Avinat LLP
How we use your information when you become a client, verify your identity, and while we work for you.
This notice explains what personal information Avinat LLP collects about you and the people connected with your business, why we collect it, who we share it with, how long we keep it, and the rights you have. It applies from the moment you open our onboarding page and for as long as we act for you.
Please read it before completing the onboarding questionnaire and the identity check. The questionnaire asks you to confirm that you have read it.
Avinat LLP is a bookkeeping and payroll practice. Our registered office is 7 Bevendon Square, Salford, Manchester M7 4TF. We are the data controller for the information described in this notice.
We are registered with the Information Commissioner’s Office under number ZA312020. We are supervised for anti-money-laundering purposes by HM Revenue & Customs, registration XSML00000210369.
Questions about this notice or about your information go to Yisroel Guttentag, partner, at info@avinat.com or by post to the address above.
Through the onboarding page and in the course of our work: the name, company number and addresses of your business; how it trades; VAT, PAYE and other tax references where we need them; the name, date of birth, home address, nationality, mobile number and email address of each director, owner and person with significant control; whether any of those people holds or has held a prominent public position; what the business does and where its income comes from; who advised you before us; and the answers you give to the other questions on the page. Where the identity document a person uses does not show their home address, we also ask for a proof of address, such as a bank statement or utility bill.
We take your company’s details, its officers and its people with significant control from the Companies House register and ask you to confirm them. Where a discrepancy between what you tell us and the register cannot be explained, the Money Laundering Regulations require us to report it to Companies House.
When you complete the electronic identity check: images of the identity document you present and the details read from it (name, date of birth, document number, expiry, and address where the document carries one); a short live recording of your face, from which a comparison with the document photograph is made; the results of the document authenticity checks, the face comparison and the screening against sanctions, politically exposed persons and law-enforcement lists; and technical details of the device used, including its IP address, browser and the date and time.
Bank transactions, invoices, receipts, payroll and pension data, and correspondence. Where that data is about your employees or customers we usually process it on your instructions as your processor, and your own privacy notice to those people covers it. This notice covers the information about you and the people who own and run the business.
UK data protection law requires us to have a lawful basis for each purpose. These are ours.
| Purpose | Legal basis |
|---|---|
| Verifying the identity of the business and of the people who own and control it, assessing the risk of money laundering, and screening against sanctions and politically exposed persons lists | Legal obligation — the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, as amended |
| Keeping identity and due-diligence records for the period the law requires | Legal obligation — regulation 40 of the same Regulations |
| Preparing, agreeing and carrying out the engagement letter: the bookkeeping, VAT, payroll and other services you have asked for | Performance of a contract with you |
| Acting as your agent with HMRC and, with your permission, contacting your previous adviser | Performance of a contract; and your consent for the approach to the previous adviser |
| Corresponding with you, running our practice, keeping accounts and defending legal claims | Our legitimate interests in running the practice properly, balanced against your interests |
| Using your face to confirm that the person presenting the document is its holder | Your explicit consent — see section 4 |
The identity check compares a live recording of your face with the photograph on your identity document. Data used to identify a person from their physical characteristics is biometric data, which the law treats as special category data and protects more strictly.
We rely on your explicit consent for the face check. You give it by proceeding with the check after reading this notice, and the onboarding page records when you did so.
You do not have to use the electronic check. If you prefer, we will verify your identity in person at our office from your original documents. Tell us and we will arrange it. Choosing this does not affect how we treat you as a client.
You can withdraw consent at any time by contacting us. Withdrawal does not undo processing that has already happened, and we may then need to verify your identity another way before we can continue to act.
The face recording is used only for this comparison. It is not used to identify you anywhere else, is not shared with anyone other than our identity verification provider, and is not kept once the check is complete (see section 7).
The document checks, the face comparison and the list screening are carried out automatically by our identity verification provider. No decision that affects you is taken by the software alone. A partner at Avinat reviews every result that is not a clear pass, and any decision to decline to act for you is made by a person. You may ask us to explain a result and to review it.
We use the following organisations to process information on our behalf. Each acts on our instructions under a written contract and may not use your information for its own purposes.
| Provider | What it does for us |
|---|---|
| ID Analyzer (Evith Technology Ltd) | Electronic identity verification: document checks, the face comparison, sanctions and politically exposed persons screening, and the electronic signing of the engagement letter. We use their European Union service, so the document, the face recording and the results are processed and stored in Frankfurt, Germany. |
| IONOS | Hosts our website, including the onboarding page you complete. |
| Karbon | Our practice management system, where client records, correspondence and the identity and due-diligence file are kept. |
| Microsoft 365 | Email, calendar and document storage. |
| Xero and QuickBooks | Accounting systems in which your books are kept, whichever applies to you. |
| Dext | Capturing receipts and invoices for your books. |
| GoCardless | Collecting our fees by direct debit. |
We also share information where our work or the law requires it:
We do not sell your information and we do not share it with anyone for marketing.
| Information | How long |
|---|---|
| Identity and due-diligence records, including the identity document image, the verification report and the signed engagement letter | Seven years after our engagement ends. The law requires at least five; the longer period is set out in the engagement letter. |
| The identity document images, the face recording and the check results held by ID Analyzer | Until we delete them from ID Analyzer, which we do once the verification report has been filed in our own records. We keep that report, which contains the document image and a still photograph, with the due-diligence record above. |
| Your books, payroll records and our working papers | Seven years after the end of the accounting year they relate to, or as long as the law requires for the records concerned, whichever is longer. |
| Onboarding information where you do not become a client | Deleted twelve months after your last contact with us. |
| The copy of your answers on the onboarding website | Removed once the record has been filed in our practice management system. |
Your information is held in the United Kingdom and the European Union. Some of the providers in section 6 are based outside the UK or hold data outside it: in particular, ID Analyzer is operated by a company established in Taiwan, although the identity data itself stays on its servers in Germany. Where information leaves the UK, or is accessed from outside it, we rely on the UK Government’s adequacy regulations for the country concerned, or on the International Data Transfer Agreement or Addendum approved by the Information Commissioner, so that it receives protection equivalent to UK law.
The onboarding page is served over an encrypted connection and protected by a password you choose. Identity documents and reports are held in access-controlled storage that is not reachable from the public website. Only Avinat partners and staff who need the information for their work can see it, and our providers are contractually bound to keep it secure.
You have the right to:
We will respond within one month. Some rights are limited by the Money Laundering Regulations: for example, we cannot delete identity records while the law requires us to keep them, and we cannot tell you about a report we are prohibited from disclosing.
If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
The onboarding page sets one cookie, which keeps you signed in after you enter your password. It is deleted when you close your browser. The page uses no analytics or advertising cookies.
We will update this notice when our practices or the law change. The version and date are shown at the top. If a change affects how we use information you have already given us, we will tell you.