Privacy Policy - General Data Protection Regulation

Last revised: 2 July 2024

KELLY + PARTNERS is committed to treating the personal information we collect in accordance with the UK Data Protection Act 2018, the UK General Data Protection Regulation, other relevant UK legislation, and the EU General Data Protection Regulation. This policy sets out how Kelly + Partners handles personal information.

In this policy when we say “we” or “us” or “KELLY + PARTNERS” we are referring to Kelly Partners Group Holdings (UK) Ltd and/or such members of the Kelly + Partners group including, where applicable, group members located in Australia, USA, Hong Kong and India. Details of our group members can be found in section 5a.

Our privacy policy will be reviewed regularly to take account of changes in legislation, technology, and our operations and practices. We aim to ensure the policy is appropriate to the changing environment. We will inform you of any changes we make to this privacy policy as necessary by email or using a banner on our website.

Requesting a copy of KELLY + PARTNERS Privacy Policy:

Our privacy policy is available by following links to the policy on our website. However, on request, we may be able to provide you with a copy of the policy in an alternate format. If you have any enquiries or would like to make a request for a copy of the policy, please contact our Privacy Officer (refer to contact details below).

1. Purposes for which KELLY + PARTNERS collects, holds, uses and discloses personal information:

We only collect, hold, use and disclose personal information which is reasonably necessary to ensure that we are able to provide you with the products and services that are appropriate to your needs.

Legal basis for processing your personal information

Under data protection law, we can only use your personal information if we have a proper reason for doing so. This will be for one of the following reasons:

• For the performance of our contract with you or to take steps at your request before entering into a contract, for example because processing is necessary for the performance of a client instruction;
• To comply with our legal and regulatory obligations;
• For our legitimate interests or those of a third party;
• For the establishment, exercise or defence of legal claims or proceedings; or
• Where you have given consent.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.

We may process special category personal data for the following reasons:

• Where you have given your explicit consent;
• For compliance with a legal or regulatory obligation;
• For the purposes of establishing, exercising or defending legal claims;
• Where it is in your (or someone else’s) vital interests and you or they are physically or legally incapable of giving consent;
• Where you have made the personal data public; and/or
• For compliance with an employment law obligation.

There may be additional reasons which will be notified to you where they apply.

How we use your personal information

We set out below more detail on the ways in which we use your personal information. We may use your data:

• To provide accountancy services or other professional services to you/our clients;
• To ensure the confidentiality of commercially sensitive information;
• To manage and administer your or your organisation's business relationship with KELLY + PARTNERS, including use for the purposes of processing payments, accounting, auditing, billing and collection and other support services;
• To conduct checks to identify our clients and verify their identity or to check whether or not we might have a conflict of interest in respect of such client or matter or prospective client or matter;
• To screen for financial and other sanctions or embargoes, including credit reference checks with credit reference agencies;
• To comply with professional, legal and regulatory obligations and guidance that applies to our business, e.g. rules issued by our professional regulators;
• Where necessary to gather and provide information required by or relating to audits, enquiries or investigations by enforcement authorities, regulatory bodies, courts, tribunals and government agencies;
• To deal with any complaints received;
• To ensure business policies are adhered to, e.g. policies covering security and internet use and to prevent unauthorised access and modifications to systems;
• For operational reasons, such as ensuring safe working practices, improving efficiency, risk management, training, staff assessment and quality control;
• For statistical analysis to help us improve our services and communications to you or the strength of our relationship with you or to manage our practice, e.g. in relation to our financial performance, client base, work type or other efficiency measures;
• To update and enhance client records;
• For marketing our services to you; and/or
• For recruitment purposes. Where you apply for a job we will collect information related to that job, including copies of right to work documentation, references and other information included in a CV or cover letter or as part of the application process.

We will also process personal data which is provided to us by or on behalf of our clients for the purposes of services we provide to them.

2. Kinds of personal information KELLY + PARTNERS collects:

Due to the nature of the products and services we provide, and the requirements of legislation and regulations, we ask for a range of personal information from our customers.

The types of personal information we may collect can include details such as:

• Names, employment titles, contact details;
• Date of birth and gender;
• Information in identification documents (e.g. passport, driver’s licence);
• Tax file numbers and other government related identifiers;
• Assets and liabilities;
• Educational qualifications and employment history;
• Personal income;
• Visa and work permit status;
• Bank account details;
• Shareholdings and details of investments;
• Superannuation details;
• Tax and financial statements;
• Information regarding insurance;
• Personal information about your spouse and dependants;
• Technical information about your use of our IT, communication and other systems;
• Marketing information including information regarding your preferences and information about when you receive and read our marketing communications and which events you attend or participate in.

