This notice explains how Officium Business Services Ltd uses personal data in providing our services to you. It forms part of your engagement letter and terms of business. If you visit our website, our Website Privacy Policy also applies.
1. Who we are
Officium Business Services Ltd, Top Floor, 108 Bradshawgate, Leigh, Greater Manchester, WN7 4NP. Company number 17464098. Registered with the Information Commissioner’s Office under number ZC251471.
Data Protection Officer: Dean Ainslie, Director — dean@officiumbusinessservices.co.uk, 01942 644864.
2. Our role
- We are the controller of personal data we use to run our relationship with you and to meet our own legal duties — for example your contact details, our engagement and billing records, anti-money laundering checks, and work we do as your agent with HMRC.
- We are your processor where we process personal data on your behalf and on your instructions — in particular your employees’ data when we run your payroll and auto-enrolment, and data in your bookkeeping records. You are the controller of that data and are responsible for having a lawful basis to share it with us and for telling your employees how it is used. We process it only to provide the services you have engaged us for, keep it confidential and secure, use only approved sub-processors, help you respond to data protection requests, and return or delete it when our engagement ends (subject to our legal retention duties).
- Where we work as a subcontractor for another firm, that firm is the controller of its clients’ data and its own privacy notice applies. We act as its processor on its instructions.
3. Whose data we use
- You, and where you are a business, your directors, partners, owners, beneficial owners and contacts.
- Your employees, workers and pensioners, where we provide payroll, auto-enrolment or HR services.
- Other people named in your records or tax affairs, such as family members, tenants, customers and suppliers, where relevant to the work.
4. What data we use
- Identity and contact details: name, address, date of birth, email, telephone, identity documents.
- Tax and financial information: National Insurance and tax references, income, bank details, transactions, accounts and tax records.
- Payroll data: pay, hours, tax codes, pension details, student loans, starter and leaver information.
- Special category data where needed for payroll — for example sickness absence for Statutory Sick Pay, pregnancy and family leave for statutory pay, and trade union subscriptions where deducted from pay. We use this only to calculate and administer pay and statutory payments.
- Anti-money laundering information: identity verification, politically exposed person and sanctions screening results, source of funds where required.
5. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the services in our engagement letter | Contract |
| Customer due diligence, ongoing monitoring and reporting under the Money Laundering Regulations 2017 and the Proceeds of Crime Act 2002 | Legal obligation |
| Meeting tax, payroll, pensions and company law requirements, including submissions to HMRC, pension providers and Companies House | Legal obligation |
| Billing, credit control and recovering unpaid fees | Contract and legitimate interests |
| Keeping records to deal with queries, complaints and claims, and to meet our professional and insurance obligations | Legitimate interests and legal obligation |
| Special category payroll data | Employment and social security law (UK GDPR Article 9(2)(b)) |
We do not use your data for marketing and we do not sell it.
6. Identity checks
To meet our anti-money laundering duties we verify identities electronically and screen against politically exposed person, sanctions and adverse media lists. These checks are reviewed by a member of staff; no decision about you is made solely by automated means.
7. Who we share it with
We share personal data only where necessary, with these categories of recipient:
- HMRC, Companies House, pension providers and the Pensions Regulator, to carry out the services and meet legal requirements.
- Service providers who process data on our behalf, such as our payroll, accounting and practice management software, identity verification, secure file sharing, email and cloud storage providers.
- Our anti-money laundering supervisor, the National Crime Agency, regulators, the police and courts, where the law requires or permits it.
- Our professional indemnity insurers and professional advisers.
- Debt recovery agencies, solicitors and the courts, if we need to recover unpaid fees.
- A business that acquires or takes over our business, if that happens, subject to confidentiality.
- Anyone else you ask us to share information with, including tax authorities outside the UK where we act for you in relation to another country.
Service providers act only on our instructions under written contracts that require them to keep data secure.
8. International transfers
Some of our service providers, and some of the clients and firms we work with, are based outside the United Kingdom. Where personal data is transferred outside the UK, we make sure it is protected by one of the safeguards UK law allows, such as:
- a UK adequacy decision — for example for the European Economic Area, or the UK–US data bridge for organisations certified under it;
- the UK International Data Transfer Agreement; or
- the UK Addendum to the EU Standard Contractual Clauses.
Where we act as processor for a client outside the UK, we follow that client’s instructions and the data processing terms in our engagement, and give the client the information it needs to meet the data protection law that applies to it.
You can ask us for details of the safeguards used for any transfer, using the contact details in section 1.
9. How long we keep it
- Client files, tax, accounts and payroll records: 7 years from the end of the tax year to which they relate.
- Anti-money laundering records: 5 years from the end of our business relationship with you, as required by the Money Laundering Regulations 2017.
- Records relating to a claim or dispute: until the matter is concluded and any limitation period has passed.
We then securely delete or destroy the data.
10. Keeping it secure
We use encryption, multi-factor authentication, strict access controls, secure file exchange rather than ordinary email for documents, and regular staff training. Only staff who need access to your data have it, and all staff are screened and bound by confidentiality.
11. Your rights
You have the right to access your personal data, to have it corrected, to have it erased or its use restricted in certain circumstances, to object to processing based on legitimate interests, and to data portability. Some rights are limited by our legal duties — for example we cannot delete records we are required to keep, or tell you about a report we have made under anti-money laundering law.
Where we act as your processor, requests from your employees about their payroll data should go to you as their employer; we will help you respond.
To exercise your rights, contact our Data Protection Officer using the details in section 1. We will respond within one month.
12. Complaints
Please contact us first so we can try to put things right — see how to make a complaint. You can also complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. If you live or are based outside the UK, you may also be able to complain to the data protection authority in your own country.
13. Changes
We may update this notice from time to time. The current version is always available on our website.