12.1. Our Privacy Policy, which can be found on our website bkl.co.uk/privacy-policy, explains how we process personal data in respect of the various services that we provide. We are registered as a Data Controller with the Information Commissioner’s Office as required by the UK Data Protection Act 2018.
12.2. We confirm that we have adequate security measures in place to protect all personal data which has been provided to, processed or stored by us, which includes organisational, administrative, physical and technical safeguards. Such safeguards help to keep personal data secure and protect it from unauthorised access, unlawful processing and against accidental loss, destruction, or damage.
12.3. Our Privacy Policy, which can be found on our website at bkl.co.uk/privacy-policy, explains how we process personal data in respect of the various services that we provide.
12.4. In the course of providing services to you, we may disclose personal data to other firms in our network, regulatory bodies, third-party partners or suppliers, or a buyer of our business. We will only export personal data you supply to us outside of the UK/EU/EEA where it is necessary for the performance of our obligations under this engagement letter, or as you may instruct us, and you consent to such data exports taking place. A list of our sub-processors can be viewed at https://bkl.co.uk/privacy-policy/data-subprocessors.
12.5. Where we use cloud-based services and applications to undertake our business activities, you are advised that the Cloud Service Provider’s terms and conditions may indicate that processing takes place outside of the UK/EU/EEA. A list of sub-processors can be viewed at https://bkl.co.uk/privacy-policy/data-subprocessors.
12.6. Depending upon the nature of the work we undertake for our clients, we may be acting either as a Data Controller or Data Processor. For clarity:
(a) Whilst working on client accounts, we decide how to process personal data based upon our professional standards, our duty of care, and our need to act independently in accordance with our ethical obligations. We are required to take responsibility any personal data we process. In such circumstances, we will be acting as a Data Controller and have responsibilities as such in accordance with the UK Data Protection Act 2018.
(b) If we have been engaged simply to process data (including personal data) strictly in accordance with the written instructions received from a client, we will be acting as a Data Processor in accordance with the UK Data Protection Act 2018.
12.7. In order for us to:
(a) discharge the services agreed within this engagement letter,
(b) comply with our legislative and regulatory obligations,
(c) update and manage our client records, and
(d) undertake management and monitoring activities
we may obtain, process and store your data, including your personal data. For most routine business activities, we will act as either a Data Controller or Data Processor (see sub-clause 6), using information you have freely provided to us for the purposes you have authorised us to undertake. We only process personal data:
(e) in accordance with your written instructions, to process personal data only to the extent necessary to perform our obligations pursuant to this engagement letter, our professional obligations and/or in accordance with your lawful written instructions,
(f) ensuring that our employees who process your personal data have been trained and informed of their obligations in relation to personal data, and that they will process information in confidence and in compliance with data protection law,
(g) in line with the services you have asked us to provide, including delivering our professional obligations to you, and
(h) in accordance with our obligations under the UK Data Protection Act 2018.
12.8. At all times, you remain the ‘Data Controller’ for your and/or your organisation’s personal data, which means:
(a) you have primary responsibility for complying with all applicable data protection legislation and regulations, including the UK Data Protection Act 2018.
(b) you have responsibility for ensuring appropriate technical and organisational controls are in place for processing personal data, including by your suppliers.
(c) you have read and understood the contractual data protection clauses, privacy notices and related supporting information made available by your suppliers.
(d) where you disclose personal data to us, you confirm that such disclosure is fair and lawful and does not contravene any relevant requirements.
(e) you will ensure that there is a valid and lawful legal basis for sharing personal data with us, and fully indemnify and hold us harmless if such a legal basis is not in place or not valid, such that the activity causes us loss.
(f) you accept full responsibility and any consequences arising from (i) the unlawful sharing of personal data with us, and (ii) actions which follow the disclosure of any personal data which we may send to you.
(g) prior to sharing data with us based upon a Power of Attorney, provide to us either an original or certified copy of power of attorney before sharing such data, and confirm that the relevant data subjects are made aware of this activity.
Where we act as a Data Controller (see sub-clause 6), the applicable clauses within this sub-clause 8 will separately also become our responsibility, as they will apply to the activities for which we have a professional responsibility.
12.9. Unless it has been communicated that we are acting as a Data Controller, the role of Data Controller remains with you for the purposes of identifying, reporting and managing any breaches of personal data.
Specifically, you have responsibility for the reporting of personal data breaches to the Supervisory Authority (ICO). If we are acting as a Data Processor, we will promptly make you aware of the circumstances of any personal data breaches identified either by our personnel, IT systems or third-party suppliers. We will provide all reasonable support to you where we are in any way involved with the personal data breach.
Where we act as a Data Controller (see sub-clause 6), the applicable clauses within this sub-clause 9 will separately also become our responsibility, as they will apply to the activities for which we have a professional responsibility.
12.10. Unless it has been communicated that we are acting as a Data Controller, the role of Data Controller remains with you for the purposes of identifying, reporting and managing any breaches of personal data.
Specifically, you have responsibility for the reporting of personal data breaches to the Supervisory Authority (ICO). If we are acting as a Data Processor, we will promptly make you aware of the circumstances of any personal data breaches identified either by our personnel, IT systems or third-party suppliers. We will provide all reasonable support to you where we are in any way involved with the personal data breach.
Where we act as a Data Controller (see sub-clause 6), the applicable clauses within this sub-clause 9 will separately also become our responsibility, as they will apply to the activities for which we have a professional responsibility.
12.10. Unless it has been communicated that we are acting as a Data Controller, the role of Data Controller remains with you for the purposes of receiving, investigating and responding to any data subject rights requests that may be received.
Specifically, you have responsibility for receiving, validating and responding to any data subject who wishes to exercise any of their rights as a Data Subject. If we are acting as a Data Processor and we receive any such data subject requests, we will forward them to you promptly and unanswered. We will provide all reasonable support to you in responding to a data subject request where we have been involved in data processing.
Where we act as a Data Controller (see sub-clause 6), the applicable clauses within this sub-clause 10 will separately also become our responsibility, as they will apply to the activities for which we have a professional responsibility.
12.11. If you have engaged with us as a private client (rather than instructing us through a company or charity) you have various rights related to our management and processing of your personal data. handle your data in particular ways. Full details of these rights can be found in our Privacy Policy, which can be accessed from our website at bkl.co.uk/privacy-policy.
12.12. If you have any questions or concerns about the way in which we process personal data, in our capacity as either a Data Controller or a Data Processor, we will be happy to answer them. Please use the information provided in this engagement letter to contact us, and we will respond as quickly as possible.