Privacy Policy

1 Who We Are

We are the controller, which means the organisation responsible in law, for the personal information we handle in providing our services, except where we keep records for a client as its processor, which section 4 explains.

Our sister company, Achieving Clarity Ltd (company number 11879908), is a separate accountancy practice with its own privacy policy for its own clients. Some of the people who work on our clients' matters are employed by Achieving Clarity Ltd, we use some of the same systems, and where one of our packages includes finance or accounting, its team carries out that work for us. In each case it handles our information on our behalf and on our instructions, under a written agreement between the two companies, and we remain responsible for it.

Contact. Christian Tetley is responsible for data protection at ACT Now. Write to him at hello@actnow.solutions, call 01227 743345, or write to our registered office. We would always rather you asked.

2 Who This Policy Covers

This policy covers everyone whose personal information we handle: our clients, the people who own and run them, and anyone who guarantees their fees; our clients' employees, workers, former employees and job applicants, and anyone else whose details come to us through a matter we handle; the people who attend our courses; people who enquire, ask for a quote or are referred to us; visitors to our website and our social media pages; the people we deal with at our suppliers and at other organisations; people who apply to work with us; and our own team, who also receive a fuller notice of their own. Sections 3 to 11 deal with each in turn. Sections 12 to 18 apply to everyone.

3 Our Clients

What we hold. To do the work you have asked us to do, we hold the information you give us and the information the work produces: the names and contact details of the people we deal with in your business; your business's details; the services you have chosen and our dealings with you; the matters we help you with, such as an employment issue, a contract or handbook, a risk assessment, an audit, a training booking or your office administration, with the documents, notes, photographs and correspondence that go with them; the access details for any of your systems you ask us to use; and, where your package includes finance or accounting, your financial records, bank statements, tax references and returns, and the information HMRC and Companies House require.

Where it comes from. From you and the people in your business; from the work itself, including what we see and are told on a visit; from public registers, such as the Companies House register, which we may use to confirm who we are dealing with; where your package includes finance or accounting, from HMRC, Companies House, your bank and the software you use; and, if someone referred you to us, from that person.

Why we hold it, and our lawful basis. Most of what we do with your information is the work you have asked us to do: the law calls this performing our contract with you. Some of it the law requires of us, mainly where your package includes finance or accounting: keeping the records HMRC and Companies House require, and verifying identity under the Money Laundering Regulations. The rest we do in our legitimate interests in running a careful, professional business: keeping our own record of the work and of the advice we gave; confirming who we are dealing with, to protect you and us against fraud; keeping in touch with you about our services; keeping our systems secure; collecting our fees and, if we have to, recovering what is owed to us and bringing or defending legal claims. If you, or a business connected to you, are also a client of Achieving Clarity Ltd, we and it may tell each other whether fees are overdue, so that each can deal with them as its Terms of Agreement allow, and we share nothing more than that needs. We have weighed those interests against the interests of the people concerned, and we are satisfied that what we do is what they would reasonably expect of a firm doing this work.

Where your package includes finance or accounting. That work is carried out for us by Achieving Clarity Ltd's team. Before we can provide it, the law requires us to verify your identity and that of the people who own or control your business, and to tell you this: the personal information we collect for that purpose will be processed only for the purposes of preventing money laundering, terrorist financing and proliferation financing, or as otherwise permitted by the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. You must give us the identity information those Regulations require and the tax information HMRC requires; without it, the law does not allow us to do that work. When a return is filed with HMRC from our software, the law also requires information about the software and the person submitting to be sent with it.

What else we need. The rest of what we ask for, you give us so that we can do the work; without it, we cannot do it well, or at all.

If you guarantee a client's fees. We hold your name, your contact details, your signature and the terms of your guarantee, and we use them to enforce the guarantee if the fees are not paid. The guarantee is a contract between you and us, and that is our lawful basis.

Decisions. No decision with a legal or similarly significant effect on anyone is made by software alone. Our systems help us; a member of our team decides, and decisions about your own people are always yours.

4 People In The Matters We Handle

Most of our work concerns the people who work for our clients. If you are an employee, worker, former employee or job applicant of one of our clients, or someone involved in a matter we are handling, such as a witness, a person who has raised a concern or someone hurt at work, we may hold your name, your contact details, your role and the information the matter needs: your employment details, absence, holiday, training, conduct and performance; what you and others have said in a meeting, an interview or a statement; and, where the matter requires it, information about your health, an accident or an injury, or an allegation about you. Most of it comes from our client, your employer, and some from you or from others involved in the matter.