It may be necessary in some circumstances for KELLY + PARTNERS to collect special category information about you in order to provide specific services. The types of special category information we may collect include:

• Health status;
• Ethnic origin;
• Martial status; and
• Details of any membership/s to professional associations;

We may also collect criminal convictions and offences data.

You have a right to refuse to provide us with your personal information. However, if you do refuse to provide such information we may be unable to complete or fulfil the purpose for which such information was collected, including providing you or our clients with the services we were engaged to perform.

3. Collection, holding, using and disclosing of personal information:

(a) Collection – General:
When we collect, hold, use and disclose personal or special category information it must be done through lawful and fair means.

(b) Methods of collection:
KELLY + PARTNERS use a variety of formats for the collection of personal and sensitive information. These include:

• Requiring clients to complete a Client Profile or other forms;
• Receipt of emails, letters and other correspondence;
• Telephone calls;
• Appointments in person;
• Publicly available records;
• Through a customer’s personal representative;
• Through use of our website, such as via contact mailboxes or online enquiry forms, or through the registration process (see more information about ‘web analytics’ in Clause 2).

In every circumstance we will attempt to obtain such personal and special category information directly from you. If that is unreasonable or impracticable, we will attempt to obtain such information from other sources in accordance with Clause 3(a) above.

(c) Collection of someone else’s personal information:
You should only provide us with someone else’s personal information where you have their express consent to do so and it is for the purpose of us providing services to you. Matters in this policy should be communicated to any person whose information you collect and provide to us. In providing such information you agree that you have obtained the revenant consent and this is authorized to do so.

Unsolicited personal information:
There may be circumstances where we are provided with personal information which we did not actively seek. An example may be misdirected mail, or an excess of documents provided to us by clients.

In such situations, our Privacy Officer will make a determination on whether we could have obtained the information lawfully. If the information was not lawfully obtained it will be destroyed or de-identified. We will try to notify the relevant person, whose information has been mistakenly received, if this situation arises.

4. Security of personal information

Safeguarding the privacy of your information is important to us. We hold personal information in a combination of secure computer storage facilities and paper based files, and take steps to protect the personal information we hold from misuse, loss, interference, unauthorized access, modification or disclosure.

KELLY + PARTNERS trains its employees carefully on handling personal information and confidentiality of such information.

Once we have no purpose for holding your personal information, we will take all reasonable steps to destroy or de-identify the information.

5. Disclosure of personal information overseas and sharing personal information amongst and within the KELLY + PARTNERS Group network

(a) Disclosure amongst and within the KELLY + PARTNERS Group:
The KELLY + PARTNERS Group has offices in a number of global locations, including Australia (New South Wales, Victoria, Queensland and ACT), the USA, India and England. To meet the purposes for which your personal information has been collected we may disclose your information to others in the KELLY + PARTNERS Group.

(b) Disclosure overseas:
We share your personal data within the KELLY + PARTNERS Group. This will involve transferring your data outside the UK and EEA to our overseas offices in Australia, the USA, India and Hong Kong.

Whenever we transfer your personal data out of the UK and EEA to countries which have laws that do not provide the same level of data protection as the UK and EEA law, we always ensure that a similar degree of protection is afforded to it by ensuring that we use specific standard contractual terms approved for use in the UK which give the transferred personal data the same protection as it has in the UK, namely the International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission’s standard contractual clauses for international data transfers.

KELLY + PARTNERS utilizes some service providers overseas to process data and help deliver services to you. We may disclose your personal information to these providers from time to time. Such overseas disclosure would be to Australia, the USA, India, and Hong Kong or another country as advised. When required, your personal information will only be disclosed to an overseas person or business in the following circumstances:

• Where the overseas recipient has signed a contract with us which creates legal obligations to comply with applicable UK and EU data protection law and that all personal data will be secure;
• If you provide written consent for KELLY + PARTNERS to disclose the information after we provide you with full information; or
• If the disclosure is required or authorized by or under an applicable law or a court/tribunal order.

On collection of your personal information, we will inform you whether it is likely we will disclose the information to an overseas recipient and, if so, where those recipients are likely to be located.

