1. Introduction
This privacy notice explains how personal data is used by:
- The Association of Taxation Technicians (ATT), www.att.org.uk, registered company number 2418331, registered charity number 241831, ICO registration reference Z6392732.
- The Chartered Institute of Taxation (CIOT), www.tax.org.uk, registered charity number 1037771, ICO registration reference Z508268X
- The Low Incomes Tax Reform Group (LITRG), www.litrg.org.uk, a department of the CIOT.
If you wish to contact us, or our Data Protection Officer, please use the contact us form or write to us at 30 Monck Street, London SW1P 2AP.
2. Details of our processing
2.1 If you visit our website
We will process details about your device, such as your IP address and browser settings, and your activity on our website (page views and timestamps).
This information is used as a recognised legitimate interest to maintain security and for our legitimate interest of managing and improving website performance. Analysis is typically performed at an anonymised and aggregate level.
We also use Cookies on our websites. For further details, please see our Cookie Notice which is linked from the bottom of our webpages.
2.2 If you ask us a question
We will use your contact details and information you give , to provide our response. We do this as a legitimate interest (ATT) or public task (CIOT).
We ask that you do not send us special categories of personal data (health, religion, ethnicity, etc), highly sensitive data (payment card data, bank account data, usernames, passwords, etc), or unnecessary personal data, on general contact forms. Only enter sensitive data if necessary for a particular purpose, such as specifically on an event booking form or the member/student portal.
2.3 If you subscribe to events, media, emails, or industry updates
We will use the contact details and communication preferences you provide us with, to send information that we believe to be relevant, as a legitimate interest (ATT) or public task (CIOT).
We will process data about the status of email communications, as a legitimate business interest, to monitor their performance.
You can opt-out of general communications at any time.
2.4 If you become a student sitting exams or apprenticeship End-Point assessments
We will use your contact details to provide relevant industry updates as a legitimate interest to help with your career development.
If you subsequently apply or take exams or assessments, we will process your exam/assessment data as a legitimate interest (ATT) or public task (CIOT). We may use third party exam software who will act as a data processor of your information.
We will use identity documents you provide (e.g. passport) to manually verify your identity for exams as a legitimate interest to prevent/detect fraudulent activities. We may use third party exam software who will act as a data processor of your information.
We will use special categories of data you provide, such as medical or religious data to make reasonable adjustments when you are sitting exams or for special consideration in relation to your results if something happens to you shortly before or during your exam/s, as a substantial public interest under our statutory obligations. Please notify us of the reasonable adjustments required, rather than health conditions.
Where any data is collected for equality, diversity and inclusion purposes, that data will only be used in an aggregate and anonymised form, for statistical purposes.
For the CA CTA and ACA CTA Joint Programmes, exam result data will be shared with ICAS/ICAEW, as a contractual necessity for the provision of the programmes. ICAS and ICAEW operate as independent Controllers. Please see their privacy notices regarding their use of personal data.
For apprentices, it is a requirement of the apprenticeship that the ATT and CIOT issue the results from your examinations to your Apprenticeship Training Provider. This is required to enable the Training Provider to confirm completion of your Apprenticeship.
If you agree (either via your employment contract or separately to us), we will share your exam results with your exam sponsor and Apprenticeship End-Point Assessment Organisation (ICAEW), as a legitimate interest. They will be the separate controller of that personal data and their own privacy notices apply..
2.5 If you become a member
We will process your contact details, membership payments and professional information to provide membership services, under contract with you.
As a member, we will publicly share your name, qualifications, membership start date, membership end date and grade, as a legitimate interest (ATT) or public task (CIOT).
We will process complaints or disciplinary action against members as a matter of legitimate interest (ATT) or public interest (CIOT) and will retain associated data indefinitely on that basis. When processing cases, personal data will be shared with the Tax Disciplinary Board (TDB) and their external advisers. We reserve the right to publish the results of any investigations and actions.
Where any data is collected for equality, diversity and inclusion purposes, that data will only be used in an aggregate and anonymised form, for statistical purposes.
