Data protection and information security policy

This policy sets out the data protection principles and information security controls adopted by Tenth Street Advisory Ltd (the “Firm”) in accordance with the UK General Data Protection Regulation (the “UK GDPR”), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), and the Firm’s obligations as an accountancy service provider supervised by HM Revenue & Customs for anti-money laundering purposes.

The Firm is registered with the Information Commissioner’s Office (the “ICO”).

The Director, Faizan Mehmood, is designated as the Firm’s Data Compliance Officer (the “Data Compliance Officer”) and is responsible for this policy and for the Firm’s compliance with it. The Firm is not required to appoint a data protection officer under Article 37 of the UK GDPR and has not done so. The Data Compliance Officer is therefore not a data protection officer for the purposes of Articles 37 to 39 of the UK GDPR.

• —Personal data is processed lawfully, fairly and in a transparent manner. Clients are informed of how their personal data is used through the Client Privacy Notice (DP-01).
• —Personal data is collected only for specified, explicit and legitimate purposes (the delivery of the Firm’s services and compliance with its tax, accounting and anti-money laundering obligations), and is limited to what is necessary for those purposes.
• —Personal data is kept accurate and up to date, and is retained only for as long as necessary, in accordance with the Data Retention Policy (DP-02).
• —Personal data is protected by the security measures set out in section 4, and records are kept to demonstrate the Firm’s compliance.
• —The Firm relies on the following lawful bases for processing: performance of a contract (the engagement letter); compliance with a legal obligation (including filings with HMRC and client due diligence under the Money Laundering Regulations 2017); legitimate interests (including practice management, credit control and marketing to existing clients); and consent (for marketing where consent is required by the Privacy and Electronic Communications Regulations 2003; consent may be withdrawn at any time). Anyone may opt out of marketing at any time.

Special category and criminal offence data. In carrying out client due diligence and ongoing monitoring under the Money Laundering Regulations 2017, including sanctions, politically exposed person and adverse media screening, the Firm may process personal data relating to criminal convictions and offences, and special category data, including information revealing the political opinions of a politically exposed person. The Firm processes this data only where it is necessary for those purposes, and relies on the conditions in paragraph 10 (preventing or detecting unlawful acts) and paragraph 12 (regulatory requirements relating to unlawful acts and dishonesty) of Part 2 of Schedule 1 to the Data Protection Act 2018. Biometric verification does not form part of the Firm’s standard identity checks and, where it is used, is addressed in section 8.

Appropriate policy document. Section 23 of the Firm’s AML Policies, Controls and Procedures, together with this policy, constitutes the Firm’s appropriate policy document for this processing for the purposes of Part 4 of Schedule 1 to the Data Protection Act 2018. Section 23 of that document sets out how the data protection principles are applied to this data, and section 22 sets out the Firm’s policy on its retention and erasure. It is retained for at least six months after the processing ends, is reviewed together with this policy, and is made available to the ICO on request.

Individuals have the right of access to their personal data and the rights to rectification, erasure, restriction of processing, objection and data portability, together with the right to complain to the ICO, subject to the conditions and exemptions set out in data protection law. Requests are handled within one calendar month of receipt, which may be extended by up to two further months for complex requests, and are recorded in the DSAR Log (DP-04).

Access and devices

Strong, unique passwords or passphrases are used on all practice systems, with multi-factor authentication wherever it is supported. Laptops and mobile devices are encrypted and protected by up-to-date anti-malware software and a firewall, with automatic updates enabled. Remote access, and access over public networks, takes place only through a secure, authenticated connection or a VPN. Account credentials are reviewed periodically and are changed or revoked immediately if a device is lost, stolen or compromised.

Encryption, cloud software and processors

Personal data is encrypted in transit and at rest. Proportionate due diligence is carried out on any cloud accounting, practice management, payroll or identity verification provider before it is engaged. A written data processing agreement meeting the requirements of Article 28 of the UK GDPR is in place with every processor, including a contractual obligation to notify the Firm of any personal data breach without undue delay.

