DATA PROTECTION PRIVACY NOTICE issued by Tandem Corporate Services Limited
Introduction
The Data Protection Act 2018 (“DPA 2018”) and the General Data Protection Regulation (“GDPR”) impose certain legal obligations in connection with the processing of personal data.
Tandem Corporate Services Limited (hereinafter referred to as “the Company, “us” “we” “our”) is a data controller within the meaning of the GDPR and we process personal data. The firm’s contact details are as follows:
Tandem Corporate Services Limited
Second Floor West
55 Athol Street,
Douglas,
Isle of Man,
IM1 1LA
The Data Protection Officer is Mr Andrew Dawson
The Company offers a wide range of services and we collect and hold personal information that identifies clients, intermediaries, suppliers and other third parties linked to our clients. The types and amount of information we collect differs depending on the relationship with us. We only collect the data we need in order to provide the services you have asked for, or that we need in order to fulfil our legal or regulatory obligations in relation to those services. If we need to collect additional information we will explain why we need it.
You are not obliged to provide any of the information we ask you for, however, it is a requirement of our contract with you that you provide us with the personal data that we request. If you do not provide the information that we request, we may not be able to provide professional services to you. If this is the case, we will not be able to commence acting or will need to cease to act.
When you enquire about our services and when you have appointed the Company to provide services, your personal information may be used for:
- Responding to enquiries, offering services, and agreeing terms of business
- Communicating with you about the services you have asked us to provide and informing you of changes that affect those services
- Providing fiduciary services
- Setting up and administering companies
- Managing property portfolios
- Tax planning and ongoing monitoring, tax registrations, and calculating and submitting tax returns
- VAT registrations and calculation and submission of VAT returns
- Payroll administration
The above list is not exhaustive.
There are times when we are under a legal obligation to collect your personal information, including for:
- Preventing financial crime, evasion of tax, and the funding of terrorism
- Identifying politically or commercially exposed persons, or those with a significant exposure to the media
- FATCA/CRS reporting.
The legal basis for our intended processing of personal data
Our intended processing of personal data has the following legal basis:
- At the time you instructed us to act, you gave consent to our processing your personal data for the purposes listed above.
- The processing is necessary for the performance of our contract with you.
- The processing is necessary for compliance with legal obligations to which we are subject
- The processing is necessary for the purposes of the following legitimate interests which we pursue.
There are occasions where it is in our legitimate interests to collect and process your information, for example:
- CCTV monitoring of our shared office spaces helps to keep our staff and visitors safe and protects your personal information from unauthorised access – such data may be given to law enforcement agencies as evidence if we think an offence has been committed.
- When we are considering adding new businesses to the Company we carry out stringent checks to ensure the business, its staff and its client base fits our culture and ethos. By doing so, we protect our existing business and ensure we are able to continue providing the high quality services you expect from us.
- When you ask us to provide services we need to assess the risks associated with providing that service. This will involve us using information we already hold and information from background checks and credit reference checks to evaluate the risks to you, to us, and to any organisations whose products or services we are providing for you.
- Analysing details of the number of visits to our website and the pages visitors view allows us to update and improve it. This allows us to refine the site and make your visits to our website more interesting and informative.
- To make you aware of additional or new services that we feel could be of benefit to you and will complement the services we already provide.
In some circumstances we cannot process your data without your explicit consent, such as when your physical or mental capacity for decision making needs to be assessed. If we ask you to provide sensitive information we will fully explain your options before we ask you to provide it.
Sharing your information with other organisations
In the usual course of our business, we sometimes use third party organisations to support the essential delivery of our services. Under these circumstances the Company remains responsible for the security and privacy of your information and we regularly review all third parties’ security measures to ensure they meet the same standards you expect from us. All third party organisations operate under contracts that restrict their use of your personal information to providing the services we have employed them for.
The services they provide include:
- providing and supporting the IT systems in which your information is stored
- transportation and storage of information and confidential destruction
- preparation of company accounts and financial statements
- translation of documents
The above list is not exhaustive.
We may also have an obligation to share some of your personal information with public authorities, such as:
- Tax and VAT authorities
- Regulatory authorities
- Law enforcement agencies
- Courts and tribunals
- The Information Commissioner’s Office.