Whose information it is. When we advise our client, investigate a matter, carry out an audit or assess risks, we decide how to handle the information as professionals and are responsible for it as a controller. When we keep an employer's staff records, run its payroll or provide its office administration, we act only on its instructions, as its processor; the employer remains responsible for that information and for telling you about it, and we pass any request you make about it to the employer and help it to answer.

We act for your employer. We work for our client as an employer, not for its employees. If you contact us about your own situation, we will suggest that you seek independent advice, for example from Acas, and you should assume that what you tell us may be shared with your employer, because we act for it.

Why, and our lawful basis. We use this information to do the work our client has asked of us and to help it meet its duties as an employer, in its legitimate interests and ours in managing its workplace fairly, lawfully and safely; and where the law requires something of our client, such as a report of an injury to the Health and Safety Executive, we help it to do so. Where our own records of advice, investigations and accidents include information about health, or about an allegation or offence, we rely on the condition the law provides for establishing, exercising or defending legal claims. Where we prepare something for an employer about one of its people, such as a risk assessment for a new or expectant mother, we do so on the employer's instructions, and the employer relies on the condition the law provides for its obligations as an employer. We ask our clients to give us only what the work needs.

Recruitment. Where we help a client with its own recruitment, we see the applications, curriculum vitae and interview notes of the people who apply, and we may help the client to record the checks it makes on a person's right to work in the United Kingdom, which involve identity documents. We use them only for that recruitment, on the client's behalf.

Visits. When we visit a workplace, we may take photographs to record what we saw. We photograph conditions rather than people wherever we can.

5 Training And Courses

If you attend a course or training session we run, we hold your name, your employer, your attendance and, where there is one, your assessment result, so that we can run the course, issue your certificate and confirm it later if asked, in our legitimate interest, and that of whoever booked the course, in delivering it properly. Where a course is accredited, we give the awarding body the details it needs to register you and issue your certificate, and its own policy then applies. If you tell us about a health need so that we can make an adjustment for you, we use it only for that, with your agreement.

6 Enquiries, Quotes And Referrals

When you contact us through our website, by email, telephone, social media or in person, or when a client or contact refers you to us, we hold your name, how to reach you, what you have told us about your business and the help you are looking for, and, if we give you a quote, the quote and our notes. We use this to answer you and, if you ask, to give you a quote and follow it up, in our legitimate interest in winning work and yours in getting an answer. If you were referred to us, we will tell you who referred you the first time we contact you. If you ask Achieving Clarity Ltd about our services, it may pass your enquiry to us, and we may pass it an enquiry about its services, so that the right company can answer you. We hold your details for no longer than twelve months after our last contact unless you become a client, and if you ask us not to contact you again, we stop.

7 Our Website And Social Media

Our website, www.actnow.solutions, is hosted for us by Netlify, Inc. Like any website, its servers record technical details of each visit, such as the internet address of your device and the page it asked for, so that the page can be delivered and the site kept secure, in our legitimate interest in running a safe website. The website sets no cookies and uses no analytics, and everything it shows, including its fonts and images, comes from the website itself rather than from other companies.

The contact form. It asks for your name and email address and, if you wish, your business name, your telephone number, the help you are looking for and your message. Netlify checks each message for spam, sends it to us by email and keeps a copy in our account, which we delete within 30 days; we then handle your message as section 6 describes. Please leave personal details about other people, such as an employee's health, out of the form: we will talk those through with you properly. If you follow a link from our website to another site, that site has its own policy.

Social media and reviews. If you interact with our pages on social media, or review us on Google or another platform, the platform handles your information under its own policy. For the statistics some platforms give us about visits to our pages, we and the platform are joint controllers, under terms the platform publishes; we see those statistics only in aggregate and never identify individuals from them. We may reply to a review in public, and we never reveal anything about our work for anyone in a reply.

8 Suppliers And Other Organisations

If you work for a supplier, a training venue, an awarding body, a software company, a professional adviser, a public body or any other organisation we deal with, we hold your name, your role, your contact details and our correspondence with you, in our legitimate interest in running our business and in yours in dealing with us. We keep it for as long as the relationship lasts and for six years afterwards where the correspondence relates to a contract.