If have a health concern that may impact your membership, we will process the health information you provide to make reasonable adjustments to support your membership-based activities, as a substantial public interest under our statutory obligations. Please notify us of the reasonable adjustments required, rather than health conditions.
2.6 If you become a colleague
The Privacy Notice for colleagues, including staff, employees and volunteers, is available from our HR team.
If you apply to become a colleague, we will process your contact details and career history to assess your suitability for that position or other relevant positions, with a view to enter into a contract.
2.7 If you become a business contact
We will process your contact details and data from our interactions for business purposes, as our legitimate interest, including the provision of services or discussing tax matters.
2.8 If you apply for a grant, a scholarship, or sponsorship
We will process your contact details and data from your application and any subsequent correspondence to assess your suitability for receipt of a grant, scholarship or sponsorship as will be necessary to enter into a contract with you.
If we agree to make a payment to you, we will process your payment details.
If you advise us of a health concern that may impact completion of your funded work, we will process the health information you provide to make reasonable adjustments in respect of your application, as a substantial public interest under our statutory obligations. Please notify us of the reasonable adjustments required, rather than health conditions.
2.9 If you attend an online event
We will process your contact details, event attendance and any comments you provide, as our legitimate interest. Details will be shared with other professional attendees, and attendees’ names and comments can be shared publicly, unless you notify us to opt-out, which you can do at any time.
If have a health concern that may impact your attendance, we will process the health information you provide to make reasonable adjustments to support your attendance, as a substantial public interest under our statutory obligations. Please notify us of the reasonable adjustments required, rather than health conditions.
2.10 AML Supervision
We provide AML Supervision on member organisations, as a task carried out in the substantial public interest. In doing so, and operating as independent data controllers, we will process personal data provided by the member organisations, including criminal convictions; share data with other authorised bodies; publish the names of supervised firms on our websites; and retain that data as long as necessary to fulfil our legal obligations for AML supervision.
3. Data Subject Rights
We fully respect your rights to request that we:
- Allow you to opt-out of any process that you previously consented to, at any time.
- Provide a copy of specific data we hold about you, or pass it to a third party on your behalf.
- Amend, delete, or restrict processing of your data.
- Explain and review any automated decision making or profiling.
- Provide further information about our processing activities.
- Allow you to speak directly with our Data Protection Officer (DPO).
- Raise a complaint.
If you wish to make a request or contact us about any other matter, please use the contact us form or write to us at 30 Monck Street, London SW1P 2AP.
We always aim to respond in a timely manner. If you don’t hear from us, please let us know in case there has been a communication system issue.
You can also escalate matters to the ICO (www.ico.org.uk) if you believe we are using your data in an unlawful manner. However, please let us know first, so that we can try to resolve the concern.
4. Other Matters
Unless otherwise stated, we process special categories of data to make reasonable adjustments and to support care of individuals, as a substantial public interest under statutory obligations. We also process special categories of personal data for statistical purposes to help monitor equality, diversity and inclusion.
For recruitment and employment, our internal privacy notice applies.
We retain data for as long as we believe necessary for the purposes it was collected, to help resolve queries or complaints, for legal reasons, or as a record of historically relevant industry discussion.
We only process personal data in the UK. If you access your data from outside the UK, your data will be transferred internationally out of necessity and you should maintain appropriate safeguards.
Other than described above, we only share personal data with third parties if they are processing that data as processors on our behalf under written contract, or if required for legal or regulatory reasons. Where data is shared with third parties for their own use, they are the data controller and fully liable for their use of personal data.
Data will be shared with public authorities, such as law enforcement, HMRC, or tax regulators when deemed necessary to prevent or detect crime, or unauthorised, inappropriate, or improper regulated activities.
We do not sell or give away personal data.
Where our websites or emails provide links to other websites, those websites, associated organisations, and their use of data are beyond our control. We encourage you to read the privacy notices on any other website you visit.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us. This privacy notice was written with brevity in mind, please let us know if you would like more details.
We reserve the right to update our notices at any time.
