Back to home

Use the quick links below to visit the section you require:

Privacy Notice - for our website visitors and email marketing recipients

We confirm that we will comply with the provisions of the UK GDPR  when processing personal data about you and your family and that we have appropriate security measures in place.

Johnston Carmichael LLP is the data controller. Our associated companies, Johnston Carmichael (Scotland) Limited and Johnston Carmichael Wealth Limited will also process personal data about you to the extent that this is required for performing the functions that you have asked us to carry out for you.

Johnston Carmichael LLP is committed to protecting the privacy of our website users and those who consent to receive marketing emails. This document explains how your personal data is processed fairly within the business in accordance with the UK GDPR.

Personal Data we collect

We may collect the following information from our website users.

  • Your visits and use of our website
  • Use of cookies
  • IP address,
  • location,
  • browser type,
  • referral source,
  • length of visit
  • number of page views

We additionally collect the following from those who subscribe to email marketing.

  • Name
  • Email address
  • Your consent to receive marketing emails

The purpose for collecting this information is for:

  • Information about the number of visitors and their use of the site will only be used for statistical purposes (in aggregate form) to improve our website’s usability and for marketing purposes.
  • Provision of newsletters and/or other Johnston Carmichael marketing materials
  • Registering and/or subscribing to our website service
  • Provision of other requested business information regarding our services

The Legal Basis for the processing

You have consented to receive marketing information from us and can remove this at any time.

Use of Cookies and Google Adwords

Cookies are used on this website. The use of cookies is now a standard operating procedure for most websites. If you are uncomfortable with the use of cookies, you will have the option to opt-out of receiving them; however, you may find other functionality in the site impaired. After termination of the visit to our site, you can always delete the cookie from your system. More information about cookies can be obtained at www.aboutcookies.org or www.allaboutcookies.org.

We use Google AdWords remarketing service to advertise on third party websites (including Google) to previous visitors of our site.

Third-party vendors, including Google, use cookies to serve ads based on a user’s past visit to the Johnston Carmichael site.

It could mean that we advertise to previous visitors who have viewed specific pages during an initial visit to the site. Ads may be shown on the Google search results page, or as banner ads appearing on a site on the Google Display Network. Of course, any data collected will be used in accordance with this privacy policy as well as Google’s.

You can set preferences for how Google advertises to you using the Google Ad Preferences page and you can opt out of third party vendor’s use of cookies by visiting the Network Advertising Initiative opt out page.

The Recipients of personal data

Information provided by you will be stored securely, kept strictly confidential, and will not be disclosed to any third party without your explicit consent, with the following exceptions:

In order to give you the information and advice that you require we may need to disclose your information to regulatory authorities.
Our compliance advisers, auditors, and our regulatory body may require us to disclose certain client details to them in the normal course of their duties.
The hosting of our web site, and of associated client data, is carried out by Whitespace. Whitespace only process this information to provide the functionality of the web site.
We use Campaign Master to manage our email marketing campaigns and to record your consent.

We will not transfer your data out with the European Economic Area.

Only members of the marketing team have access to the data which they require to carry out their job function.

Your Rights

We will retain your personal data until you inform us you wish to remove consent. You can remove consent by emailing dpo@jcca.co.uk or unsubscribing in the footer of the email.
You have a right to apply for a copy of your information; to have any inaccuracies corrected and restrict processing of it.
In certain circumstances you have a right to have your personal data erased, subject to legal and regulatory compliance and crime prevention.
You have a right to data portability: to obtain a copy of the data you provided us, held digitally, in a form that allows you to transfer it to another data controller.
You have the right to complain about the processing of your personal data and in the first instance please send any concerns you have to our Data Protection Officer via dpo@jcca.co.uk and we will do our best to help you.  If you are still unsatisfied you have the right to complain to the Information Commissioner’s Office.  Contact details can be found at www.ico.org.uk

 

Privacy Notice - for contacts and clients we engage with

We confirm that we will comply with the provisions of the UK GDPR when processing personal data about you and your family and that we have appropriate security measures in place.

Johnston Carmichael LLP is the data controller. Our associated companies, Johnston Carmichael (Scotland) Limited and Johnston Carmichael Wealth Limited will also process personal data about you to the extent that this is required for performing the functions that you have asked us to carry out for you.

