This is the Privacy Notice for Corporation Tax Rebates Limited (“CTR”) of Eastham Hall, 109 Eastham Village Road, Eastham Village, Wirral CH62 0AF.
We are the data controller and all communications are to go to enquiries@corporationtaxrebates.co.uk
Who does this privacy notice apply to, and what is it about?
This privacy notice applies to you if you are an individual who works for a third party organisation which has or has had a business relationship or business dealings with CTR.
What personal data do we collect about you, and how?
We collect certain information about you, when given by you, or your organisation, as follows:
- your name and your role or position in your organisation;
- your contact details at your organisation, including any work email address, telephone numbers and other contact methods and derived information.
We need this in order to enable pre-contract discussions and later to manage any subsequent contract and our relationship.
What do we do with your personal data, and on what basis?
We process personal data about you for the following purposes:
- Managing our business relationship with the organisation that you represent: including communicating with your organisation and negotiating, concluding and performing business transactions with your organisation, and this may involve complaints to your managers about your behaviours (lawful basis – pre-contract and contract performance and legitimate interests).
- Managing our own business arrangements: including liaison with and payment of introducers and accountants involved, and to assess and report on the effectiveness of our business relationship with your organisation (lawful basis – contractual performance and legitimate interest).
- Legal and regulatory compliance: to ensure compliance with applicable laws and regulations to which we are subject, including those which require us to keep records of business transactions with your organisation (lawful basis – to comply with legal obligation).
- Contractual compliance: to ensure compliance with contractual obligations which we have assumed to your organisation, including those which require us to notify your organisation of matters (lawful basis – contractual performance).
Our legitimate interests are to achieve all those purposes above that do not relate to complying with a precontractual request, contractual right or a legal duty.
Where we process your personal data only on the basis of a legitimate interest you have the right to object to our use of your personal data. However, we do not have to stop processing personal data where we have compelling grounds that override your interests, or where we need to process your data in order to establish, exercise or defend legal claims. If you have any objections please contact us (see details above).
Where we process your personal data because we have a legal obligation to do so there is no right to object.
What are our obligations to collect and your obligations to provide personal data?
We are not obliged to collect personal data about you but, where we do so, we may be obliged to retain that data, for example where it appears in certain of our business records.
You are not obliged to provide us with your personal data but, if you do not do so, we may not be able to manage our business relationship with your organisation.
Who will we share your personal data with?
We will share your data with the party that referred or introduced you to us (you will know who that is, so we do not need to list them here) so we can manage our relationship with them, report to them on the progress of matters and meet payment obligations of commission for the introduction (if any). We will share your personal data with third parties where we are legally obliged to do so, for example to government bodies and regulatory authorities and to the courts and parties to legal proceedings pursuant to court rules and orders.
We may also share your personal data with third parties who provide services to us, for example accountants, professional advisors and other third parties who are used by us to perform processing activities, such as email or network hosting or software management services and payment services. We can let you know who these are if they process your data if you want to know (subject to any data security concerns which may override that disclosure).
For how long will we process your personal data?
We will process your personal data for as long as your organisation is, or is likely to be, in a business relationship with us, which will depend entirely on the nature and length of that business relationship, and for so long after the cessation of that business relationship as is necessary to deal with any outstanding business, tax, regulatory or legal matters, which will also depend entirely on what those outstanding matters are and whether any legal issues arise. This will usually be no more than six years after the end of our business relationship with your employers.
We may also retain your personal data where it is comprised in documents which evidence our business dealings with your organisation, such as in emails sent to or from you when acting on behalf of your organisation or where your name or other information about you appears in business records or reports, for as long as we need to keep that evidence for our business purposes, which is likely to be at least six (6) years from creation of that evidence or longer where there are legal requirements to hold such evidence or where any regulatory investigations or legal claims arise or could arise.
What rights do you have in relation to your personal data?
You have a number of rights in relation to your personal data. These include the right, subject to exceptions,
to:
- Be told what we are doing with your personal data (which is the point of this notice)
- access your personal data;
- portability of your personal data;
- request the rectification or erasure of your personal data;
- request restrictions on the processing of your personal data; and
- object to our processing of your personal data.
Please contact us as set out above if you wish to exercise any of these rights. We will only charge if the request is excessive because of the frequency of requests, the historic period and systems over which we may have to search, and perhaps the volume of data involved.
What should you do if you have any questions or complaints?
If you have any questions or complaints about how we process your personal data, you should contact us as set out above.
CTR Privacy Notice September 2020 v1.0
