1. Introduction
This privacy notice explains how personal data is used by:
- The Association of Taxation Technicians (ATT), www.att.org.uk, registered company number 2418331, registered charity number 803480, ICO registration reference Z6392732.
- The Chartered Institute of Taxation (CIOT), www.tax.org.uk, registered charity number 1037771, ICO registration reference Z508268X
- The Low Incomes Tax Reform Group (LITRG), www.litrg.org.uk, an initiative of the CIOT.
If you wish to contact us, or our Data Protection Officer, please use the contact us form or write to us at 30 Monck Street, London SW1P 2AP.
2. Details of our processing
2.1 If you visit our website
We will process details about your device, such as your IP address and browser settings, and your activity on our website (page views and timestamps).
This information is used as a recognised legitimate interest to maintain security and for our legitimate interest of managing and improving website performance. Analysis is typically performed at an anonymised and aggregate level.
We also use Cookies on our websites. For further details, please see our Cookie Notice which is linked from the bottom of our webpages.
2.2 If you ask us a question
We will use your contact details and information you give, to provide our response. We do this as a public task (CIOT) or legitimate interest (ATT).
We ask that you do not send us special categories of personal data (health, religion, ethnicity, etc), highly sensitive data (payment card data, bank account data, usernames, passwords, etc), or unnecessary personal data, on general contact forms. Only enter sensitive data if necessary for a particular purpose, such as specifically on an event booking form or the member/student portal.
2.3 If you subscribe to events, media, emails, or industry updates
We will use the contact details and communication preferences you provide us with to send information that we believe to be relevant as a legitimate interest (ATT) or public task (CIOT).
We will process data about the status of email communications, as a legitimate business interest, to monitor their performance.
You can opt-out of general communications at any time.
2.4 If you become a student sitting exams or apprenticeship End-Point assessments
We will use your contact details to provide relevant industry updates as a legitimate interest to help with your career development.
If you subsequently apply or take exams or assessments, we will process your exam/assessment data as a public task (CIOT) or legitimate interest (ATT). We may use third party exam software who will act as a data processor of your information.
We will use identity documents you provide (e.g. passport) to manually verify your identity for exams as a legitimate interest to prevent/detect fraudulent activities.
We will use special categories of data you provide, such as medical or religious data to make reasonable adjustments when you are sitting exams or for special consideration in relation to your results if something happens to you shortly before or during your exam/s, as a substantial public interest under our statutory obligations.
Where any data is collected for equality, diversity and inclusion purposes, that data will only be used in an aggregate and anonymised form, for statistical purposes.
For the CA CTA and ACA CTA Joint Programmes, exam result data will be shared with ICAS/ICAEW, as a contractual necessity for the provision of the programmes. ICAS and ICAEW operate as independent Controllers. Please see their privacy notices regarding their use of personal data.
For apprentices, it is a contractual requirement of the apprenticeship that the ATT and CIOT issue the results from your examinations to your Apprenticeship Training Provider. This is required to enable the Training Provider to confirm completion of your Apprenticeship. For the Level 7 Apprenticeship, the CIOT operates in conjunction with the ICAEW to deliver the End Point Assessment and therefore, we will share your examination results with ICAEW (with them acting as Apprenticeship End Point Assessment Organisation) as a contractual requirement.
If you agree (either via your employment contract or separately to us), we will share your exam results with your exam sponsor as a legitimate interest. They will be an independent Controller of that personal data and their own privacy notices apply.
2.5 If you become a member
We will process your contact details, membership payments and professional information to provide membership services, under contract with you.
As a member, we will publicly share your name, qualifications, membership start date, membership end date and grade, as a legitimate interest (ATT) or public task (CIOT). The information will also be displayed on the member website.
We will process complaints or disciplinary action against members as a matter of legitimate interest (ATT) or public interest (CIOT) and will retain associated data indefinitely on that basis. When processing cases, personal data will be shared with the Tax Disciplinary Board (TDB) and their external advisers. We reserve the right to publish the results of any investigations and actions.
Where any data is collected for equality, diversity and inclusion purposes, that data will only be used in an aggregate and anonymised form, for statistical purposes.
If have a health concern that may impact your membership, we will process the health information you provide to make reasonable adjustments to support your membership-based activities, as a substantial public interest under our statutory obligations. Please notify us of the reasonable adjustments required, rather than health conditions.
