Data Protection

Employee, payroll, contractor and statutory records can contain confidential personal and commercial information. We process records entrusted to us only for the agreed assignment, with access limited to authorised people who need the information for their work.

We ask clients to provide only the records needed for the stated service. Information is not repurposed for unrelated advertising or shared internally without an assignment need. Where a full record is unnecessary, clients should redact or omit unrelated personal details before sending it.

Work systems use individual accounts and authentication. Permissions are assigned according to role and assignment responsibilities, while administrative access is limited. Staff should not share account credentials or leave records accessible to unauthorised persons.

Changes to managed compliance content are associated with authorised staff access so that important updates can be reviewed.

We use reasonable technical and organisational measures for storage and transfer, including access-controlled systems and agreed sharing channels. Records should not be sent through personal accounts or unapproved public links. Printed material, when required, should be kept secured and disposed of appropriately.

Personnel handling client information are subject to confidentiality responsibilities. External service providers are selected for a defined operational purpose, receive only the access needed for that purpose and are expected to maintain suitable safeguards.

We work from records supplied by clients and notifications published by competent authorities. Clients remain responsible for promptly reporting corrections to employee, establishment and authorised-contact details. Compliance information that cannot be verified is marked for review instead of being presented as final.

Assignment records are retained for the engagement period and any applicable statutory, professional or dispute-related period. At the end of that period, records are securely deleted, anonymised or returned where reasonably practicable. Backup copies may remain for a limited cycle before routine expiry.

If we identify suspected unauthorised access, loss or disclosure, we assess the event, contain it where possible, preserve relevant evidence and take corrective action. We inform the affected client without undue delay when the incident is relevant to their information and support legally required notifications.

Clients should use the agreed secure channels, limit information to what the assignment requires, maintain accurate source records, manage their own user access and notify us promptly when an authorised contact changes or a shared credential or file may have been compromised.

We review safeguards when systems, services, threats or legal requirements change. This statement describes our general approach and may be supplemented by engagement-specific confidentiality, processing or security terms.