Apteus Group Privacy Notice
How the Apteus Group and all of its companies collect, use and protect your personal data, in accordance with the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and ICO guidance.
Contents
1. About us and the purpose of this notice
2. The personal data we collect
3. Where we obtain your data (including from third parties)
4. How and why we use your data (lawful bases)
5. Who we share your data with
6. International transfers
7. How long we keep your data
8. Your rights
9. Automated decision-making and profiling
10. Direct marketing, cookies and PECR
11. How we protect your data
12. Complaints and how to contact us
13. Changes to this notice
Appendix — Apteus Group companies covered by this notice
1. About us and the purpose of this notice
This notice is issued for the whole of the Apteus Group. It applies to Apteus Holdings Limited (company number 16773949) and to every company, subsidiary, business unit and trading name within the Apteus Group, without exception (together “Apteus”, “the Apteus Group”, “we”, “us”, “our”). The Apteus Group is an ICAEW-regulated audit, accountancy and professional services group. A full list of the group companies to which this notice applies is set out in the Appendix, and it also applies to any business that joins the group in future from the date it joins.
The group includes our statutory audit business, Apteus Audit Limited (company number 16775133), and our regional and specialist businesses, which continue to serve clients under both the Apteus name and established local practice names — including Farries, Kirk & McVean, Hodge Bakshi, Richard Anthony, Lawrence Grant, DSA Prospect, and FTS Recovery. This notice covers all of them.
It explains how we look after your personal data, your privacy rights, and how the law protects you. It applies to clients and prospective clients, individuals connected to our clients (such as their directors, owners, employees and beneficial owners), our own staff and applicants, suppliers and other business contacts, and visitors to our websites.
Who is the controller?
Each Apteus Group company that decides how and why your personal data is processed is a data controller in its own right for that processing. Depending on the services you receive, one or more Apteus Group companies may act as controller, and in some cases group companies act as joint controllers — for example where client, relationship and compliance information is shared and managed centrally across the group. Where companies act as joint controllers we have agreed, in a transparent way, which company is responsible for which obligations, and you may exercise your rights against, and contact, any of them. Where we carry out certain client work under your instruction (for example payroll or bookkeeping) an Apteus company may act as a data processor.
Across the whole group we apply a single, consistent data protection standard, so your personal data receives the same protection wherever within Apteus it is held, and this notice applies to that processing uniformly and without exception.
We have appointed the Head of Risk and Compliance, Apteus Group as the Group Data Protection Point of Contact, who is responsible for enquiries in relation to this notice on behalf of all group companies. The Apteus Group companies are each registered with the Information Commissioner’s Office (ICO) and pay the data protection fee as required. In this notice, “data protection law” means the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations 2003 (PECR), and related ICO codes and guidance.
2. The personal data we collect
As an audit and multidisciplinary professional services group, we routinely process sensitive personal data. Depending on your relationship with us and the Apteus company providing your service, we may collect and use the following categories:
- Identity and contact data — name, title, date of birth, National Insurance number, Unique Taxpayer Reference, address, email and telephone.
- Financial and transactional data — tax, payroll, accounting, banking, source-of-funds and source-of-wealth information.
- Identification and verification data — passport, driving licence and other ID collected for anti-money-laundering (AML) and client due diligence.
- Employment and HR data — for staff and applicants, including recruitment, payroll, training and right-to-work records.
- Technical and usage data — IP address, device and browsing information collected via our websites and systems.
- Special category and criminal-offence data — for example health data within payroll, and AML criminal-offence data, processed only under a valid Article 9/10 condition and an Appropriate Policy Document.
Do you have to provide it?
Where we need your personal data to comply with a legal or regulatory obligation (for example AML identity checks) or to perform a contract with you or your organisation, and you do not provide it, we may be unable to act for you, to accept you as a client, or to continue to provide our services.
