Privacy notice

1. Introduction

This privacy notice explains how personal data is used by:

• The Chartered Institute of Taxation (CIOT), www.tax.org.uk, registered charity number 1037771, ICO registration reference Z508268X
• The Association of Taxation Technicians (ATT), www.att.org.uk, registered charity number 241831, ICO registration reference Z6392732
• The Low Incomes Tax Reform Group (LITRG), www.litrg.org.uk, an initiative of the CIOT.

If you wish to contact us, or our Data Protection Officer, please use the contact form on this website or write to us at 30 Monck Street, London SW1P 2AP.

We will be data controllers if you:

Visit our website.

• Ask us a general question.
• Subscribe to events, media, emails or industry updates.
• Become a student sitting exams or apprenticeship End-Point assessments.
• Become a member.
• Become a colleague.
• Become a business contact.
• Attend our online event.

2. Details of our processing

2.1 If you visit our website

We will log your IP address and timestamped website interactions.

This information is used both to prevent and detect crime, and for our legitimate interest of managing website performance.

We also use Cookies on our websites. For further details, please see our cookie notice.

2.2 If you ask us a general question

We will use your contact details and information you provide, to establish our response and to provide a reasonable and appropriate response. We do this as a public task, under our Royal Charter.  

We ask that you do not send sensitive data, bank account data, usernames, passwords, or unnecessary personal data via chat forums or email for reasons of your own security.

2.3 If you subscribe to events, media, emails or industry updates

We will use the contact details and communication preferences you provide us with, to send information that we believe to be relevant, as a public task, under our Royal Charter.

We will process data about the status of email communications, as a legitimate business interest, to monitor their performance.

Subscribers can opt-out of general communications at any time.

2.4 If you become a student sitting exams or apprenticeship End-Point assessments

We will use your contact details to provide relevant industry updates.

If you subsequently apply or take exams, we will process your contact details, the exams you sat, your answers and your results. We do this as a public task, under our Royal Charter.

We will use identity documents you provide (e.g. passport) to manually verify your identity for exams. This is done to prevent/detect crime.

We will use medical or personal information you provide, with your explicit consent, to make appropriate adjustments when you are sitting exams or for special consideration in relation to your results if something happens to you shortly before or during your exam/s.

Students are asked to provide information on their gender when they create their record with us to help us deliver services and understand the composition of the tax profession in a manner that is beneficial, representative and fair, as a legitimate business interest.

Where any data is collected for equality, diversity and inclusion purposes, that data will only be used in an aggregate and anonymised form, for statistical purposes.

If you agree (either via your employment contract or separately to CIOT), we will share your exam results with your exam sponsor or apprenticeship training provider and Apprenticeship End-Point Assessment Organisation (ICAEW), as their legitimate interest. They will be the separate controller of that personal data and their own privacy notices apply.

2.5 If you become a member

We will process your contact details, membership payments and professional information to provide membership services, under contract with you.

As a member, we will publicly share your name, qualifications, membership start date, membership end date and grade, as a public task, under our Royal Charter.

We will process complaints or disciplinary action against members as a matter of public interest and will retain associated data indefinitely on that basis. When processing cases, personal data will be shared with the Tax Disciplinary Board (TDB) and their external advisors. We reserve the right to publish the results of any investigations and actions.

Where any data is collected for equality, diversity and inclusion purposes, that data will only be used in an aggregate and anonymised form, for statistical purposes.

If have a health concern that may impact your membership, we will process the health information you provide on the basis of explicit consent and will only use that information to make appropriate adjustments to support your membership-based activities. You can opt-out of that processing at any time.

2.6 If you become a colleague

The Privacy Notice for colleagues, including staff, employees and volunteers, is available from our HR team.

If you apply to become a colleague, we will process your contact details and career history to assess your suitability for that position or other relevant positions, with a view to enter into a contract.

2.7 If you become a business contact

We will process your contact details and data from our interactions for business purposes, as our legitimate interest, including the provision of services or discussing tax matters.

2.8 If you attend our online event

We will process your contact details, event attendance and any comments you provide, as our legitimate interest. Details can be shared with other professional attendees, and attendees’ names and comments can be shared publicly, unless you notify us to opt-out, which you can do at any time.

If have a health concern that may impact your attendance, we will process the health information you provide on the basis of explicit consent and will only use that information to make appropriate adjustments to support your attendance. You can opt-out of that processing at any time.

2.9 AML Supervision

We provide AML Supervision on member organisations, as a substantial public interest. In doing so, and operating as independent data controllers, we will process personal data provided by the member organisations, including criminal convictions; share data with other authorised bodies; publish the names of supervised firms on our websites; and retain that data as long as necessary to fulfil our legal obligations for AML supervision.

3. Data Subject Rights

We fully respect your rights to request that we:

• Allow you to opt-out of any process that you previously consented to, at any time.
• Provide a copy of data we hold on you, or pass it to a third party on your behalf.
• Amend, delete or restrict processing of your data.
• Explain and review any automated decision making or profiling.
• Provide further information about our processing activities.
• Allow you to speak directly with our Data Protection Officer (DPO)

If you wish to raise a data subject request or contact us about any other matter, please use the contact form on this website or write to us at 30 Monck Street, London SW1P 2AP.

We always aim to respond in a timely manner. If you don’t hear from us, please let us know, in case there has been a communications issue.

You can also escalate matters to the ICO if you believe we are using your data in an unlawful manner. However, please let us know first, so that we can help you resolve the concern. The ICO’s address is: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Their helpline number is UK 0303 123 1113. Their website is: https://www.ico.org.uk

4. Other Matters

We retain data for as long as we believe necessary for the purposes it was collected, to help resolve queries or complaints, for legal reasons, or as a record of historically relevant industry discussion.

We only process personal data in the UK. If you access your data from outside the UK, your data will be transferred internationally out of necessity and you should maintain appropriate safeguards.

Other than described above, we only share personal data with third parties if they are processing that data as processors on our behalf under written contract, or if required for legal or regulatory reasons.  

We do not sell or give away personal data.

Where our websites or emails provide links to other websites, those websites, associated organisations, and their use of data are beyond our control. We encourage you to read the privacy notices on any other website you visit.

This privacy notice was written with brevity and clarity in mind. Please let us know if you would like more details.

We reserve the right to update our notices and cookie notice at any time.