We will process your personal data in order to provide you with the services you have requested and to comply with our legal and regulatory obligations. We obtain this personal data from yourself or other regulatory bodies.

In order to carry out the terms of this engagement you agree to provide us with your personal information and understand that failure to do so will negatively impact the services we provide.

We will also process your personal data for management and analysis purposes.

Any personal data we hold on you or your family will be stored securely on our systems for a period of time defined by our internal data retention policies. Generally, this will be for the duration of our engagement with you and thereafter for as long as is required by the law.

You will receive relevant updates from us, as part of our service offering on issues that may affect you or your business.

Your personal data may be processed by third parties for the purposes of:

  • Secure document storage and disposal
  • Specialist financial analysis
  • Cyber security and managed end point detection

As part of our client identity verification process, Johnston Carmichael LLP employs third party suppliers to provide services including utilising the services of  credit reference agencies such as Experian or Transunion  (https://www.transunion.co.uk/legal-information/bureau-privacy-notice).  A record of these searches will be retained.

In relation to these organisations, we have in place a written contract which only permits them to use your data for specified purposes and in accordance with our instructions. The contract also requires that the organisation has in place appropriate security measures in relation to your personal data which are in line with our policies.

Unless you have already informed us not to do so, we may contact you occasionally by mail or e-mail to share news and insights, invite you to events, or tell you about products or services we think you will find useful. To unsubscribe from receiving such communications, or to tailor your preferences, email dpo@jcca.co.uk, or click the unsubscribe link in the email you receive.

You have a right to apply for a copy of your information; to have any inaccuracies corrected and restrict processing of it. In certain circumstances you have a right to have your personal data erased, subject to legal and regulatory compliance and crime prevention. You have a right to data portability: to obtain a copy of the data you provided us, held digitally, in a form that allows you to transfer it to another data controller. You have the right to complain about the processing of your personal data and in the first instance please send any concerns you have to our Data Protection Officer via dpo@jcca.co.uk and we will do our best to help you.  If you are still unsatisfied you have the right to complain to the Information Commissioner’s Office.  Contact details can be found at www.ico.org.uk.

GDPR Article 28 Notice of addition or changes to “Sub-Processors”

At least 30 days before we engage a new sub-processor we will publish their details below.  If you object in good faith to the appointment of the processor, we will work with you to consider how we may provide our services without using them.

We currently use the following sub-processors:

Cloud: 

  • ApprovalMax - Software application to manage the creation and approval of purchase ordersAVEPOINT - Email and office 365 backup solution
  • Campaign Master - An online email marketing campaign management solution
  • Cashflow Manager - We to process clients back ups in order to access their accounting data and to produce reports
  • Castaway - This is a software solution which provides cashflow forecasting and business modelling
  • CCH Accounts Production - This system is an accounts production platform
  • Chaser - Solution designed to assist with client communications and debt management
  • Company Secretarial - This system is used to manage our Company Secretarial clients, housing statutory records and pulling company, officer and shareholder information from Companies House
  • Croner-I - Accounting, auditing and company law regulations / disclosure checklists
  • Dext precision - Data health check application which links to cloud accounting products like Xero and QuickBooks Online
  • Dext prepare - Data capture tool to automate data entry, for example bank statements and invoice processing
  • Dropbox - File sharing platform used for clients who require it
  • Egress Protect - We outsource the encryption of email. All cloud based systems are based in the UK
  • Farmplan
  • Fathom - Management report, forecasting and consolidation software
  • Float - Cash flow forecasting software
  • FreshService - Service desk application
  • GlassCubes - A secure web portal allowing us to share documents and collaborate with you
  • Hellosign - Cloud based software to apply digital signatures to documents
  • Highlander International Shredding - for secure on site destruction of paperwork
  • HRUX - This system provides an electronic organiser and calendar capability for specific areas of our business and so may include contact information
  • HubDoc - Data capture tool to automate data entry, for example bank statements and invoice processing
  • Iris - ePayslips - provides businesses with the ability to deliver online payslips
  • iTrent - This is our HR Information System which contains all employee records, payslips, professional learning logs etc.
  • Microsoft Office 365 E3 - We use an EEA data centre to host our email system and other communication and collaboration systems on the Office 365 platform
  • Microsoft Outlook
  • Microsoft PowerBI - we use this Microsoft platform, which has access to data from several other listed systems, to delivery reports into our business
  • Microsoft SharePoint - We use this system to manage documents on client work, which may include personal details
  • Microsoft Teams - Cloud based collaboration platform used both internally and externally
  • Move my books
  • Paycircle Payroll Software - This is a cloud based payroll system hosted in the UK
  • Paygate (BACS Provider) - System used to transmit payroll payments using BACS
  • QuickBooks Online - Cloud accounting software
  • Retain Planner
  • Reward gateway - This is our employee benefits platform. It includes access to our Employee Assistance Programme (counselling/mental health support), our Holiday Purchase Scheme, and a range of other benefits.
  • Sage Business Cloud Accounting - Cloud accounting software
  • Schedule-IT - this system provides scheduling capabilities for specific areas of our business and so may include contact information
  • Silverfin - This is a cloud based platform we use for completing working papers and accounts production for all non-audit clients.
  • Smart Search - Anti Money Laundering search service
  • Teammate - TeamMate is an excel Add-in from WolterKlulers which is used by the Audit Department to perform analytics over entity ledger information.
  • Trickle - A cloud based platform used to collate team feedback and track engagement
  • Veritas - Email archiving platform
  • Xero - Cloud accounting software
  • XPlan
  • ZOHO - CRM software allowing us to track our business development pipeline across clients, targets and partnerships.

