01382 221511

Findlays Privacy Notice

Privacy Statement

Who we are

This is the privacy statement of Findlays, a professional firm of Chartered Accountants, regulated by the Institute of Chartered Accountants of Scotland (ICAS). Our office addresses are 11 Dudhope Terrace, Dundee DD3 6TS and Westway Enterprise Centre, Peasiehill Road, Arbroath, DD11 2NJ.

This privacy statement explains how we collect and use personal information about you.

What personal information we collect

We collect personal information to fulfil our role as a professional firm of Chartered Accountants. As there are many different aspects to this role, the information requested and collected will vary from person to person.

The personal information most commonly collected from our clients is as follows:

• Full name.

• Contact details (including home and business addresses, email address, telephone number).

• Date of birth.

• Employment details (including current and previous employers).

• Regulatory information (including applications for licenses and regulatory monitoring).

• Information regarding investigation and disciplinary processes.

• Records of enquiries, meetings and other direct engagement.

• Copies of physical and electronic correspondence.

• Financial information.

• a copy of identification documents (such as a passport or driving licence) and proof of address (such as a bank statement or utility bill), to be used only for complying with our anti-financial crime obligations.

Where we collect personal information from

Like most organisations that handle personal information, there are various ways in which we collect information from the people we deal with:

• Email and written correspondence.

• Telephone discussions.

• Visitors to our website.

• Social media.

• Application forms and other information requests.

• Direct personal contact at our offices and elsewhere.

In nearly all instances, it should be obvious to you that Findlay’s is collecting your personal data.

How we use your personal information

As explained in this notice, there are various ways in which we must process personal data to allow us to fulfil our role as a professional firm of Chartered Accountants

• deliver services and meet legal responsibilities

• verify identity where this is required

• communication by post, email or telephone

• understand needs and how they may be met

• maintain records

• process financial transactions

• prevent and detect crime, fraud or corruption

What is the lawful basis for Findlay’s processing activities?

We will only process personal information where we believe we have a lawful basis to do so. The basis for processing will vary from activity to activity. In some instances, processing may have more than one lawful basis.

The information below summarises the basis on which we process personal information.

Lawful Basis Examples of processing activities

Process is necessary for us to meet our obligations as a professional firm of Chartered Accountants, including:

• The maintenance of our client database, promotion & monitoring of professional standards & delivery of services we provide to various parties.

· General administration for maintaining our client database.

• Corresponding with clients in respect of the delivery of services within the terms of our specific engagement.

• Regulatory activity (e.g. complying with membership of ICAS, and fulfilling our responsibilities with regards applicable legislation).

• Providing clients & other parties with relevant technical/sector updates & other information.

• Processing carried out in the public interest• Regulatory activity (e.g. complying with membership of ICAS, and fulfilling our responsibilities with regards applicable legislation).
• Processing necessary for us to comply with our legal obligations

• Providing information to oversight regulators (Including, ICAS, OSCR, the FCA and ACCA).

• Providing information to statutory bodies (e.g.HMRC).

• Providing information to law enforcement agencies.

• Consent

• Providing clients & other parties with relevant technical/sector updates & other information

• Use of financial & other information relevant to the delivery of professional services provided to our clients

Who we share your personal information with

Some of the processing activities set out above require us to share personal information with third parties. Whenever we share personal data, we take all reasonable steps to ensure it will be handled appropriately and securely by the third party.

The following is a list of the main third parties with whom we share personal information:

• CAS, which assist us in fulfilling our role as a professional firm of Chartered Accountants.

• Oversight regulators and statutory bodies (e.g. HMRC, the FCA, OSCR).

• Software providers which allow us to operate efficient digital processes, including:

· Sage


· Star

· DataTracks

· Caseware

For practical reasons, this is an indicative, but not exhaustive list. Please also note that the list may be updated from time to time.

How long we retain your personal information for

The periods for which we retain personal information depends on the purpose for which the information was obtained but, in general terms, we will retain personal data for so long as required by law, or as may be required for record keeping and legal claims purposes.

Holding personal information outside the EEA

Personal information is mostly processed by our staff at our offices in the UK. To allow us to operate efficient digital processes, we sometimes need to store information in servers located outside the UK, but in the majority of cases this will remain within the European Economic Area (EEA). We will not normally transfer your information outside the UK other than to companies, service providers, agents, subcontractors and regulatory authorities in countries where data protection laws provide the same level of protection as those in the European Economic Area.

Given that we have clients located in several countries around the world, there may sometimes be occasions when we need to transfer information outside the EEA. Where this happens, we will take all reasonable steps to ensure that your personal information is properly protected. The exceptions to this are where you provide specific consent to this or where you or another party to the services we are providing is located outside of these countries. In all cases we will always use the most secure communication methods possible.