3. Where we obtain your data (including from third parties)
We collect most personal data directly from you — for example when you enquire about or engage our services, correspond with us, complete our onboarding and AML checks, apply for a role, or use our websites. We also lawfully obtain personal data from other sources, including:
- our clients and the businesses we act for (for example information about their directors, owners, employees, customers and suppliers, provided to us so that we can deliver audit, accountancy, tax, payroll and advisory services);
- other Apteus Group companies, so that the right expertise from across the group can be brought to your work;
- publicly available and official sources such as Companies House, HM Land Registry, the electoral roll and sanctions and PEP screening tools; and
- credit reference, identity-verification and AML service providers, banks, and your professional advisers or previous accountants.
Where we receive your personal data from a source other than you, we handle it in accordance with this notice, which serves as the information we are required to give you under Article 14 of the UK GDPR.
4. How and why we use your data (lawful bases)
We only use your personal data when the law allows us to. In most cases we rely on one or more of the following lawful bases, which mirror those in our group Data Protection Policy:
Lawful basis: Contract
When we rely on it: To provide the services you or your organisation have engaged any Apteus Group company for, and to take steps at your request before entering into a contract.
Lawful basis: Legal obligation
When we rely on it: To meet HMRC, Companies Act, statutory audit, anti-money-laundering and identity-verification requirements.
Lawful basis: Legitimate interests
When we rely on it: For practice and relationship management across the group, business development, network administration and fraud prevention, where not overridden by your rights.
Lawful basis: Consent
When we rely on it: For optional marketing and communications, which you can withdraw at any time.
Lawful basis: Special category / criminal-offence condition
When we rely on it: For payroll health data and AML criminal-offence data, under the relevant Article 9/10 condition and an Appropriate Policy Document.
5. Who we share your data with
We do not sell your personal data. We may share it, where necessary and lawful, with:
- other companies within the Apteus Group (so we can bring the right expertise from across the group to your work, manage our relationship with you and meet our shared legal and regulatory obligations);
- our professional advisers and subcontractors acting as processors;
- HMRC, Companies House, the ICAEW and other regulators and supervisory bodies;
- banks, insurers and payment providers; and
- law enforcement or other authorities where we are legally required to do so.
We may also disclose personal data in connection with the sale, purchase, restructuring or financing of any part of the group. Where we engage a data processor, we put a written contract in place requiring them to protect your data and act only on our instructions. Sharing between Apteus Group companies is carried out under the group’s common data protection standard and only where there is a lawful basis to do so.
6. International transfers
We aim to keep your personal data within the UK. Where any transfer outside the UK is necessary (for example a cloud provider, or access by an Apteus Group company or team located outside the UK), we ensure an appropriate safeguard is in place, such as a UK adequacy regulation or the International Data Transfer Agreement / Addendum, so that your data receives an equivalent level of protection.
7. How long we keep your data
We keep your personal data only for as long as necessary to fulfil the purposes for which it was collected, to meet our legal, regulatory and professional obligations, and to support the establishment or defence of legal claims. Retention periods are governed by our group Records Retention Policy; the table below summarises the key periods. Where record types conflict, the longer statutory or professional requirement applies.
Record category: Company formation & acquisition documents
Retention period: Permanent
Basis: Companies Act 2006
Record category: Engagement letters / working papers (audit, tax, advisory)
Retention period: 6 years after engagement end
Basis: ICAEW/ACCA guidance; Limitation Act 1980
Record category: Audit files and working papers
Retention period: 6 years from the date of the auditor's report
Basis: Audit Regulations reg 3.11; ISQM (UK) 1
Record category: Accounts, ledgers, VAT and tax return files
Retention period: 6 years after year end / filing
Basis: HMRC; Companies Act 2006
Record category: KYC / AML customer due diligence records
Retention period: 5 years after the relationship ends
Basis: Money Laundering Regs 2017
Record category: Personnel files
Retention period: 6 years after employment ends
Basis: Employment claims
Record category: Right to work checks
Retention period: 2 years after employment ends
Basis: Home Office rules
Record category: CCTV footage
Retention period: 30 days
Basis: ICO CCTV guidance
Record category: Marketing consent records
Retention period: For as long as consent is valid
Basis:UK GDPR / PECR
8. Your rights
Under data protection law you have the following rights, which you can exercise free of charge in most cases:
- The right to be informed about how we use your data.
- The right of access to a copy of your data (a Subject Access Request).
- The right to rectification of inaccurate or incomplete data.
