Privacy & Cookie Policy

Introduction
This Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed
by us. Please read the following carefully to understand our views and practices regarding your personal data and how
we will treat it.

The rules on processing of personal data are set out in the General Data Protection Regulation (EU 2016/679 (the
“GDPR”).

1. Definitions
Data controller – A controller determines the purposes and means of processing personal data.
Data processor – A processor is responsible for processing personal data on behalf of a controller.
 – Natural person.
Categories of date: Personal data and special categories of personal data
Personal data – The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person (as
explained in Article 6 of GDPR). For example, name, passport number, National Insurance number, home address, or
private email address. Online identifiers include IP addresses and cookies.
Special categories personal data – The GDPR refers to sensitive personal data as ‘special categories of personal data’ (as
explained in Article 9 of GDPR). The special categories specifically include genetic date and biometric data where
processed to uniquely identify an individual. Other examples include racial and ethnic origin, sexual orientation, health
data, trade union membership, political opinions, religious, or philosophical beliefs.
Processing – means any operation or set operations, which is performed on personal data, or on sets of personal data,
whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation,
retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, or
combination, restriction, erasure, or destruction.
Third party – means a natural or legal person, public authority, agency, or body other than the data subject, controller,
processor and persons who, under the direct authority of the controller or processor, are authorised to process personal
data.
2. Who are we?
Rushtons Insolvency Limited, trading as Rushtons, company number 08905570, registered office at 6 Festival Building,
Ashley Lane, Saltaire, Shipley, West Yorkshire, BD17 7DQ is a data controller. This means we decide how your personal
data is processed and for what purposes.
Nicola Baker is licensed to act as an Insolvency Practitioner in the UK by the Institute of Chartered Accountants in England
and Wales, number 15852 and is a data controller and a data processor.
Nicola baker can be contacted at: -
Address: Rushtons Insolvency Limited
6 Festival Building
Ashley Lane
Saltaire
BD17 7DQ
Telephone: 01274 598585
Email: enquiries@rushtonsifs.co.uk
3. The purpose(s) of processing your personal data
We use your personal data for the following purposes: -

Nature of Work
Insolvency Practitioners.
Description of processing
The following is a broad description of the way Rushtons Insolvency Limited and Nicola Baker processes personal
information. To understand how your own personal information is processed you may need to refer to any personal
communications you have received, check any privacy notices published, or contact us directly to ask about your personal
circumstances.
Reasons/purposes for processing information
Your personal information is processed to enable us to carry out marketing activities and our work as insolvency
practitioners, which includes processing company data and practitioner data.
Type/classes of information processed
We process information relevant to the above reasons/purposes. This may include: -
• Personal details;
• Education and employment details;
• Goods or services;
• Financial details;
• Records of company data, which include all types of data necessary for the administration of the affairs of
insolvent companies, partnerships and individuals;
• Records of practitioner date, which include details of appointments;
• Records under the Company Directors Disqualification Act 1986;
• Employees’ claims under the Employment Rights Act 1996 and associated legislation;
• Details of dividends distributed to creditors.
We also process sensitive classes of information that may include offences and alleged offences, criminal proceedings,
outcomes and sentences.
Who the information is processed about
We process personal information about: -
• Clients;
• Employees/staff of our clients
• Complainants;
• Enquiries;
• Professional advisers and consultants;
• Creditors;
• Company directors;
• Other individuals, or organisation belonging to the insolvent company, partnership or individual;
• Individuals necessary for the administration of the affairs of insolvent companies, partnerships and individuals.
Providing financial services and advice
Personal information is also processed in order to provide financial services and advice. For this reason, the information
processed may include name, contact details, family details, lifestyle and social circumstances, financial details, goods and
services and sensitive classes of information that may include physical or mental health details. This information may be
about clients, family and associates of clients, suppliers and enquirers. Where necessary or required this information may
be shared as detailed in this policy.
Undertaking research
Personal information is also processed in order to undertake research. For this reason, the information processed may
include name, contact details, family details, lifestyle and social circumstances, financial details, goods and services. The
sensitive types of information may include physical or mental health details, racial or ethnic origin and religious or other
beliefs. This information is about survey respondents. Where necessary or required this information may be shared as
detailed in this policy.