9 People Who Apply To Work With Us

When you apply for a role with us, we hold your application, your curriculum vitae, the notes of any interview, the references we take with your agreement, and the documents the law requires us to check before you can start, such as your right to work in the United Kingdom. We use them to decide whether to offer you the role, in our legitimate interest in recruiting well and in the steps that lead to a contract of employment, and to meet our legal duties. If you join us, your application becomes part of your staff record. If you do not, we keep it for twelve months from our decision, so that we can answer any question about the process, and then delete it. We do not use automated screening, and we ask about your health only where we need to make adjustments for you, and then with your permission.

10 Our Team

Our team receive a fuller Staff Privacy Notice when they join. In short: we hold what we need to employ, pay and look after our people and to meet our duties as an employer; our systems record what each person does in them, for the security of our clients' information, so that any mistake can be found and put right and any misuse looked into, and not to measure anyone's performance; and nothing is shared outside the firm except with HMRC, our pension provider, our insurers and others the law or the employment requires. Some of the people who work with us are employed by Achieving Clarity Ltd, and the same notice covers them.

11 Keeping In Touch

We write to our clients about changes in employment and health and safety law, and about our services that we think will help them, because keeping them ahead of change is part of looking after them, and we rely on our legitimate interest in doing so. Every such message tells you how to stop receiving them, and one word to us is enough; we then keep a note of your request, so that you are not contacted again. We tell you about Achieving Clarity Ltd's services only if you have asked us to. We do not send marketing to anyone who is not a client or contact of ours, and we never pass anyone's details to another organisation for its marketing. Where the law requires your consent before we send you such messages, we ask for it first, and you may withdraw it at any time.

12 Our Systems And Artificial Intelligence

We keep client records in PRISM, the practice management system that Achieving Clarity Ltd built and runs for both companies, which is held in the United Kingdom, in London, on infrastructure provided by Supabase and Vercel. Access to it is limited to the people who need it, and every change is recorded against the person who made it. Our documents are kept in Microsoft 365, stored in the United Kingdom, and some of our working files and messages are held in Google Workspace and Dropbox. Where you ask us to use your own systems, such as your email, diary or software, we keep the access details secure, use them only for the work you have asked us to do, and stop using them when that work ends. Software we arrange for you, such as a human resources or health and safety system, is provided under its maker's own terms and policy.

We use artificial intelligence, provided by Anthropic, to help our team read documents, organise records, and prepare and check work. We use it only under a business contract that forbids Anthropic from using your information to train its models. Our team follows written rules on what may be shared with it: identifiers such as National Insurance numbers, Unique Taxpayer References, dates of birth, home addresses and bank details, and information about anyone's health, are kept out unless the work requires them and our data protection lead has approved their use. A member of our team checks everything it helps to produce, and nothing is issued, sent or decided without a person.

13 Who Else Sees Your Information

Only the people who need to. Within ACT Now, that is the members of our team working on the matter, including the people from Achieving Clarity Ltd who work with us; each sees only what their role needs, and our systems record what they do.

Outside it, your information goes to Achieving Clarity Ltd, which provides people and systems to us and carries out our finance and accounting work, on our behalf and under a written agreement, and with which we share whether fees are overdue, as section 3 explains; to the companies that run our systems and the software we use, each of which processes it for us under a written contract that binds it to our instructions and to keeping it secure; to the public bodies we deal with on your behalf, such as the Health and Safety Executive, Acas, an employment tribunal, HMRC, Companies House, the Pensions Regulator and, where we run a payroll, pension providers; to the awarding body for a course that leads to its certificate; to witnesses and others involved in a matter, where that is a necessary part of the work our client has asked us to do, such as sharing an investigation report with the person it concerns; to the emergency services or an authority, where we reasonably believe it is necessary to prevent a serious risk to someone's health or safety; to our professional advisers, insurers, professional bodies and regulators, and to anyone reviewing the quality of our work under a duty of confidence, if we need them or they ask; to anyone who has guaranteed a client's fees; to debt recovery agents, such as our partner Federal Management, solicitors and the courts, if we have to recover money owed to us or bring or defend a legal claim, and to anyone to whom we transfer a debt; to a prospective buyer of our business who has agreed to keep it confidential, and to any business that takes ours over, which would then be responsible for your information; and to anyone else only when you ask us to, or when the law requires it.