- The right to erasure in certain circumstances.
- The right to restrict or object to processing.
- The right to data portability.
- The right to withdraw consent at any time where we rely on consent.
- Rights relating to automated decision-making and profiling (see section 9).
We will respond to any request within one calendar month (extendable by two months for complex or numerous requests, with notice). You can exercise these rights in respect of any Apteus Group company by contacting our Group Data Protection Point of Contact using the details below — you do not need to identify which company holds your data.
9. Automated decision-making and profiling
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. We may use automated tools to support AML screening, risk assessment and fraud prevention, but a member of our team reviews the outcome before any significant decision is taken. If this changes, we will update this notice and tell you about the logic involved and the significance and consequences of such processing.
10. Direct marketing, cookies and PECR
Where we send you marketing communications we do so in accordance with PECR and the UK GDPR, and you can opt out at any time using the unsubscribe link or by contacting us. Our websites use cookies and similar technologies; non-essential cookies are only set with your consent, and you can manage your preferences through your browser or our cookie settings.
11. How we protect your data
We have appropriate technical and organisational measures in place across the group to keep your personal data secure, to prevent it being accidentally lost, used or accessed in an unauthorised way, and to detect and manage personal data breaches. Access is limited to those who need it, and our people are subject to a duty of confidentiality. These measures are set out in our group Information Security Policy and Data Protection Policy and apply to every Apteus Group company without exception.
12. Complaints and how to contact us
If you have any questions about this notice, or wish to exercise your rights in relation to any Apteus Group company, please contact our Group Data Protection Point of Contact:
Head of Risk and Compliance, Apteus Group
Apteus Audit Limited, First Floor, 1 Des Roches Square, Witan Way, Witney OX28 4BE
Email: dataprotection@apteusgroup.com
We would welcome the opportunity to resolve any concern you may have. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at www.ico.org.uk or on 0303 123 1113, although we would ask that you contact us first.
13. Changes to this notice
We keep this notice under regular review and will update it where our practices change, where new companies join the Apteus Group, or where the law or ICO guidance requires. This notice will be reviewed annually, or sooner if data protection law changes. This version is effective from 1 October 2026.
Appendix — Apteus Group companies covered by this notice
This notice applies to Apteus Holdings Limited and all of the following companies, together with every other current and future subsidiary, business unit and trading name of the Apteus Group, without exception. Company numbers are shown where confirmed; “—” indicates a number that is pending or to be confirmed.
Apteus Group company:
Company number:
Practice / business it operates (where applicable):
Apteus Group company: Apteus Holdings Ltd
Company number: 16773949
Practice / business it operates (where applicable): Group holding company
Apteus Group company: Apteus Midco 1 Ltd
Company number: 16774297
Practice / business it operates (where applicable): Intermediate holding company
Apteus Group company: Apteus Midco 2 Ltd
Company number: 16774581
Practice / business it operates (where applicable): Intermediate holding company
Apteus Group company: Apteus Group Ltd
Company number: 16774985
Practice / business it operates (where applicable): Group operating company
Apteus Group company: Apteus Audit Ltd
Company number: 16775133
Practice / business it operates (where applicable): Audit
Apteus Group company: Apteus London Ltd
Company number: 16821152
Practice / business it operates (where applicable): Richard Anthony; Lawrence Grant
Apteus Group company: Apteus Caledonia Ltd
Company number: 17048294
Practice / business it operates (where applicable): Farries, Kirk & McVean (FK&M)
Apteus Group company: Apteus Wales Ltd
Company number: 16821018
Practice / business it operates (where applicable): Hodge Bakshi
Apteus Group company: Apteus Recovery Ltd
Company number: 17048222
Practice / business it operates (where applicable): FTS Recovery
Apteus Group company: Apteus Oxfordshire Ltd
Company number: 17312860
Practice / business it operates (where applicable): DSA Prospect
Trading / practice names in use across the group include: Farries, Kirk & McVean (FK&M), Hodge Bakshi, Richard Anthony, Lawrence Grant, DSA Prospect, and FTS Recovery. Any business or trading name that becomes part of the Apteus Group is automatically covered by this notice from the date it joins.