Contact Us
Contact Us

Privacy Policy

Version: 26 June 2026. This English version applies to the United Kingdom (.com) site under UK GDPR and the Data Protection Act 2018, with the Information Commissioner’s Office (ICO) as the supervisory authority and the UK Extension to the EU-US Data Privacy Framework for United States transfers. On the German (.de) site the German version above is operative.

1. Controller

Tuerner & Co Limited, Bridge House, Old Grantham Road, Whatton, Nottingham, NG13 9FG, United Kingdom. Telephone: +44 1636 526 075 · Email: info@tuerner.com. Authorised representative: Christine Turner, BA (Hons), ACA.

2. Representative in the European Union (Article 27 GDPR)

As the controller is not established in the European Union, it has appointed the European Data Protection Office (EDPO) as its representative in the Union under Article 27 GDPR. You can contact EDPO on matters relating to the GDPR: – using EDPO’s online request form: https://edpo.com/gdpr-data-request/ – in writing: EDPO, Avenue Huart Hamoir 71, 1030 Brussels, Belgium

3. Data-protection contact

Email: privacy@tuerner.com.

4. Purposes and legal bases

  • Website delivery and security; server logs — Art 6(1)(f) (legitimate interest in secure, stable operation).
  • Handling your enquiries (contact form, email, telephone, online forms) and providing quotes — Art 6(1)(b) (steps at your request) or (f). Replying to you is not marketing.
  • Managing the prospect and client relationship (CRM) — Art 6(1)(f) or (b).
  • Delivering engaged services and practice management — Art 6(1)(b) (contract) and (c) (legal obligations, including tax and anti-money-laundering).
  • Providing requested resources (for example the “CIS Health Check”) — Art 6(1)(b) or (f).
  • Newsletter and email marketing — Art 6(1)(a) (consent) and § 7 UWG; for recipients in Germany and Austria on a double opt-in
  • Cookies, analytics and marketing tags — Art 6(1)(a) with § 25(1) TDDDG (consent) — see section 10.
  • Recording and transcribing online meetings (Microsoft Teams) to produce accurate internal notes and follow up on agreed actions — Art 6(1)(f), with a right to object; notice is given at the start of each meeting, and we do not record if you object.
  • Data from other sources (for example employers, HMRC): where we do not obtain data from you directly, we inform you under Art 14.

5. Recipients and processors

Carefully selected processors (Art 28): HubSpot, Inc. (United States — CRM, web forms, marketing); Karbon (United Kingdom — practice and work management, including prospect data); Fireflies (United States — meeting recording and transcription); Brain Payroll (United Kingdom/EU — payroll for engaged employers); Siteground (EU — website hosting); and, where legally required, tax and supervisory authorities and other professional/regulatory bodies. (Specialist software used to deliver engagements — for example for working papers — is listed in our separate client privacy notice; see section 13.)

6. International transfers

HubSpot and Fireflies process data in the United States; those transfers rely on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), under which both are certified. Karbon stores and processes the data in the United Kingdom (covered by the EU adequacy decision for the United Kingdom); a limited part of Karbon’s shared infrastructure (identity services and routing metadata) is processed in the United States under Standard Contractual Clauses (Art 46(2)(c)). Website hosting (Siteground) is within the EEA. A copy of the safeguards is available at privacy@tuerner.com.

7. Retention

Server logs 30 days; non-converting enquiries/leads deleted or anonymised after 12 months of inactivity; consent-based marketing contacts until consent is withdrawn, then a minimal suppression record; client records for the engagement plus statutory retention (typically about 6 years; possibly longer).

8. Your rights

Access (Art 15), rectification (16), erasure (17), restriction (18), portability (20) and withdrawal of consent for the future (Art 7(3)). Right to object to direct marketing: you may object to processing for direct marketing at any time (Art 21), and we will stop. A general right to object on grounds of your particular situation also applies to processing based on Art 6(1)(f).

9. Right to complain

Complain to us: if you are unhappy with how we handle your personal data, you can contact us directly at any time at privacy@tuerner.com. We will acknowledge your complaint within 30 days, investigate without undue delay, and tell you the outcome (reflecting our duty under the United Kingdom Data (Use and Access) Act 2025, in force from 19 June 2026).

Complain to a supervisory authority: you may also complain to a data-protection supervisory authority. The competent authority is normally the one for your habitual residence or place of work; in Germany this is the data-protection authority of your federal state (Land). (United Kingdom site: the ICO, ico.org.uk.)

10. Cookies and consent banner

Non-essential cookies and technologies (analytics, marketing) are used only with your prior consent (§ 25(1) TDDDG). Through the cookie banner you may accept or reject; “reject all” is as easy as “accept all”. Strictly necessary cookies are exempt. You can change your choice at any time.

11. Automated decision-making

There is no automated decision-making, including profiling, within the meaning of Art 22.

12. Provision of data

Where necessary to start or carry out an engagement, providing certain data is a contractual or statutory requirement; without it we may be unable to take on or deliver the engagement.

13. Client-related processing

Delivering an engagement involves further processing (for example working papers, payroll) through additional specialist software. Details are in our separate client privacy notice, to which we refer you when the engagement begins.

14. Currency

Version: 26 June 2026. We review this notice regularly and update it when things change.

Main Menu