The above list is not exhaustive.
In some cases, your personal information will be shared with organisations outside the Company in order to obtain specialist or professional services that are necessary for the services we provide.
These include:
- Your professional advisers, such as accountants, lawyers, agents, architects
- Banks or other financial institutions
- Credit reference agencies who assist us in meeting our customer due diligence obligations
- professional indemnity insurers
The above list is not exhaustive.
These external organisations have a legal obligation to comply with privacy and data protection legislation and may also operate under a professional duty of confidentiality due to the type of service they provide. They have their own privacy policies that provide information about how they use your information. You can find out more about the organisations your data has been shared with by contacting the Data Protection Officer.
Transferring your information to other countries
In the unlikely event that we share your information with organisations that are located in different jurisdictions, we ensure they apply equivalent levels of protection.
Countries in the European Economic Area and those that are recognised as providing adequate protection by the European Commission are considered to be secure. Personal information can flow freely between those countries because they provide equivalent levels of protection and their laws give you the same rights and protections in relation to your personal data.
For other international transfers we put data sharing contracts in place to ensure you retain the same rights and protections in the recipient country as you have in the country where your information was originally collected. This ensures that such transfers are legal and gives you, and the Company, the reassurance of knowing that your privacy rights remain the same wherever your information is being processed.
If you would like more information please contact the Data Protection Officer.
Using your contact details
From time to time, we will send you important notices about the products or services you have asked us to provide, changes to our policies or terms and conditions, or changes to laws or regulations that could affect the service we provide. This is important information that keeps you informed about the products or services you have asked us to provide.
We may also send you emails containing newsletters and articles, information about additional products or services provided by the Company or invitations to events we are organising, attending or sponsoring.
You can opt-out of receiving these messages by contacting the Data Protection Officer or by clicking on the unsubscribe link in those emails.
We never sell or lease your personal information or share it with other organisations outside the Company for marketing purposes.
Storing and deleting your information
The amount of time we keep your personal information will vary depending on your relationship with the Company. In some circumstances, there is a legal or regulatory requirement to keep information for a specific amount of time, although this will be extended if there is ongoing legal action that overrides the normal retention period. Where there is no regulatory or legal requirement, we assess how long we reasonably need to keep your information in order to deal with ongoing queries.
When our relationship with you ends, there will be information we cannot delete immediately. Such information will be stored in our physical and/or electronic archives until we no longer have an obligation to keep them. At that point the information will be permanently deleted.
Keeping your information secure
We take the security of personal information and confidential documents extremely seriously. The Company complies with data protection legislation and we have put in place appropriate safeguards to prevent unauthorised access or unlawful use of confidential information.
We restrict access to personal information to Company employees, contractors and agents who need to know that information in order to process it for us. They are subject to strict contractual confidentiality obligations and they may be disciplined or their contract terminated if they fail to meet these obligations.
Our Information Security Management is undertaken by a trusted third party, and we employ a wide variety of technical and organisational security measures to safeguard the confidentiality, integrity and availability of your information.
Your rights
Subject to some exceptions, you have the right to:
- Know whether the Company is processing your personal information
- Request a copy of the personal information the Company holds about you (see below – subject access requests)
- Have any inaccuracies corrected or and have incomplete personal data completed (see below – right to rectification)
- Have your personal data erased if it is no longer needed (see below – right to erasure)
- Ask the Company to restrict the processing of your data (see below – right to restrict processing
- Object to the Company processing your data (see below – withdrawal of consent)
- Ask for your data to be transferred to a new service provider
- Object to processing that is carried out in the Company’s legitimate interests
- Make a complaint to a data protection supervisory authority or regulator.
Requesting personal data we hold about you (subject access requests)
You have a right to request access to your personal data that we hold. Such requests are known as ‘subject access requests’ (“SARs”). Please provide all SARs in writing marked for the attention of the Data Protection Officer.
To help us provide the information you want and deal with your request more quickly, you should include enough details to enable us to verify your identity and locate the relevant information. For example, you should provide us with:
- Your full name (s)
- Your date of birth
- Any previous or other name(s) you have used
- Your previous addresses in the past five years
- Any reference number(s) that we may have given you
- What type of information you want to know
The DPA 2018 requires that we comply with a SAR promptly and in any event within one month of receipt. There are, however, some circumstances in which the law allows us to refuse to provide access to personal data in response to a SAR (e.g. if you have previously made a similar request and there has been little or no change to the data since we complied with the original request).