2.6 If you become a colleague
The Privacy Notice for colleagues, including staff, employees and volunteers, is available from our HR team.
If you apply to become a colleague, we will process your contact details and career history to assess your suitability for that position or other relevant positions, with a view to enter into a contract.
2.7 If you become a business contact
We will process your contact details and data from our interactions for business purposes, as our legitimate interest, including the provision of services or discussing tax matters.
2.8 If you apply for a grant, a scholarship, or sponsorship
We will process your contact details and data from your application and any subsequent correspondence to assess your suitability for receipt of a grant, scholarship or sponsorship as will be necessary to enter into a contract with you.
If we agree to make a payment to you, we will process your payment details.
If you advise us of a health concern that may impact completion of your funded work, we will process the health information you provide to make reasonable adjustments in respect of your application, as a substantial public interest under our statutory obligations.
2.9 If you register for or attend an event
This section applies to online, hybrid and in-person events.
We will process your contact details, event registration, attendance records, and any information or comments you provide, as our legitimate interest in administering and delivering the event.
If you provide necessary information about dietary, accessibility or religious requirements to support your attendance, we will process that data to make appropriate arrangements or reasonable adjustments, as a substantial public interest under our statutory obligations. Please tell us the adjustment or dietary arrangement required rather than providing special categories of information or more information than is necessary.
For events where networking is part of the programme, we will make an attendee list, including name, employee and contact details, available to other delegates where appropriate. We will explain this at registration and provide an opportunity to opt out. We do not share attendee information with speakers, exhibitors, sponsors or other third parties for their own marketing or other independent purposes.
Where we plan to take photographs or make audio or video recordings at events, as a legitimate interest for reporting, promotional, educational or archival purposes, we will provide information about photography, filming or recording before or at the event and explain how you can raise any concerns and opt out if so desired.
For in-person events, we will share information with venues, security providers and other contracted service providers to manage access, safety, catering, accessibility and event delivery. These organisations will process personal data only as required for those purposes and in accordance with the applicable contractual arrangements.
2.10 AML Supervision
We provide AML Supervision on member organisations, as a task carried out in the substantial public interest. In doing so, and operating as independent data controllers, we will process personal data provided by the member organisations, including criminal convictions; share data with other authorised bodies; publish the names of supervised firms on our websites; and retain that data as long as necessary to fulfil our legal obligations for AML supervision.
3. Data Subject Rights
We fully respect your rights to request that we:
- Allow you to opt-out of any process that you previously consented to, at any time.
- Provide a copy of specific data we hold about you, or pass it to a third party on your behalf.
- Amend, delete, or restrict processing of your data.
- Explain and review any automated decision making or profiling.
- Provide further information about our processing activities.
- Allow you to speak directly with our Data Protection Officer (DPO).
- Raise a complaint.
If you wish to make a request or contact us about any other matter, please use the contact us form or write to us at 30 Monck Street, London SW1P 2AP.
We always aim to respond in a timely manner. If you don’t hear from us, please let us know in case there has been a communication system issue.
You can also escalate matters to the ICO (www.ico.org.uk) if you believe we are using your data in an unlawful manner. However, please let us know first, so that we can try to resolve the concern.
4. Other Matters
Unless otherwise stated, we process special categories of data to make reasonable adjustments and to support care of individuals, as a substantial public interest under statutory obligations. We also process special categories of personal data for statistical purposes to help monitor equality, diversity and inclusion.
For recruitment and employment, our internal privacy notice applies.
We retain data for as long as we believe necessary for the purposes it was collected, to help resolve queries or complaints, for legal reasons, or as a record of historically relevant industry discussion.
We only process personal data in the UK. If you access your data from outside the UK, your data will be transferred internationally out of necessity and you should maintain appropriate safeguards.
Other than described above, we only share personal data with third parties if they are processing that data as processors on our behalf under written contract, or if required for legal or regulatory reasons. Where data is shared with third parties for their own use, they are the data controller and fully liable for their use of personal data.
Data will be shared with public authorities, such as law enforcement, HMRC or tax regulators when deemed necessary to prevent or detect crime, or unauthorised, inappropriate or improper regulated activities.
We do not sell or give away personal data.
Where our websites or emails provide links to other websites, those websites, associated organisations, and their use of data are beyond our control. We encourage you to read the privacy notices on any other website you visit.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. This privacy notice was written with brevity in mind. Please let us know if you would like more details.
We reserve the right to update our notices at any time.
