How Your Information Is Handled

Asking an owner to open their books is asking for trust, so this page says exactly what happens to information here — including the parts firms usually leave vague. Where a limit exists, it is stated, not hidden.

Who touches your information

Cloud tools mean other companies' systems touch your data, so here is the actual list. Your information is handled by the firm and by the providers below, only as far as the work requires:

Under the engagement, information is disclosed only to representatives, specialists, advisers, contractors, and technology providers who need it for the engagement and who owe a duty to protect it. Any contractor or adviser will be named to you in writing before they see your records. A provider may also have to disclose information when law, a court, a regulator, or lawful process requires it.

Engagement records are processed in the cloud, by the providers above.

What we never do

• We never sell your information. Not your records, not your contact details, not anything derived from them.
• We will not knowingly authorise a provider to use your confidential information to train a general public model.
• We never hold your money — and we never ask for your own passwords. Do not send us a personal password, a multifactor code, or a bank or government account credential. Where a system allows it, you create a separate view-only login for the firm that you can revoke at any time. You keep control; we get a key you can take back.
• Your records stay yours. Nothing in an engagement transfers ownership of your records or data to this firm. General lessons may be reused only in a form that does not identify you and does not reveal your confidential information.

During an engagement

• Your records are kept in the systems identified or allowed under your engagement's technology schedule, which may also list approved providers, prohibited providers, restricted data, and special handling rules you set.
• Confidential information is used only to perform or receive the services, and is protected with reasonable care.
• You should flag any record that is subject to a legal privilege, court order, confidentiality duty, or other restriction before we review it.

When an engagement ends

• The records in our working file are returned or made available to you at termination.
• Within 30 days after termination, you may direct us to return or delete the records we control, on the terms of the engagement.
• One archival copy of findings, fee statements, engagement records, and supporting work papers may be kept, so the work performed can be proved, a fee calculated or defended, a legal duty met, or a claim answered. Legal holds and legal duties may also require retention.

If something goes wrong

If we confirm that an unauthorised person accessed your confidential information stored in a system we control, we will tell you promptly, and cooperate with your reasonable investigation. Each side complies with the privacy and data protection law that applies to its own role in the engagement.