Local Application:

  • Alphatax - This as a corporate tax software used to create corporate tax computations and submit to HMRC
  • BigHand - We use this software for digital dictation of written materials like letters, etc.
  • CCH Audit Automation - This Audit software is used to produce and complete various checklists
  • CCH Central - we use this system to manage documents on client work, which may include personal details
  • Data Warehouse (SQL Server) - We use this system to perform data anlytics across our internal systems as well as provide internal reporting
  • GP Accounts - This software is used by our doctor clients, allowing us to generate reports from client data backups
  • IDEA - Caseware IDEA is a data analytics platform for the interrogation, conversion, analysis of client entity data sets along with the automation of these processes for repetitive application.
  • IPS Turnkey
  • Iris Payroll - We run a bureau system with the data held on our IT systems. There is a cloud based component based in the UK, used for storing e-payslips.
  • Landmark (Farmdata) - Farm and Estate management software, including accounts, property, crop and cattle management
  • Sage (Payroll) - We occasionally share backup data for support purposes
  • UIPath - this platform automates data processing tasks for payroll data
  • Wolters Kluwer Oneclick - This organisation hosts a secure client portal allowing us to confidentially share documents with yourself. The client portal is based in the EEA

Security:

  • Cybereason - Cyber security and managed end point detection
  • Mimecast

Service:

  • Datamatics - Cloud based suppliers who provide various services to support tax and accounting professionals
  • Datamolino - Data capture tool to automate data entry and invoice processing
  • Stone Group - Recycling of old IT equipment in a secure and environmentally safe manner

Privacy Notice - for Recruitment

We confirm that we will comply with the provisions of the UK GDPR  when processing personal data about you and that we have appropriate security measures in place.

Johnston Carmichael LLP is the data controller.  Our associated companies, Johnston Carmichael (Scotland) Limited and Johnston Carmichael Wealth Limited will also process personal data about you to the extent that this is required for our candidate application and recruitment process.

We will process your personal data in order to manage your application.  The categories of personal data are set out below.  We will only process personal data which is necessary for the purposes of progressing your application or as required by law or regulatory requirements.

  • Application: CV details including but not limited to name, address, employment history, academic and professional qualifications and references
  • Assessment: Interview assessments including technical assessments

As part of the application process you agree to provide us with your personal information and understand that failure to do so will negatively impact that process.

During the recruitment process we may also capture some special category personal information about you, for example if you have any disabilities. This is necessary to ensure that we can make reasonable provisions for you regarding the interview process.

Any personal data we hold on you will be stored securely on our systems for a period of time defined by our internal data retention policies.  Generally, this will be for the duration of the application process.

Your personal data may be processed by third parties for the purposes of managing the application process.  In relation to these organisations, we have in place a written contract which only permits them to use your data for specified purposes and in accordance with our instructions.  The contract also requires that the organisation has in place appropriate security measures in relation to your personal data which are in line with our policies.

