Privacy Notice

1. Purpose of this notice
This privacy notice describes how Appold Ireland Limited , trading as “Moore” (hereinafter referred to as “Moore”, “the firm”, “we”, “us” or “our”) collects and uses Personal Data, in accordance with the General Data Protection Regulation (GDPR), and any other applicable data protection law in the Republic of Ireland (collectively “data protection law”).

It applies to Personal Data provided to us by you or by someone else.

Personal Data is any information relating to an identified or identifiable living person. Words used with first letter capitalisation (e.g. Personal Data), unless otherwise defined in this policy, have the same definition and meaning as under data protection law.

2. About us
Moore, as a major accountancy and advisory firm, provides professional support to a broad range of individuals, corporate clients and other organisations including trusts, credit unions, charities and regulated entities. Personal interactions are at the core of our business, so we have implemented this policy for reasons of lawfulness, fairness and transparency in relation to our use of Personal Data.

3. Our role
Where we decide how and why Personal Data is processed, we are a Data Controller. This is generally the role under which we process Personal Data, in accordance with guidance issued by Chartered Accountants Ireland.
We provide certain services such as payroll processing where we are a Data Processor.

4. Types of Personal Data processed by this firm
The firm process two different types of personal data: client data and firm data.

‘Client data’ is personal data received from clients in relation to professional engagements and practice; and
‘Firm data’ is personal data held by a firm in relation to its own management, employees and affairs generally, including marketing databases.

Given the diversity of the services we provide to clients we may process many categories of Personal Data. By way of example, we could collect and process:

Anti- Money Laundering customer due diligence data.
contact and personal details (including name, address, date of birth, employer name, contact title, phone, email and other business or family contact details);
business activities;
family information;
information about management and employees of clients;
income, taxation and other financial-related details;
investments and other financial interests;
payroll details and other financial information.

Including all related entities of Appold Ireland Limited operating in Ireland: Gatal Limited, and, Moore Ireland Audit Partners Limited

5. Categories of Data Subjects
We hold personal data for the following categories of people (Data Subjects):

Business Partners/Directors in the firm who are living natural persons.
Current clients and their family members who are living natural persons.
Employees of clients for whom we process outsourced payroll etc.
Former clients and their former employees for whom we have processed payroll etc. in the past.
Prospective clients (on a mailing list for example).
Sub-Contractors of the firm.
Existing staff & former staff of the firm.
Job applicants to the firm.
Other ‘Contacts’ not already included on the above lists including complainants, enquirers etc.

6. Collection of Personal Data
We will only collect such Personal Data that is necessary for us to perform our services and we ask our clients only to share such Personal Data as required for that purpose. Where we identify that a client has provided us with unnecessary Personal Data, we will either return that information to its source or destroy it, taking into account our client’s preference wherever possible.

Generally, we collect Personal Data from our clients or from third parties acting on the instructions of the relevant client. Examples of this collection include when:

we are contacted about our services;
a proposal is requested from us in respect of the services we provide;
our clients engage us to provide our services and during the provision of those services;
we receive client information from public registers, government and regulatory authorities, financial and insurance advisors, service providers etc.

7. Use of Personal Data
Here we set out the basis upon which we process Personal Data. Please note that we may process Personal Data for more than one lawful basis, depending on the specific purpose for which we are using that information.

Performance of a contract
We provide a diverse range of professional services, of which more information can be found here: http://www.mooreireland.ie/services

Many of our services require us to process Personal Data for purposes necessary for the performance of our contract with our clients. We consider that we have a legal right and obligation to maintain engagement files and correspondence files containing personal data so that we can subsequently demonstrate that we complied with our contractual obligations and that we applied due skill and care, as well as complying with other legal and professional obligations in the performance of the engagements.

Legitimate interests
We may process Personal Data for the purposes of our own legitimate interests in the effective delivery of information and services to our clients, and in the effective and lawful operation of our businesses, provided that those interests do not override the interests, rights and freedoms of a Data Subject which require the protection of that Personal Data.

Examples of such processing activities include:

managing our relationship with clients;
developing our businesses and services (such as identifying client needs and improvements in service delivery);
monitoring the services we provide clients for quality control purposes, which may involve processing the Personal Data stored on the relevant professional file;
managing risk in relation to client engagements and to the firm generally;
maintaining and using IT systems, including security monitoring to identify harmful programs;
hosting or facilitating the hosting of events;
administering and managing our website and systems and applications.

Compliance with a legal obligation
As with any provider of professional services, we are subject to legal, regulatory and professional obligations. We will process Personal Data as necessary to comply with those obligations.

One example of such processing includes anti-money laundering activities such as carrying out searches (such as internet searches and sanctions lists) to identify politically exposed persons and heightened risk individuals and organisations, and to check that there are no issues that would prevent us from working with a particular client (such as sanctions, criminal convictions (including in respect of company directors), conduct or other reputational issues).

We are also to keep certain records to demonstrate that our services are provided in compliance with our legal, regulatory and professional obligations.

Consent
In certain limited circumstances, such as where a Data Subject has agreed to receive marketing communications from us, we may process Personal Data by consent. Where consent is the only basis upon which Personal Data is processed the relevant Data Subject shall always have the right to withdraw their consent to processing for such specific purposes.

It is our policy to only process Personal Data by consent where there is no other lawful basis for processing.

8. Retention
We retain the Personal Data processed by us for as long as is considered necessary for the purpose for which it was collected (including as required by applicable law or regulation).

In the absence of specific legal, regulatory or contractual requirements, our standard retention period for records and other documentary evidence created in the provision of services is 6 years. There is an exception to the standard 6-year retention period for certain records that are necessary to retain for ongoing taxation purposes, e.g. Capital Goods Scheme records.

Our standard e-mail retention period is 7 years.