IP addresses

We may collect information about the computer or device which is used to access our corporate website. We use this information to improve the user experience, and to help us better understand the ways in which our website is used. This may include information about:

• The computer or device type.

• IP address.

• Operating system.

• Browser type and version.

• Time zone setting and browser plug-in types and versions.

This is statistical data about our users’ browsing actions and patterns. It is collected on an anonymous, aggregated basis, and does not identify individual users.


Our website makes use of cookie files to distinguish you from other users of our site, to provide you with a bespoke user experience tailored to your individual preferences. A cookie file (a small file of letters and numbers) will be placed on your computer or other access device each time you visit our site.

We also use analytical cookie files. These allow us to recognise and count the number of visitors to our site and to see how visitors move around our site when they are using it. This helps us to improve the way our site works, for example, by ensuring that users are finding what they are looking for easily.

If you wish to delete any such cookie files, please refer to the instructions for your file management software to locate the file or directory that stores cookies. Our cookies will contain the domain name findlay-ca.co.uk within the file name.

You may refuse to accept cookie files when visiting our site, by activating the setting on your browser which allows you to refuse the setting of cookies. However, if you choose this setting, you may not get an optimal web site experience and be unable to access certain parts of our site.

Other websites

Our website and emails may contain links to other websites. We are not responsible for the content or practices of these other sites and we recommend that you check their own privacy policies.

Your rights where we are processing your information

The law in the UK gives certain rights to individuals whose information is being processed by a third party. The following is a short summary of these rights:

Access to your information – You have the right to request a copy of the personal information about you that we hold.

Correcting your information – We want to make sure that your personal information is accurate, complete and up to date and you may ask us to correct any personal information about you that you believe does not meet these standards.

Deletion of your information – You have the right to ask us to delete personal information about you where:

• You consider that we no longer require the information for the purposes for which it was obtained.

• We are using that information with your consent and you have withdrawn your consent – see Withdrawing consent to using your information below.

• You have validly objected to our use of your personal information – see Objecting to how we may use your information below.

• Our use of your personal information is contrary to law or our other legal obligations.

Objecting to how we may use your information – You have the right at any time to require us to stop using your personal information for direct marketing purposes. In addition, where we use your personal information to perform tasks carried out in the public interest then, if you ask us to, we will stop using that personal information unless there are overriding legitimate grounds to continue.

Restricting how we may use your information – In some cases, you may ask us to restrict how we use your personal information. This right might apply, for example, where we are checking the accuracy of personal information about you that we hold or assessing the validity of any objection you have made to our use of your information. The right might also apply where this is no longer a basis for using your personal information but you don’t want us to delete the data. Where this right to validly exercised, we may only use the relevant personal information with your consent, for legal claims or where there are other public interest grounds to do so.

Withdrawing consent using your information – Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.

Please contact us in any of the ways set out in the ‘contact information and further advice’ section if you wish to exercise any of these rights

Changes to our privacy statement

We keep this privacy statement under regular review and will place any updates on this website. Paper copies of the privacy statement may also be obtained writing to us at 11 Dudhope Terrace, Dundee, DD3 6TS.

This privacy statement was last updated in May 2018

Contact information and further advice

If you have any questions which are not covered in this notice, we suggest that you email us at dc@findlay-ca.co.uk . If you would prefer to submit your questions in writing, please write to our office at 11 Dudhope Terrace, Dundee, DD3 6TS, United Kingdom addressing your letter to the Data Controller.


We seek to resolve directly all complaints about how we handle personal information but you also have the right to lodge a complaint with the Information Commissioner’s Office, whose contact details are as follows:

The Information Commissioner’s Office – Scotland

45 Melville Street



Telephone – 0303 123 1115

E-mail -Scotland@ico.org.uk

Website – https://ico.org.uk/concerns

For the protection of our clients

In accordance with the disclosure requirements of the Provision of Services Regulations 2009, our professional indemnity insurer is Hiscox Insurance Company Limited, of 1 Great St. Helens, London, EC3A 6HX, United Kingdom. The territorial coverage is worldwide excluding professional business carried out from an office in the United States of America or Canada and excludes any action for a claim brought in any court in the United States of America or Canada. Details of our audit registration can be viewed at www.auditregister.org.uk under reference 0698.




11 Dudhope Terrace



Tel: 01382 221511

Fax: 01382 322299


Westway Enterprise Centre

Peasiehill Road



DD11 2NJ

Tel: 01241 873853

Fax: 01241 871038

2018 © FINDLAYS. All rights reserved.