Brick Accounting Ltd (company number 17075192). This is version 1.0 of this Schedule, dated 27 October 2026.
This Schedule forms part of our agreement with each client whose Engagement Letter identifies it, under clause 1.1 of our standard terms of business. It prevails over those terms on the processing of personal data, as clause 1.2 of the terms provides. Nothing in this Schedule reduces the protections in sections 15 to 17 of the terms, and liability arising under this Schedule is subject to them.
The current version of this Schedule is the one published on this page, with its version number and date shown above. Your Engagement Letter identifies the version that applied when you accepted it. We change this Schedule in two ways: changes to sub-processors are made under paragraph 16; any other change takes effect 30 days after we give you written notice of it, or on publication where it does not reduce the protections this Schedule gives you or is required by law. Previous versions are available on request.
1. In this Schedule, “Data Protection Law” means the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003, each as amended. “Controller”, “processor”, “personal data”, “processing”, “data subject”, “personal data breach” and “sub-processor” have the meanings given in the UK GDPR.
2. In performing the Services, we act in two distinct capacities:
(a) as a processor on your behalf, in respect of the activities described in Part A; and
(b) as an independent controller, in respect of the activities described in Part B.
3. You and we are not joint controllers. Each of us is separately responsible for its own compliance with Data Protection Law in respect of the processing for which it is controller.
Part A sets out the terms on which we process personal data on your documented instructions in performing the Services.
4. This Part applies to the personal data we process on your documented instructions in performing the Services.
5. You are the controller of this personal data. You warrant that you have a valid lawful basis for the processing you instruct, and that any privacy information required by Data Protection Law has been provided to the relevant data subjects.
6. We will process the personal data only on your documented instructions, including in respect of transfers to a third country, unless required to do otherwise by law, in which case we will inform you of that requirement before processing, unless the law prohibits it on important grounds of public interest.
7. This Schedule, together with the Engagement Letter and the Schedules, constitutes your initial documented instructions. Further instructions will be given in writing.
8. We will inform you if, in our opinion, an instruction infringes Data Protection Law, and we may suspend the relevant processing until the instruction is withdrawn or amended.
9. We will ensure that the people authorised to process the personal data are subject to an appropriate duty of confidentiality.
10. We will implement appropriate technical and organisational measures under Article 32, having regard to the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing. Our current measures are set out at Annex 1.
11. We will, taking into account the nature of the processing, assist you by appropriate technical and organisational measures in responding to requests to exercise data subject rights.
12. We will assist you in ensuring compliance with Articles 32 to 36, taking into account the nature of the processing and the information available to us.
13. We will notify you without undue delay on becoming aware of a personal data breach affecting the personal data, and will provide the information you reasonably require to meet your own notification obligations.
14. We will make available to you the information necessary to demonstrate compliance with this Part.
15. You give general authorisation for us to engage sub-processors. Those authorised at the date of this version are:
Where identity verification is carried out under Part B rather than under this Part, our provider and its own sub-processors are disclosed separately on request.
Anthropic (Claude) and Google (Gemini within Google Workspace) are the only providers whose AI services we use directly on your personal data, in each case under terms that prohibit the training of models on it. Our other sub-processors may use AI providers within their own services; those providers are their sub-processors, disclosed on their published lists, and are covered by the obligations we impose under paragraph 17. We assess any optional AI feature in those services under our vendor due diligence before enabling it for your data.
16. We will notify you in writing before engaging any additional or replacement sub-processor, giving not less than 10 working days’ notice where the sub-processor’s own terms permit us to do so, and otherwise as soon as reasonably practicable after we become aware. You may object on reasonable data protection grounds within 10 working days of that notice, in which case you and we will discuss the objection in good faith. If no resolution is reached, either of us may terminate the affected Services on 30 days’ notice without penalty.
17. We will impose on each sub-processor data protection obligations no less protective than those in this Part, and we remain fully liable to you for the performance of each sub-processor’s obligations.
18. We will not transfer the personal data outside the United Kingdom except on your documented instruction, or where necessary to use an authorised sub-processor, and in either case only where an appropriate transfer mechanism under Chapter V of the UK GDPR is in place.
19. Where you instruct us to send reports or other deliverables to recipients outside the United Kingdom, including your own directors, officers or group entities, you confirm that you have satisfied yourself as to the lawfulness of that transfer. We will record that instruction in writing.
20. On termination or expiry of the engagement we will, at your election, return or delete the personal data processed under this Part, and delete existing copies, within 90 days.
21. Paragraph 20 does not apply to the records we hold as an independent controller under Part B, which we retain for the purposes and periods described in our privacy notice, as clause 12.2 of the terms also provides. You acknowledge and agree to that retention.
22. Paragraph 20 also does not apply to the extent we are required by law to retain the personal data, including under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017.
23. We will, on not less than 30 days’ written notice and no more than once in any 12-month period, make available to you the information reasonably necessary to demonstrate compliance with this Part, and allow for and contribute to audits conducted by you or an auditor you appoint.
24. Any audit will: be conducted during normal business hours; be subject to reasonable confidentiality undertakings; not unreasonably disrupt our business; not extend to information relating to our other clients; not extend to any record we hold as controller under Part B; and be at your cost, save where the audit reveals material non-compliance.
25. For the following activities we are an independent controller. We determine the purposes and means of the processing and are separately responsible for it; you are not its controller and cannot instruct us in respect of it:
(a) client due diligence and anti-money laundering, including identity verification and sanctions, politically exposed person and adverse media screening, as section 6 of the terms describes;
(b) reports to our Money Laundering Reporting Officer and, where required, to the National Crime Agency, as clause 6.3 of the terms describes;
(c) our engagement file and working papers, including the supporting records on which they rest. This is a record of the work performed, not a copy of your accounting records;
(d) the administration of our relationship with you, including contact details, correspondence, engagement records and billing.
26. The personal data involved, our lawful bases, how long we keep it, who we disclose it to, and the rights of the individuals concerned are described in our privacy notice, which we keep current. Where you give us personal data about individuals for the purposes in paragraph 25(a), you will tell them that we process it as described in that notice.
We maintain an information security policy structured on the five controls of the NCSC Cyber Essentials scheme. A copy is available on request. The measures relevant to the processing under Part A are summarised below.