We continually review our data retention policies, and we reserve the right to amend the above retention periods without notice.

Other records, which are not required to be retained as part of our professional services, will be kept for a period of time depending on:

the type, amount and categories of Personal Data we have collected;
the requirements of our business and the services we provide;
the purposes for which we originally collected the Personal Data;
the lawful grounds upon which we based our processing;
any relevant legal or regulatory obligations;
whether the purpose of the processing could be reasonably fulfilled by other means.

9. Data Security
We take the security of all the data we hold very seriously. We have a framework of policies, procedures and training in place covering data protection, confidentiality and security and regularly review the appropriateness of the measures we have in place to keep the data we hold secure.

We have put in place appropriate security measures to prevent Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. This is not only in accordance with our obligations under GDPR, but also in accordance with our regulatory obligations of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify any affected Data Subject and any applicable regulator of a suspected breach where we are legally required to do so.

In some circumstances we may anonymise or pseudonymise Personal Data so that it can no longer be associated with the Data Subject, in which case we may use it without further notice.

10. Data transfers
We will share Personal Data with third parties where we are required by law, where it is necessary to administer our relationships between clients and Data Subjects, or where we have another legitimate interest in doing so.

We are part of a global network of firms and accordingly Personal Data may be transferred to other member firms of Moore Global. This may result in Personal Data being transferred outside the countries where we and our clients are located. This includes to countries outside the European Union (EU) and to countries that do not have laws that provide specific protection for personal data. All Personal Data will be provided with adequate protection and all transfers of Personal Data outside the EU will be done lawfully. Where we transfer Personal Data outside of the EU to a country not determined by the European Commission as providing an adequate level of protection for Personal Data, the transfers will be under an agreement which covers the EU requirements for the transfer of personal data outside the EU, such as the European Commission approved standard contractual clauses.

Please also see https://www.mooreireland.com/locations for a list of firms and countries in which member firms of the Moore International network operate. We will also share Personal Data with other entities within our group, subject to the safeguards mentioned above.

We may share Personal Data with third party service provider, including:

Third-party organisations that provide applications / functionality, data collection and processing or IT services to us – we use third parties to support us in providing our services, obtaining feedback from our clients and prospective clients and to help provide, run and manage our internal IT systems. For example, providers of information technology, cloud-based software as a service provider, website hosting and management, data analysis, data back-up, security and storage services;
Third-party organisations that otherwise assist us in providing goods, services or information;
Appold Ireland associated businesses;
Auditors and other professional advisers; and
Law enforcement or regulatory agencies or those required by law or regulations.

11. Rights and responsibilities

A Data Subject’s duty to inform us of changes
It is important that the Personal Data we hold about is accurate and current. Should your personal data change, please notify us of any changes of which we need to be made aware by contacting us, either through your usual contact at Moore or by using one of the means set out at the end of this privacy notice.

A Data Subject’s rights in connection with Personal Data

Data Subjects have certain rights under the GDPR in relation to the Personal Data held by us about them. In particular, they may have a right to:

request access to their Personal Data. This enables a Data Subject to receive details of the Personal Data we hold about them and to check that we are processing it lawfully;
ask that we update the Personal Data we hold about them, or correct such Personal Data that they think is incorrect or incomplete;
request erasure of their Personal Data. This enables a Data Subject to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. Data Subjects also have the right to ask us to delete or remove Personal Data where they have exercised their right to object to processing (see below). Please note that we may not always be able to comply with a request for deletion of Personal Data for legal reasons which will be notified, if applicable, after receiving such a request;
object to processing of their Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about their particular situation which makes them want to object to processing on this basis. They also have the right to object where we are processing their personal information for direct marketing purposes;
request the restriction of processing of their Personal Data. This enables a Data Subject to ask us to suspend the processing of Personal Data about them, for example if they want us to establish its accuracy or the reason for processing it;
request the transfer of their Personal Data to them or another Controller if the processing is based on consent, carried out by automated means and this is technically feasible. Please note that, at the time of the drafting of this notice, we do not undertake any processing relevant to the exercise of this right.

Withdrawal of consent
Where we process Personal Data based on consent, individuals have a right to withdraw consent at any time. However, as noted above, we do not generally process Personal Data based on consent.
To withdraw consent to our processing of your Personal Data please email us at dataprotection@mooreireland.ie or, to stop receiving an email from a Moore marketing list, please click on the unsubscribe link in the relevant email received from us.

Contacting us to exercise a right
If any individual would like to exercise the above rights, please contact us by sending an email or by one of the means set out at the end of this privacy notice. We may charge a reasonable fee for a request to access details of Personal Data, if permitted by law. If a request is clearly unfounded, repetitive or excessive we may refuse to comply with that request.

Please note that we do not provide photocopies of documents we are contacted by Data Subject seeking access to their Personal Data. We will comply with this request in another way, usually by providing a newly created document listing the information we are required to provide under data protection law.

We may need to request specific information from those individuals who contact us to help us confirm their identity and ensure their right to access their personal data (or to exercise any of their other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact an individual to ask them for further information in relation to their request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if a request is particularly complex. In this case, we will notify the individual concerned and keep them updated.

Data Subjects also have the right to make a complaint to the Data Protection Commissioner (DPC), the Irish supervisory authority for data protection issues. For further information on individual rights and how to complain to the DPC, please refer to the DPC Website https://dataprotection.ie/docs/Home/4.htm .

12. Changes to this notice
We recognise that transparency is an ongoing responsibility so we will keep this privacy statement under regular review.

This privacy statement was last updated in June 2024.

13. Contacts
If there are any questions regarding this notice or if anyone would like to contact us about the manner in which we process their Personal Data, please email our Data Compliance Principal at: dataprotection@mooreireland.ie.