(c) Disclosure to third party service providers:
KELLY + PARTNERS utilizes third party providers (such as IT providers and market researchers) for its business and to deliver services to you. It may be necessary for us to disclose personal information to these providers from time to time. Such disclosure will be in accordance with this Privacy Policy.

(d) Disclosure to other third parties:
We may share your personal data with third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. Privacy on our websites

The KELLY + PARTNERS website uses Google Analytics or other third party software to analyze aggregate user behavior. Google Analytics and such other software uses first party cookies, which are text files placed on your computer for the purpose of anonymously identifying your session. These cookies are not used to grant KELLY + PARTNERS access to your personally identifiable information. Non-identifiable information (such as the pages you visit) may be tracked. By directing your browser to delete your cookies, this data will be erased. For more information about Google Analytics, please follow the links provided on our website.

The information is collected using first party cookies, meaning that only KELLY + PARTNERS is able to access your information. Your information may be aggregated with information from other users for the purpose of improving our website and offerings. We will not associate any data gathered from our website with any personally identifiable information, unless you explicitly submit that information (e.g. your email address) via our online information form.

Any links to third party websites on Kelly + Partners website are not covered by our privacy policy.

7. Direct marketing

KELLY + PARTNERS may engage in direct marketing to you from time to time. We have a legitimate interest in processing your personal data for promotional purposes (see above the basis on which we use your personal data). This means we do not usually need your consent to send you marketing information. However, where consent is needed, we will ask for this consent separately and clearly.

When required, your personal information will only be used or disclosed for direct marketing where the information is not sensitive information, is collected directly from you and there is an easy means to opt out of such marketing (and such an opt out request has not been made) in the following circumstances:

• Where you would expect KELLY + PARTNERS to use or disclose the information for direct marketing purposes; or
• You have consented to the use or disclosure of the information for direct marketing purposes.

If you do not wish to receive these materials, please contact our Privacy Officer or opt-out of receiving these communications by using the ‘unsubscribe’ link in emails or other marketing communications which we send to you.

8. Access to personal information

You have the right to access any personal information regarding you that KELLY + PARTNERS holds. This is subject to some limited exceptions, which the Privacy Officer can provide further information on.

Such requests should be made in writing to the Privacy Officer. We will acknowledge your request within 1 month and respond to it within a reasonable time.

Unless your request is clearly unfounded, repetitive or excessive, KELLY + PARTNERS will not charge you a fee to access your personal data (or to exercise any of the other rights outlined below). Notwithstanding the foregoing, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

9. Correction of personal information

KELLY + PARTNERS endeavors to ensure that the personal information it holds is accurate and up-to-date.

You are able to make a request to correct the information by contacting our Privacy Officer, or by telephoning or emailing us with your corrected information. In some limited circumstances your request may be refused or partially refused.

10. Additional legal rights

In addition to the rights above, you can ask us to:

• Delete your personal data - in certain situations;
• Restrict processing of your personal data - in certain circumstances, e.g. if you contest the accuracy of the data; and
• Provide you with a copy of the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transfer that data to a third party - in certain situations.

You can object:

• At any time to your personal data being processed for direct marketing;
• In certain other situations to our continued processing of your personal data, e.g. processing carried out for the purpose of our legitimate interests.

If you would like to exercise any of those rights, please contact our Privacy Officer in the following ways:

Email address: info@kellypartners.com.au
Postal address: Privacy Officer, PO Box 1764, North Sydney NSW 2059 Australia

There may be limited circumstances where your request is refused or partially refused.

If this occurs we will give you a written notice that sets out:

• The reasons for the refusal, including the reasons why access cannot be granted in an alternative way (except where it would be unreasonable to provide those reasons);
• How to make a complaint about the refusal;
• Any other matter as prescribed by the regulations.

If your request to correct is refused you have the option of submitting a statement associated with your personal information. For more information contact the Privacy Officer.

11. How to make a complaint

You have the right to complain to the supervisory authority in the UK, the Information Commissioner. The Information Commissioner’s Office may be contacted at https://ico.org.uk/make-a-complaint/

We would, however, appreciate the chance to deal with your concerns before you approach the Information Commissioner, so please contact us in the first instance.

12. EU Representative

We have appointed Saltire Data Protection Services Limited to act as our representative in the European Economic Area to comply with Article 27 of the GDPR. You can always contact us directly if you are located in the EU and wish to raise any issues or queries you may have relating to the processing of your personal data. However, if you wish to contact Saltire Data Protection Services Limited you can do so by clicking this form https://app.saltiredataprotection.eu/enquiry/rs/kellypartners