Accounts Privacy Notice

Introduction

Revell Research Systems Limited (the Company, we, us, our) is providing you with this information in order to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), which require us to tell you what we do with your personal information.

This notice relates to the personal data that is processed in our accounts and time recording systems, which may include data associated with our members, directors, staff, associates, clients and suppliers or those working for or on behalf of them (where applicable).

Who is collecting this personal data?

Revell Research Systems Limited is collecting this data as the Data Controller.

Revell Research Systems Limited is registered with the Information Commissioner in the United Kingdom as a data controller under number Z186392X.

Who are we sharing your personal data with?

We may share personal data processed under this notice, where necessary and proportionate, with the following categories of recipient:-

• The courts and those involved in legal proceedings and non-contentious matters, including solicitors and barristers
• Police and law enforcement agencies
• Our subsidiaries, our ultimate holding company and all its subsidiaries
• HM Revenue and Customs
• Companies House
• Other government agencies
• Financial institutions such as banks or building societies
• Agents acting on our behalf
• Service providers (including associates)
• Our accountants, auditors and other financial advisers
• Other professional advisers

We will not sell or rent your data to third parties. We will not share it with third parties for marketing purposes.

Why are we collecting and what will we do with your personal data?

We are collecting this information to properly record our financial transactions as a business and also to maintain time recording, expense and disbursement records to support the delivery, administration and billing of our services.

Where you are a party to a transaction, we will use this information to record the transaction; to facilitate payments to you; and to fulfil our statutory obligations.

Where you are involved in the transaction in some other way (such as being a named contact), we will record your information as part of the transaction and use it in effecting the transaction.

We have a legal obligation to file our accounts with HM Revenue and Customs each year and they have a right to inspect our accounts. Our accountants routinely work on our financial data and auditors and other financial advisers periodically have access to our accounting records. These records are also sometimes made available to other professional advisers.

We are obliged to make a return to Companies House, which will routinely include the personal data of members and directors of the Company and very rarely details of other individuals. We may report personal data to the police and other law enforcement agencies in instances of suspected fraud or other crime. We may also be legally obligated to share other personal data within our accounting records with other government agencies from time-to-time.

We may process this data for the purpose of the proper administration of our business and in communicating with you as well as maintaining backups.

We may share data with the courts and associated professionals in establishing, exercising or defending our legal rights. We may share data in reporting crime to or when co-operating with the police and law enforcement agencies.

What is the legal basis for processing?

Our lawful bases are Contract, Legal Obligation and Legitimate Interests.

• contract - the Company keeps personal data in performing a contract with an unincorporated entity such as a sole proprietor or individuals in a partnership and may from time-to-time record details of client staff where they are associated with a transaction (eg: as a point of contact).
• legal obligation - the Company is legally obligated to accurately record its transactions.
• legitimate interests - the Company has legitimate interests in maintaining accurate financial records, administering its business, protecting and asserting legal rights, preventing fraud and maintaining backups.

These lawful bases are detailed in Article 6 of the UK General Data Protection Regulation (UK GDPR):-

• processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b)).
• processing is necessary for compliance with a legal obligation to which the controller is subject (Article 6(1)(c)).
• processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (Article 6(1)(f)).

How are we collecting this information?

We collect personal data from data subjects when they are a party to a transaction with us through the contracting process and from the transaction records such as orders, invoices and receipts.

We collect personal information about people involved in these transactions for or on behalf of the other party as the transactions progress usually to expedite their progress (as the named contact) or because they were otherwise involved (eg: in recording time, expenses or disbursements).

What information are we collecting?

The personal data we collect depends on whether you are acting on your own behalf, in an unincorporated partnership or are working for or on behalf of an organisation.

If you are a sole proprietor or a partner in an unincorporated partnership or otherwise acting in a transaction on your own account then we will collect, process, hold and share the following categories of personal data:-

• personal information (such as name, address and other contact details)
• business bank details
• VAT registration details
• details of payments made to or received from you
• time, expense and disbursement records if you are a client

If you work for or on behalf of an organisation (as a member of their personnel) then we may collect, process, hold and share the following categories of personal data if you become a point of contact for that business:-

• your name
• business contact details
• time, expense and disbursement records where you have been involved in the transaction in some way

Who can see your information within the Company?

Access to your personal data is restricted to authorised directors, staff and associates who require it for legitimate business purposes.

How long is your information kept?

We will only keep your information for as long as necessary. The retention period is either dictated by law or our legitimate requirements. Once your information is no longer needed it will be securely and confidentially destroyed.

We typically retain personal data relating to financial transactions with the Company for six years after the financial year in which they occurred based on the Limitation Act 1980.

How secure is your information?

We take appropriate technical and organisational measures to protect your information against unauthorised access, disclosure, alteration and destruction. You can read more about our approach to security at www.rrs.co.uk/security.

Who keeps your information updated?

You are responsible for keeping your personal details up-to-date. Please advise the Company of any changes.

Will your information be used for any automated decision making?

No. We do not undertake solely automated decision making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Our Privacy Statement

You can access the Company's Privacy Statement at www.rrs.co.uk/privacy. This statement provides you with more information about how we address data protection and privacy as well as informing you of your rights.

Other Privacy Notices

You are likely to interact with us in more than one way, so our other privacy notices may apply to you in different scenarios. We are open and transparent about how we use your personal data. You can find all of our Privacy Notices at www.rrs.co.uk/privacy.

Changes to this Notice

Any changes to this privacy notice will take effect when the revised notice is published. If these changes affect how your personal data is processed, the Company will take reasonable steps to make sure you know.

Further Information