Privacy & Policy

We collect and process the following categories of data:

• Personal Data:

  Includes but is not limited to names, email addresses, telephone numbers, and IP addresses.

• Financial Data:

  Encompasses bank statements, payment histories, payroll records, donor reports (for charities), and HMRC Gift Aid data.

• Sensitive Data:

  Refers to financial information required for accounting services, including tax filings and compliance reporting.

Your data is processed for the following purposes:

• Service Delivery:

  To provide accounting, digital marketing, and other outsourcing services as agreed in our contracts.

• Legal Compliance:

  To fulfill obligations under UK Charity Commission and HMRC regulations.

• Marketing:

  To send promotional materials, subject to your explicit consent.

Under GDPR Article 6, we process your data based on the following legal grounds:

• Contractual Necessity:

  To perform our obligations under service agreements.

• Legal Obligations:

  To comply with UK tax and charity laws.

• Legitimate Interests:

  To improve our services and communicate with clients.

• For sensitive financial data, we rely on GDPR Article 9(2)(b) (processing necessary for the performance of a contract).

We implement stringent measures to ensure the confidentiality, integrity, and security of your financial data:

• Access Controls:

  Financial data is accessible only to authorized personnel bound by confidentiality agreements.

• Encryption:

  All financial data, including bank statements, is encrypted.

• Non-Disclosure Agreements (NDAs):

  All employees and third-party processors handling financial data are required to sign NDAs.

• No Unauthorized Sharing:

  Financial data is never sold, shared, or disclosed except as necessary for service delivery (e.g., HMRC filings) or as required by law.

To deliver our services, we may transfer your data outside the UK or European Economic Area (EEA). In such cases, we implement safeguards to ensure compliance with GDPR and protect your data, including:

• Standard Contractual Clauses (SCCs):

  Approved by the European Commission for international data transfers.

• Adequacy Decisions:

  Ensuring the recipient country provides an adequate level of data protection.

In the event of a data breach that affects your personal or financial data, we will:

• Notify you within 72 hours of becoming aware of the breach, as required by GDPR Article 33.

• Provide details of the breach, including its nature, potential impact, and the steps we have taken to address it.

We retain your data in accordance with legal and operational requirements:

• Bank Statements:

  7 years (to comply with HMRC tax audit requirements).

• General Financial Data:

  3 years following the termination of our contractual relationship.

• Marketing Data:

  Until you withdraw your consent or opt out of communications.

You have the following rights regarding your data:

• Access:

  To request a copy of your data.

• Rectification:

  To correct inaccurate or incomplete data.

• Erasure:

  To request deletion of your data, subject to legal obligations.

• Restriction:

  To limit the processing of your data under certain conditions.

• Objection:

  To object to processing for direct marketing purposes.

• Data Portability:

  To receive your data in a structured, commonly used format.

To exercise these rights, please contact us at info@ssfglobal.co.uk. We will respond within 30 days of receiving your request.