Directly. We obtain personal data directly from individuals in a variety of ways, including obtaining personal data from individuals who provide us with their business card(s), complete our online forms, subscribe to our newsletters, attend meetings or events we host, visit our offices or for recruitment purposes. We may also collect personal data directly when, for example we are establishing a business relationship, performing professional services through a contract. 

Indirectly. We obtain personal data indirectly about individuals from a variety of sources, including recruitment services and our clients:

Public sources – Personal data may be obtained from public registers (such as Companies House), news articles, sanctions lists and internet searches. 

Social and professional networks sites 

Business clients – Our business clients may engage us to perform professional services which involves sharing personal data they control as part of that engagement. 

Recruitment services – We may obtain personal data about candidates from an employment agency, and other parties including former employers, and credit reference agencies. 

What categories of personal data do we collect? 

We may obtain the following categories of personal data about individuals through direct interactions with us, or from information provided through client engagements from applicants, our suppliers and through other situations including those described in this Privacy Notice. 

Personal Data. This is the list of personal data we commonly collect to conduct our business activities. 

1. Contact details (e.g, name, company name, job tile, work and mobile telephone numbers, work and personal email and postal address). 
2. Professional details (e.g, job and career history, educational background and professional memberships, published articles). 

Sensitive personal data 

We typically do not collect sensitive or special categories of personal data about individuals other than our own employees. In some circumstances it is necessary for Strata to process sensitive personal data of our employees and other third parties. Other than where such personal data is made public by the individual themselves, such processing would only be undertaken as necessary for Strata to exercise its rights and obligations as an employer (including for occupational health purposes), protect the vital interests of individuals, establish or defend legal claims or with the explicit consent of the individual(s) concerned.  Examples of sensitive personal data we may obtain, or otherwise hold, include:

• Personal identification documents that may reveal race, religion or ethnic origin, possibly biometric data of private individuals, beneficial owners of corporate entities, or applicants.
• Expense receipts submitted for individual tax or accounting advice that reveal affiliations with trade unions or political opinions.
• Adverse information about potential or existing clients and applicants that may reveal criminal convictions or offences information.
• Information provided to us by our clients in the course of a professional engagement.
• Diversity and equal opportunity information volunteered by participants in certain Strata professional development programmes and recruitment processes.
• Health data where the processing is necessary to assess, monitor and control spread of infectious diseases and to provide a safe environment for our employees, clients and suppliers.

What legal ground(s) do we rely on?

We aspire to be transparent when we collect and use personal data and tell you why we need it, which typically includes:

Providing professional advice and delivering reports related to our tax, advisory, audit and assurance, pension scheme administration, mergers and acquisitions and other professional services. Our services may include reviewing client files for quality assurance purposes, which may involve processing personal data for the relevant client.

• Promoting our professional services, products and capabilities to existing and prospective business clients.
• Sending invitations and providing access to guests attending our events and webinars or our sponsored events.
• Administering, maintaining and ensuring the security of our information systems, applications and websites.
• Authenticating registered users to certain areas of our sites.
• Seeking qualified candidates, and forwarding candidate career inquiries to our People team, which may be governed by different privacy terms and policies.
• Processing online requests, including responding to communications from individuals or requests for proposals and quotations.
• Contacting journalists regarding company press releases, invitations to annual press parties, highlighting messages that may be of interest on specific industry topics.
• Complying with legal and regulatory obligations relating to anti-money laundering, terrorist financing, fraud and other forms of financial crime.
• Compiling health and safety data (directly or indirectly) following an incident or accident. Indirect data can take many forms including an incident report, first aider report, witness statements and CCTV footage.
• Collecting health data to assess, monitor and control spread of infectious diseases and to provide a safe environment for our employees, clients and suppliers.