and you have given us personal information we only use that data to enable us to contact you about the Supply Contract;
If you are a contact (including former clients) we only use the personal information you have given to us to contact you about our services and other information about our organisation that we believe will be relevant and of interest to you.

Who we share your personal information with

We do not routinely share personal information. On Clients’ instructions we may need to share personal information where the services we provide involve an identified third party supplier in which case we will take reasonable steps to ensure that any information shared will be limited to what is necessary for the specific purpose and will only be processed in accordance with GDPR principles.
We will share personal information with law enforcement or other authorities if required by applicable law.
We will not share personal information with any other third party.

How long your personal information will be kept

If you are a client we will hold your personal information for so long as you continue to be a client of Dafferns LLP;
If you are a supplier we will hold your name and address (inc email and telephone) for up to 7 years after the Supply Contract is completed and beyond that we will only keep that information for so long as we reasonably think we might need to contact you about further, similar goods and services that you might be able to supply to us;
If you are a contact (including former clients) we will hold your contact details only for so long as we reasonably consider that the information we might provide to you is relevant to and of interest to you and we will delete your contact details if you ask us not to continue to send such information to you or at any time if we have reason to think that the information is out of date. We will generally keep your personal data for a period of 7 years after you last contacted us.

Reasons we can collect and use your personal information

If you are a client we rely on the fact that it is necessary for us to have and to use that information for the performance of our contract with you as the lawful basis on which we collect and use your personal data.
If you are a supplier we also rely on our legitimate interests as the lawful basis on which we collect and use your personal data (in addition to contractual necessity). Our legitimate interests in this regard are two-fold. Firstly, we might need to contact you about the Supply Contact. Secondly, we might need to contact you about further similar goods & services.
If you are a contact (including former clients) we rely on our legitimate interests as the lawful basis on which we collect and use your personal data. Our legitimate interests are to keep you informed of our events, services and other information about our organisation we reasonably consider might be of interest to you. This will be limited to information sent to you by email to your business email address and with every communication you will be given a clear and straightforward option to opt out of further communications and to ask us to delete the personal information that we hold about you. We have considered the risk of harm to your privacy rights and to your data security and have concluded that the risk is minimal given (i) the type of data (your contact details) that we process for this purpose, (ii) the method, volume and content of the communications that we might send to you (which will be neither excessive nor likely to cause offence) and (iii) your right to opt out of further communications and to ask us to delete your information from our records at any time.

Any unrequested contact by electronic communication to a personal (not business) account will respect your personal e-privacy rights by being restricted to the use of e-contact details that you provided to us in connection with the supply by us to you of services that you paid us for or enquired about previously and limited to the same or similar services.

Consequences of our use of your personal information

We do not believe that there are likely to be any serious consequences to you of our use of your personal information. The potential consequences that we have identified are:

The risk of the personal information that we hold about you being accidentally lost, or used or accessed in an unauthorised way. We have taken steps to protect against this (please see further information under the heading “Keeping your personal information secure” below).
You may, from time to time, receive unsolicited communications from us. However, we do not believe that the frequency, content or manner of these communications will risk any breach of your privacy rights.

Transfer of your information out of the EEA

Generally we do not intend to transfer your information out of the EEA. However, on occasion we may use MailChimp as a means to contact you about important information. This will involve some of your personal data (name and email address) being transferred outside the EEA to the United States. MailChimp certifies to the Privacy Shield framework.

Your rights

Under the General Data Protection Regulation you have a number of important rights free of charge. In summary, those include rights to:

fair processing of information and transparency over how we use your use personal information
access to your personal information and to certain other supplementary information that this Privacy Notice is already designed to address
require us to correct any mistakes in your information which we hold
require the erasure of personal information concerning you in certain situations
receive the personal information concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations
object at any time to processing of personal information concerning you for direct marketing
object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you
object in certain other situations to our continued processing of your personal information
otherwise restrict our processing of your personal information in certain circumstances
claim compensation for damages caused by our breach of any data protection laws

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

If you would like to exercise any of those rights, please:

email, call or write to us (contact details below),
let us have enough information to identify you,
let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill), and
let us know the information to which your request relates

Keeping your personal information secure

We have appropriate security measures in place to prevent personal information from being accidentally lost, or used or accessed in an unauthorised way. We limit access to your personal information to those who have a genuine business need to know it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

How to complain

We hope that we can resolve any query or concern you raise about our use of your information.

The General Data Protection Regulation also gives you right to lodge a complaint with a supervisory authority, in particular in the European Union (or European Economic Area) state where you work, normally live or where any alleged infringement of data protection laws occurred. The supervisory authority in the UK is the Information Commissioner who may be contacted at https://ico.org.uk/concerns/ or telephone: [0303 123 1113].

Changes to this privacy notice

This privacy notice was published in May 2018 (V1).

We may change this privacy notice from time to time, when we do we will inform you via our website.

How to contact us

Please contact us if you have any questions about this privacy notice or the information we hold about you.

If you wish to contact us please write to:

Compliance
Dafferns LLP
One Eastwood,
Binley Business Park,
Coventry
CV3 2UB.