article banner

Privacy statement – professional engagements

Grant Thornton NI LLP wants to protect the privacy of our clients and all third parties whose data we process in the course of our professional engagements.  In the conduct of providing our professional services to clients, we may need to collect and use personal data about their directors, shareholder, partners, trustees, clients or customers or their employees, agents or contractors, which we will hold as a controller under the UK Data Protection Acts. 

Please read the following statement; it will help you to understand how we use your personal data.

About Us

In this privacy statement “we”, “our”, and “us” refers to Grant Thornton NI LLP, the limited liability partnership. 

What personal data do we collect?

In the course of carrying out our engagement for our client we may process personal data including your personal identification, name, address, email address, telephone numbers, roles and responsibilities, National Insurance numbers, details relating to contract of employment, salary information including credits and deductions, tax returns, bank account details, insurance details, invoices and company loan information.  We may also process health information and family details if instructed to provide certain services to our client.

While most personal data will be obtained from you directly or from our client, we may also perform background checks as part of our client onboarding procedures and continuous monitoring, and we will engage a third party service provider to assist with such checks.

Why do we process your personal data?

We may process your personal data in connection with our client on-boarding process, which includes background checks, in order to comply with our legal obligations in connection with the anti-money laundering legislation (including the Money Laundering Regulations 2007 as amended by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, the Proceeds of Crime Act 2002, the Terrorism Act 2000 and the Counter-Terrorism Act 2008 (as amended in each case)) and as may be further amended and updated from time to time.

We may also process your personal data in connection with the professional services that we provide to our clients.  In particular, where we provide audit and/or tax services to our clients we may be the controller of certain personal data that we process in order to undertake that service and meet our contractual and professional obligations. 

Our processing of your personal data in these circumstances is also based on our legitimate business interests in performing our engagement, operating our business and complying with internal policies and procedures.  We may also be required to process such personal data in order to comply with our legal obligations.

What personal data are you obliged to provide?

To whom might we disclose your personal data?

We may be required to submit returns to Companies House or HM Revenue and Customs as part of our engagement and to fulfil our professional obligations.

We may be required to provide other audit firms with access to our audit files where they act as group auditors or successor auditors.  We may also be requested to provide access to our audit files to potential investors or their advisors.

We may be required in certain circumstances, by law or by Regulations or by Professional Bodies, some of these may be located outside the United Kingdom (UK), to which we belong, to make reports to regulatory and law enforcement authorities or to such bodies, or to disclose documents or information or take other action, as a result of information received by us or matters which come to our attention during the course of our engagement. We may also be required to provide Regulatory Bodies, Grant Thornton International Limited or Professional Bodies with access to our work papers in order to facilitate monitoring inspections.

Transfers Abroad

We are an all-Ireland firm and therefore data is processed in all offices (ROI/NI) for the legitimate interest to ensure efficient running of the business.

Whilst we store personal data on servers both in Dublin and the UK, in line with the above, we may need to transfer personal data outside the UK. This includes to countries that are not recognised by the Government of the UK as providing an equivalent level of protection for personal data as in the UK (also known as having adequacy). Where we do so, we ensure that appropriate measures are in place to comply with our obligations under data protection legislation. This can include entering into an agreement governing the transfer containing the ‘standard contractual clauses’ (also known as ‘model clauses’) approved for this purpose by the Government of the UK.

Further details of the measures that we have taken in this regard are available by contacting us using the contact details below.

Our retention of your personal data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your rights

You have the right, subject to certain exemptions, to obtain a copy of any personal data we hold about you, to request rectification or erasure of such data, to request restriction of processing or to object to processing, and data portability.  If you wish to exercise these rights, please contact us at our registered office:

Registered office address: 12-15 Donegall Square West, Belfast, BT1 6JH

Alternatively, contact

You also have the right to complain to the Information Commissioners Office or another supervisory authority.