Email, communications and home working

Any request to change a client’s bank details is verified by independent means before it is actioned. Bulk communications are sent by blind copy (bcc) or mail merge. Sensitive data sent externally is password-protected or sent through a secure portal. The home office is kept secure, devices are locked when unattended, and no member of the household has access to practice accounts. Paper records are kept to a minimum, stored securely and destroyed by cross-cut shredding.

Backup, continuity and incident response

Practice data is backed up regularly and automatically, and restoration is tested periodically. Arrangements are in place to maintain continuity of client service in the event of a significant IT failure or loss of equipment. Any actual or suspected security incident is reported immediately to the Data Compliance Officer and investigated in accordance with the Data Breach Response Plan (DP-03).

This policy is the Firm’s master data protection and information security document and is to be read together with the following supporting documents:

Compliance with this policy is reviewed periodically as part of the Firm’s ongoing practice management. This policy is reviewed by the Data Compliance Officer at least annually and following any material change in the Firm’s systems, the threats it faces or the applicable law, and sooner where an incident indicates that a control is inadequate. The Data Compliance Officer also ensures that the Firm’s registration with the ICO is renewed before it expires.

The Firm has assessed its processing activities against the criteria for a data protection impact assessment (“DPIA”) in Article 35 of the UK GDPR and the ICO’s guidance. As a small, owner-managed practice providing routine bookkeeping, payroll and tax services to individual clients, the Firm does not carry out large-scale or high-risk processing, or systematic profiling, of a kind that would require a DPIA. Subject to the provisions on biometric verification below, the Firm has therefore concluded that a full DPIA is not currently required. This conclusion will be revisited if the scale or nature of the Firm’s services changes, and before any AI tool is used to process personal data in a new way (section 5.7).

Identity verification and biometric data. The Firm’s standard method of verifying the identity of clients, directors and beneficial owners does not involve the processing of biometric data. Identity is verified electronically, through a provider certified under the UK digital verification services trust framework, by checking the individual’s identity details against reliable and independent sources. The Firm then confirms, by means of a video call at which the individual presents their identity document, that the individual it is dealing with is the person whose identity has been verified, as set out in its AML Policies, Controls and Procedures. The comparison made on that call is a visual comparison carried out by a person and does not involve the processing of biometric data.

Biometric verification is not used routinely. It is used only where it is necessary to meet an identity verification standard that applies to a particular check, or where the Data Compliance Officer determines, in a particular case, that additional assurance is required. In this policy, “biometric verification” means a check in which the provider compares a live image or video of the individual with the photograph in their identity document (facial matching), or confirms that the individual is physically present (liveness detection). Such a check processes biometric data to uniquely identify the individual, which is special category data under Article 9 of the UK GDPR, and the ICO’s guidance on biometric recognition requires a DPIA to be completed before such processing begins.

Where biometric verification is used, the Firm:

1. (a)completes and records a DPIA for this processing before biometric verification is first used, and reviews it at least annually and whenever the provider, its technology or the way in which the check is carried out changes;
2. (b)relies on the individual’s explicit consent under Article 9(2)(a) of the UK GDPR for the facial matching, obtained through the provider’s process before the check begins and after the individual has been informed of what the check involves and how their data will be used;
3. (c)offers any individual who does not consent an alternative means of verification that does not involve biometric data and meets the requirements of the Money Laundering Regulations 2017, as agreed with the Data Compliance Officer;
4. (d)establishes, before engaging a provider, whether the provider acts as the Firm’s processor or as a separate controller in respect of the biometric data, and puts in place an agreement meeting the requirements of Article 28 of the UK GDPR where it acts as the Firm’s processor;
5. (e)ensures that the provider deletes facial images and biometric templates once the check is complete, or within the period set out in its terms, and does not use them for any other purpose, including the training of its systems, without the Firm’s agreement; and
6. (f)retains only the verification result and the records required by regulation 40 of the Money Laundering Regulations 2017, in accordance with the Data Retention Policy (DP-02).