Consulting and advisory services
Information is processed for consultancy and advisory services that are offered. For this reason, the information
processed may include name, contact details, family details, financial details and the goods and services provided. Where
necessary this information may be shared as detailed in this policy.
4. The categories of personal data concerned
We have obtained your personal data from the records of the insolvent companies, partnerships and individuals which
you have provided to them. We may have also obtained your personal information from publicly accessible sources such
as social media or a personal or business-related website.
With reference to the categories of personal data described in the definitions section, we process the following categories
of your data: -
Personal data
The GDPR applies to ‘personal data’ meaning any information relating to an identifiable person, who can be directly or
indirectly identified in particular by reference to an identifier. This definition provides for a wide range of personal
identifiers to constitute personal data, including name, identification number(s), location data or online identifier,
reflecting changes in technology and the way organisations collect information about people.
The GDPR applies to both automated personal data and to manual filing systems where personal data are accessible
according to specific criteria. This could include chronologically ordered sets of manual records containing personal data.
Personal data that has been pseudonymised – e.g. key coded – can fall within the scope of the GDPR depending on how
difficult it is to attribute the pseudonym to a particular individual.
Sensitive personal data
The GDPR refers to sensitive personal data as ‘special categories of personal data’.
The special categories specifically include genetic data and biometric data where processed to uniquely identify an
individual. Personal data relating to criminal convictions and civil, or other offences are not included, but we consider this
data to be ‘sensitive’ and similar extra safeguards will be applied by us to its processing.
5. What is out legal basis for processing personal data?
Personal data (article 6 of GDPR)
Our lawful basis for processing your general personal data: -
.....................................................................................................................................................................................................................
Basis Reason for Processing
.....................................................................................................................................................................................................................
Consent of the data subject As provided for by past or present consent
arrangements. Such consent can be withdrawn
by the data subject at any time.

.............................................................................................................................................................................................................
Processing related to personal data Including information made publicly available

manifestly made public by the data through social media, personal or business-
subject related websites or similar medium.

.......................................................................................................................................................................................................................
Processing necessary for the performance In accordance with the terms of a Letter of
of a contract with the data subject or to take Engagement issued by Rushtons Insolvency
steps to enter a contact Limited.
.......................................................................................................................................................................................................................
Processing necessary for compliance with In accordance with Nicola Baker’s
a legal obligation role and duties as an Officer Holder appointed
under the provisions of The Insolvency Act 1986.
.......................................................................................................................................................................................................................
Processing necessary for the performance In accordance with Nicola Baker’s
of a task carried out in the public interest role and duties as an Office Holder appointed
or in the exercise of official authority under the provision of The Insolvency Act 1986.
vested in the controller
.......................................................................................................................................................................................................................
.......................................................................................................................................................................................................................

Processing necessary for the purposes of 1. In accordance with any ancillary activities
the legitimate interest, of the data controller relating to Nicola Baker’s role and
or a third party, except where such interest duties as an Office Holder appointed under the
are overridden by the interests or provisions of The Insolvency Act 1986;
fundamental rights or freedoms of the data
subject 2. In accordance with legitimate business
activities relating to Rushtons Insolvency
Limited including but not limited to the
promotion of services provided by Rushtons
Insolvency Limited.

.......................................................................................................................................................................................................................
Special categories of personal data (article 9 of GDPR)
Our lawful basis for processing your special categories of data: -
.......................................................................................................................................................................................................................
Basis Reason for Processing
.......................................................................................................................................................................................................................
Processing necessary for carrying out In accordance with Rushtons Insolvency
obligations under employment, social Limited’s role and duties as an Office Holder
security or social protection law, or a appointed under the provision of The Insolvency
collective agreement Act 1986.
.....................................................................................................................................................................................................................
Processing necessary to protect the vital 1. In accordance with Nicola Baker’s
interests of a data subject or another role and duties as an Office Holder
individual where the data subject is appointed under the provisions of The Insolvency
physically or legally incapable of giving Act 1986.
Consent

2. In accordance with the terms of a Letter of
Engagement issued by Rushtons Insolvency
Limited.

.......................................................................................................................................................................................................................
Processing relates to personal data Including information made publicly available
manifestly made public by the data through social media, personal or business -
subject related websites or similar medium.
.....................................................................................................................................................................................................................
Processing necessary for the establishment, 1. In accordance with Nicola Baker
exercise or defence of legal claims or where role and duties as an Office Holder
courts are acting in their judicial capacity appointed under the provisions of The Insolvency

Act 1986.
2. In accordance with the terms of a Letter of
Engagement issued by Rushtons Insolvency
Limited.

