Fair processing notice: Licensed members

28 March 2024

The data we collect about you

Your name, contact details and country of residence.
Personal details like your date of birth, gender and address history
Sensitive personal data such as ethnic background and certain health information you may voluntarily disclose in respect of your personal circumstances, such as details of disabilities
Details of your membership and qualifications, such as your membership number, CPD details and any other information contained in your evidence of qualifications
Details of your organisation/firm and website (required if we are your AML supervisor)
Your insurance details such as account ID, name of provider, amount of cover and renewal date and, on registration, send a copy of the policy.
Your licence details such as licence ID and status including for relevant licenses held with other bodies.
Your business annual turnover
Any information received as part of your practice assurance review
Information relating to the "fit and proper" test, including criminal convictions, insolvency, sanctions with other professional bodies or regulators and civil sanctions, health records, insurance details and personal circumstances, complaints and malpractice details.
The name of your Money Laundering Supervisor
The name and contact details of the Money Laundering Reporting Officer (MLRO).
You can view and update most of your personal details at any time by using the Edit My Details service. For change of name please contact our customer services team providing a copy of your marriage certificate or deed poll certificate, along with your membership number to customersupport@aat.org.uk. Please note AAT require an official legal name.

What we do with your data and on what grounds

We can only process your personal data if we have a basis to do so which is permitted by law. This may be that you have given your consent, or it may be one of the other lawful bases for data processing. These comprise situations where it is necessary:

for our performance of a contract with you. We process your personal data where it’s necessary in order to fulfil a contract with you or to take steps, at your request, before entering into such a contract
for our legitimate interests. We process your personal data as and when necessary to do so in order to conduct and manage our business to provide you with the best service and experience. We make sure we consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests. We don’t use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law)
to meet our legal obligations. We process your personal data where it’s necessary for compliance with legal or regulatory obligations.

Purpose/activity	Lawful basis for processing including basis of legitimate interest
Publish details of licensed members and supervised firms in a publicly accessible online directory on our website and retain that data as long as necessary to fulfil our legal and public interest obligations.	Performance of a contract with you. Performance of a task carried out in the public interest or in the exercise of official authority in accordance with The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 – specially Regulation 55 which states: (5) Subject to paragraph (6) a registering authority may maintain a register under this regulation in any form it thinks fit.
To process and manage licensed member applications.	Performance of a contract with you. Compliance with our legal obligations. Performance of a task carried out in the public interest or in the exercise of official authority in accordance with The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.
Monitoring equality and accessibility to AAT courses and qualifications with regards to gender, ethnicity and disability status, including producing anonymised and aggregated statistics.	Your explicit consent.
Product development and quality control, including to monitor engagement with third-party services.	Our legitimate interests (to improve our business offering).
To fulfil regulatory requirements relating to licensing and anti-money laundering supervision, including assessing the suitability of licensed members, monitoring CPD, carrying out practice assurance, notifying regulators and investigating any alleged breach of money laundering regulations.	Compliance with our legal obligations. Performance of a task carried out in the public interest or in the exercise of official authority - in accordance with The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 – specially Regulation 50 (duty to cooperate), 51 (Regulatory information) and 52 (Disclosure by supervisory authorities).
To manage complaints and breaches of our regulatory framework and policies, including investigating incidents, publishing findings of misconduct and sanctions, any decisions to grant, refuse or terminate a licence, the findings and outcome of any appeals; and maintaining records for future reference.*	Performance of a contract with you. Performance of a task carried out in the public interest or in the exercise of official authority in accordance with The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017. Supporting activities performed under the substantial public interest (in respect of your sensitive personal data).
Managing renewal applications for licensed members, including to fulfil regulatory requirements to assess the suitability of applicants for licensing.	Compliance with our legal obligations. Performance of a task carried out in the public interest or in the exercise of official authority in accordance with The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017.
Customer support in relation to your application and membership, including: addressing enquiries and resolving issues enabling access to third-party services made available as a benefit of membership.	Performance of a contract with you. Performance of a task carried out in the public interest or in the exercise of official authority in accordance with The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017. Supporting activities performed under your consent .
Managing payment, including processing invoices and payments, including card and direct debit payments	Performance of a contract with you. Our legitimate interests (recovering owed sums to us).
To make important communications relevant to your membership.	Performance of a contract with you. Performance of a task carried out in the public interest or in the exercise of official authority in accordance with The Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017. Our legitimate interests (for running our business).
Marketing and promotional communications, including to: market to existing members via post, SMS, email and social media market to existing members on behalf of third parties communicate third party campaigns to AAT members communicate non-essential information and send relevant promotional information to invite people to participate in surveys, research and focus groups.	Your consent (if received) Our legitimate interests (to improve our business offering) - where you have bought a related product/service.
To invite people to provide feedback about an AAT product or service, and process feedback received and follow up with responses if appropriate.	Our legitimate interests (to improve our business offering).