You have a right to apply for a copy of your information; to have any inaccuracies corrected and restrict processing of it. In certain circumstances you have a right to have your personal data erased, subject to legal and regulatory compliance and crime prevention.  You have a right to data portability: to obtain a copy of the data you provided us, held digitally, in a form that allows you to transfer it to another data controller.  You have the right to complain about the processing of your personal data and in the first instance please send any concerns you have to our Data Protection Officer via dpo@jcca.co.uk and we will do our best to help you.  If you are still unsatisfied you have the right to complain to the Information Commissioner’s Office.  Contact details can be found at www.ico.org.uk.

GDPR Article 28 Notice of addition or changes to “Sub-Processors”

At least 30 days before we engage a new sub-processor we will publish their details below.  If you object in good faith to the appointment of the processor, we will work with you to consider how we may provide our services without using them.

We currently use the following sub-processors:

  • 01/12/2020 TestPartnership –Provide testing for some candidates who apply for positions with us

Privacy Policy for Restructuring assignments

We confirm that we will comply with the provisions of the UK GDPR  when processing personal data in relation to the administration of the insolvent estate, and that we have appropriate security measures in place.

Our Insolvency Practitioners are the data controllers only for the personal data that they are required to collect and process in order to meet their legal/regulatory obligations. For the processing of all other personal data the estate in administration will remain the data controller. In order to administer the insolvent estate we may have access to personal data and we will process, use and disclose personal data about you as is necessary to comply with the statutory requirements of the formal insolvency appointment, in accordance with the relevant insolvency legislation and associated guidance. Any personal data we hold on you will be stored securely on our systems for a period of time defined by our internal data retention policies.

Your personal data may be processed by third parties for the purposes of secure document storage and disposal. We take steps to ensure that these organisations are also looking after your data securely.

In relation to these organisations, we have in place a written contract which only permits them to use your data for specified purposes and in accordance with our instructions. The contract also requires that the organisation has in place appropriate security measures in relation to your personal data which are in line with our policies.

You have a right to apply for a copy of your information, to have any inaccuracies corrected and restrict processing of it. You have a right to have your personal data erased, subject to legal and regulatory compliance and crime prevention. You have a right to data portability, obtaining a copy of your data in a commonly used machine readable format where technically possible. You have the right to complain about the processing of your personal data and in the first instance please send any concerns you have to our Data Protection Officer via dpo@jcca.co.uk. If you are still unsatisfied you have the right to complain to the Information Commissioner’s Office. Contact details can be found at www.ico.org.uk.

Privacy Notice - RBS Branch Review 

We confirm that we will comply with the provisions of the Data Protection Act 2018 and GDPR when processing personal data about you and have appropriate security measures in place.

If you have not provided us with your contact details we will record your “IP Address” along with any feedback you may give us, to process and use your personal data to help us with our engagement with the Royal Bank of Scotland.

If you have provided us with your contact details and given us consent to contact you, we will process and use your personal data to help us with our engagement with the Royal Bank of Scotland. Johnston Carmichael LLP is the “Controller”. Our associated company, Johnston Carmichael (Scotland) Limited will also process personal data about you.

Any personal data we hold on you will be stored securely on our systems for a period of time defined by our internal data retention policies. Generally this will be for the period of the engagement which we envisage to last 3 months.

Your personal data will also be processed by a third party at the point of information collection for the purposes of hosting our website.

In relation to this organisation, we have in place a written contract which only permits them to use your data for specified purposes and in accordance with our instructions. The contract also requires that the organisation has in place appropriate security measures in relation to your personal data which are in line with our policies.

You have a right to apply for a copy of your information; to have any inaccuracies corrected and restrict processing of it. In certain circumstances you have a right to have your personal data erased, subject to legal and regulatory compliance and crime prevention. You have a right to data portability: to obtain a copy of the data you provided us, held digitally, in a form that allows you to transfer it to another data controller. You have the right to complain about the processing of your personal data and in the first instance please send any concerns you have to our Data Protection Officer via dpo@jcca.co.uk and we will do our best to help you.  If you are still unsatisfied you have the right to complain to the Information Commissioner’s Office.  Contact details can be found at www.ico.org.uk.