.......................................................................................................................................................................................................................
Processing necessary for reasons of In accordance with Nicola Baker’s
substantial public interest on the basis of role and duties as an Office Holder appointed
EU or Member State Law under the provisions of The Insolvency Act 1986.
.......................................................................................................................................................................................................................
6. Sharing your personal data
Your personal data will be treated as strictly confidential and will be shared only with the parties detailed in this policy.
There is sometimes a need to share the personal information processed with the individual themselves and also with
other organisations. Where this is necessary, we are required to comply with all aspects of the provisions of GDPR. What
follows is a description of the common types of organisations where we may need to share some of the personal
information, we process with for one or more reasons: -
Where necessary or required personal information is shared with: -
• Our clients;
• Business associates;
• Suppliers;
• Service providers;
• Enquirers;
• Professional advisers;

• Financial organisations;
• Debt collection and tracing agencies;
• Credit reference agencies;
• Creditors;
• Current, past or prospective employers;
• Local and central government;
• Anyone else where we have your consent.
We will never share your personal information with any third party where it does not relate to the nature of our work.
Where your data is shared on a non-work-related basis this is only done when we are required to do so by law.
7. How long do we keep your personal data?
We keep your personal data for no longer than reasonably necessary for the purposes of our work.
8. Providing us with your personal data
You are under no statutory or contractual requirement or obligation to provide us with your personal data for our
marketing purposes.
However, we do require your personal data in respect of our work as it is a legal, statutory or contractual requirement, or
a requirement necessary to enter into a contract.
9. Your rights and your personal data
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: -
• The right to request a copy of the personal date which we hold about you, subject to any fee specified by law;
• The right to request that we correct any personal data if it found to be inaccurate or out of date free of charge;
• The right to request your personal data is erased where it is no longer necessary to retain such data;
• The right to withdraw your consent to the processing at any time, where consent was the lawful basis for
processing the date;
• The right to request that we provide you with your personal data and where possible, to transmit that data
directly to another data controller, (known as the right to data portability), where applicable i.e. where the
processing is based on consent or is necessary for the performance of a contract with the date subject and where
the data controller processes the data by automated means;
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a
restriction is placed on further processing;
• The right to object to the processing of personal data, (where applicable i.e. where processing is based on
legitimate interest (or the performance of a task in the public interest/exercise of official authority); direct
marketing and processing for the purposes of scientific/historical research and statistics).
10. Transfer of Data Abroad
It may sometimes be necessary to transfer personal information overseas. When this is needed, information is shared
within the European Economic Area (EEA) or internationally, as required by law. Any transfers made will be in a full
compliance with all aspects of the provisions of GDPR.
11. Automated Decision Making
We do not use any form of automated decision making in our business, which utilises your personal data.
12. Further processing
If we wish to use your personal data for a new purpose, not covered by this Data Privacy Notice, then a new notice
explaining the new use will be published on our website prior to commencing the processing and setting out the relevant
purposes and processing conditions.
13. Changes to our privacy policy
Any changes we make to our privacy policy in the future will be forwarded by email. Please check back frequently to see
any updates or changes to our Privacy Policy.
14. How to make a complaint
To exercise all relevant rights, queries or complaints, please in the first instance contact our data processing officer Ivan
Mckenzie at imckenzie@rushtonsifs.co.uk.

If this does not resolve your complaint to your satisfaction, you have the right to lodge a complaint with the Information
Commissioners Office on 0303 123 1113, or at the Information Commissioner’s Office, Wycliffe House, Water Lane,
Wilmslow, Cheshire, SK9 5AF.