* AAT may use information provided as part of a complaint regarding professional and licensed members for the purposes of our investigation and disciplinary process within the meaning of the Professional Standards Investigation policy, and for the prevention and detection of crime. AAT may share details of the complaint with AAT’s Discipline and Conduct Panel members, or our oversight regulators, and law enforcement agencies upon their request or where we are legally obligated to disclose information, such as the submission of suspicious activity reports to the National Crime Agency.

Hearings of AAT’s Disciplinary Tribunal in accordance with AAT’s Disciplinary Regulations and the Appeals Committee in accordance with AAT’s Appeals Regulations are open to the public and the date, time and place of any hearing and findings are publicised unless determined otherwise. This will include details of the member that a case relates to but would not include the details of the complainant. If your complaint is against a member who holds dual membership status, we may also share details with other professional bodies.

For details of your rights see our main Privacy policy.

Automated decision making

We do not currently, and do not envisage, that any decisions will be taken about you using solely automated means, however we will notify you in writing if this position changes.

Who we share your personal data with

The public, in relation to information published in the online directory of licensed members, and information regarding any disciplinary outcomes (which may include your name, membership number, alleged misconduct and sanctions)
Supervisory and regulatory bodies (including HMRC and the Institute of Chartered Accountants in England and Wales) and your insurance providers, in connection with our anti-money laundering/licensing legal obligations
The Shared Intelligence Service, which is an "anything known" enquiry service on individuals and firms that all participating bodies use to locate information held by other regulators
The government Disclosure and Barring Service

If you are applying for a licence renewal, we may also share your data with:

Our insurance providers
HMRC, to notify them of when anti-money laundering supervision ceases

Our use of data processors

We use a third-party supplier of an IT system (Jotform) to complete student, licensed, and member applications. This system is hosted in Europe.

We use a third-party supplier of a Customer Relationship Management (CRM) IT system, hosted within the UK by our IT service provider. We also use a second CRM system, HubSpot hosted in Europe.

We also use Microsoft Office 365 to process email and for file storage, hosted within the EU, and a third-party email archive system hosted within the UK. Transfers to the EU are based on the UK adequacy decision of EEA countries.

Other third-party data processors might also include:

our third-party providers of practice assurance activity, such as the Institute of Chartered Accountants in England and Wales
our third-party service providers of payment, user testing, IT, career management consultancy, benefits and rewards services and mailing services.
independent investigators/expert witnesses relating to disciplinary investigations.

Where a third-party data processor is used, we ensure that they operate under contractual restrictions with regard to confidentiality and security, in addition to their obligations under data protection legislation. This means that they cannot do anything with your personal data unless we have instructed them to do it. They will not share your personal data with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Where we get your data from

Other than directly from you, we may also receive personal data from the following third-party sources:

Publicly available sources, such as returned post and information on websites
Your insurance providers
Professional bodies such as the Institute of Chartered Accountants in England and Wales
Law enforcement agencies
The Shared Intelligence Service, which is an "anything known" enquiry service on individuals and firms that all participating bodies use to locate information held by other regulators
Parliament Hill/TRM, which provides us with details of insurance bought by licensed members (if you have consented to this sharing).

How long we keep your data

Your basic membership records, such as name, address history, membership statuses, work experience history and other awarding bodies and practice management details will be retained for 70 years from the end of your membership to support required reporting and professional queries.
If you’ve undertaken any AAT assessments, information on these will be retained for 70 years from the date of assessment, as will information on qualifications awarded.
If you’ve submitted any medical evidence to support Reasonable Adjustment and Special Consideration requests, this will be retained for 7 years from the end of the adjustment period
Correspondence such as email is retained for a maximum of 2 years.
Your communication preferences will be retained for two years after the end of your membership
Credit card details will be managed in line with the Payment Card Industry Data Security Standard (PCI DSS). We do not store or retain any electronic credit card data and use third party payment provider services to process card payments. Card data provided on hardcopy application forms will be securely destroyed once processed.
Direct Debit instructions will be retained for 2 years from the date your direct debit is cancelled.

Transferring your data overseas

We transfer your data to the European Economic Area (EEA) and the USA, as detailed above with regards to data processors.

We rely on the Standard Contractual Clauses for data transferred to the USA to ensure the protection of the rights and freedoms of individuals concerned. Transfers to Europe are based on the UK adequacy decision with regards to EEA countries.