The main companies that process information for us are Achieving Clarity Ltd, Supabase, Vercel, Microsoft, Google, Dropbox, Anthropic, PandaDoc, Cognito Forms, Netlify and Xero, and, for finance and accounting work, IRIS and Bright. A full list, with where each one processes information, is available on request.

Information outside the United Kingdom. Some of these companies store information or provide support outside the United Kingdom, including in the European Union, the United States, India, Australia and New Zealand. Where they do, we require one of the safeguards UK law recognises, such as adequacy regulations made by the United Kingdom, the UK Extension to the EU-US Data Privacy Framework, the International Data Transfer Agreement, or the International Data Transfer Addendum to the European Union's standard contractual clauses. You can ask us which safeguard applies to any of them, and for a copy of it.

14 How Long We Keep It

We keep personal information for as long as the law and our work require, and no longer. The accounting records below apply only where a package includes finance or accounting.

Our health and safety records, including the notes and photographs behind them, are kept longer than the rest because a claim about an injury or an illness can be made many years after the event. Where a claim or dispute is in prospect, an authority asks us to, or another law requires a longer period, we keep the records for as long as that requires. Records we keep for a client as its processor, such as its staff records and payroll, are returned to the client or deleted when that work ends, except anything the law requires us to keep. When a period ends, we dispose of the personal information securely.

15 How We Keep It Safe

We protect personal information with security measures appropriate to the risk: encryption; multi-factor sign-in to our systems; access limited to each person's role, so that information about health, conduct and other sensitive matters is seen only by the people working on that matter; a full record of who did what in our practice management system; devices that are kept up to date; backups of our records; and a team briefed on handling personal information and on recognising attempts to trick them into releasing it. No system is immune from every risk, and we keep our measures under review. If something goes wrong with your information, we will act at once to contain it, report it to the Information Commission where the law requires, and tell you without undue delay where it puts you at high risk. Where we hold your information for one of our clients as its processor, we tell that client without undue delay, so that it can do what the law requires of it.

16 Your Rights

You may ask us for a copy of the personal information we hold about you; to correct anything that is wrong; to delete what we no longer need to keep; to restrict what we do with it; and to give you the information you provided to us in a form you can take elsewhere. You may object to our use of your information where we rely on our legitimate interests, and we will stop unless we can show compelling reasons to continue; you may object to marketing at any time, and we will always stop. Where we rely on your consent, you may withdraw it at any time, without affecting what we did before.

We will respond within one month, after a reasonable and proportionate search. Where a request is complex, or you make several, we may take up to two further months, and we will tell you why within the first month. If we need to confirm who you are, or need you to tell us more about what you are asking for, we will ask, and the time for our answer does not run while we wait for it. Where we hold your information for your employer as its processor, we pass your request to your employer and help it to answer. We may withhold information where the law allows, for example where releasing it would reveal information about someone else, such as a witness. We do not charge for a request unless it is manifestly unfounded or excessive. Where the law requires us to keep something, we will tell you which rule applies and when the information will go. These rights are the same whether or not you are our client.

17 Complaints

If you are unhappy with how we have handled your personal information, please tell us: by email to hello@actnow.solutions, by telephone on 01227 743345, by post to our registered office, or, if you are a client, through the complaints procedure in our Terms of Agreement. No form is needed. We will acknowledge your complaint within 30 days, look into it properly, and tell you, without undue delay, what we have found and what we have done.

You also have the right to complain to the Information Commission (the ICO) at any time, at ico.org.uk or on 0303 123 1113, though we hope you will give us the chance to put things right first.

18 About This Policy

This policy is information the law requires us to give you. It is not a contract, and it does not give you rights beyond those the law gives you, or take any away. Other organisations, such as Achieving Clarity Ltd for its own clients, HMRC, Companies House, banks, awarding bodies, social media platforms and the websites we link to, handle personal information under their own policies when they act on their own account, and they are responsible for what they do.

We review this policy every year and whenever we change how we work. The version on our website is always the current one, and the version number and date at the top tell you which one you are reading. If we make a change that matters to you, we will tell you.