We will not charge you for dealing with a SAR.
You can ask someone else to request information on your behalf – for example, a friend, relative or solicitor. We must have your authority to respond to a SAR made on your behalf. You can provide such authority by signing a letter which states that you authorise the person concerned to write to us for information about you, and/or receive our reply.
Where you are a data controller and we act for you as a data processor (e.g. by processing payroll), we will assist you with SARs on the same basis as is set out above.
Putting things right (the right to rectification)
You have a right to obtain the rectification of any inaccurate personal data concerning you that we hold. You also have a right to have any incomplete personal data that we hold about you completed. Should you become aware that any personal data that we hold about you is inaccurate and/or incomplete, please inform us immediately so we can correct and/or complete it.
Deleting your records (the right to erasure)
In certain circumstances you have a right to have the personal data that we hold about you erased. Further information is available on the ICO website in the IOM (https://www.inforights.im). If you would like your personal data to be erased, please inform us immediately and we will consider your request. In certain circumstances we have the right to refuse to comply with a request for erasure. If applicable, we will supply you with the reasons for refusing your request.
The right to restrict processing and the right to object
In certain circumstances you have the right to ‘block’ or suppress the processing of personal data or to object to the processing of that information. Further information is available on the ICO website in IOM (https://www.inforights.im). Please inform us immediately if you want us to cease to process your information or you object to processing so that we can consider what action, if any, is appropriate.
Obtaining and reusing personal data (the right to data portability)
In certain circumstances you have the right to be provided with the personal data that we hold about you in a machine-readable format, e.g. so that the data can easily be provided to a new professional adviser. Further information is available on the ICO website in the IOM (https://www.inforights.im).
The right to data portability only applies:
- To personal data an individual has provided to a controller;
- Where the processing is based on the individual’s consent or for the performance of a contract;
- and
- When processing is carried out by automated means
We will respond to any data portability requests made to us without undue delay and within one month. We may extend the period by a further two months where the request is complex or a number of requests are received but we will inform you within one month of the receipt of the request and explain why the extension is necessary.
Withdrawal of consent
Where you have consented to our processing of your personal data, you have the right to withdraw that consent at any time. Please inform us immediately if you wish to withdraw your consent.
Please note:
- The withdrawal of consent does not affect the lawfulness of earlier processing
- If you withdraw your consent, we may not be able to continue to provide services to you
- Even if you withdraw your consent, it may remain lawful for us to process your data on another legal basis (e.g. because we have a legal obligation to continue to process your data)
You can find out more about your rights by contacting the Data Protection Officer. If you would like to exercise any of your rights please contact the Data Protection Officer.
Social Media
The Company uses a number of social media sites including LinkedIn, Facebook, Twitter and Instagram. We receive some information about you from these sites when you interact with us or access our social media content. The amount of information we receive is governed by your social media account privacy settings and the policies and procedures of each social media platform.
Links to external sites
The Company website contains links to other websites which are not controlled by us. We are not responsible for the privacy of those sites, and we encourage you to review the privacy policies of each one when you visit external sites so that you understand how those other organisations are using your personal information.
Cookies
A cookie is a file which is sent to your computer or other access device when you visit a website. The Company website uses cookies to analyse user activities which helps us to develop it and initiate improvements aimed at making your visits simpler and more relevant. The cookies we use do not collect personal information and they are not used to identify individuals.
For full details of the cookies used by the Company, please see our Cookies Policy
Queries and complaints
This privacy policy aims to give you an overview of the ways in which we process your personal information. If you would like more detail or have any queries, please contact us so that we can assist you. We take any complaints we receive about the way we process your information very seriously and we would like to hear from you if you have any concerns.
You also have the right to make a complaint to:
Isle of Man Information Commissioner.
P.O. Box 69
Douglas
Isle of Man
IM99 1EQ
Telephone: +44 1624 693260
Email: ask@inforights.im
https://www.inforights.im/