Last updated: 14 October 2026
1. Who we are
BBK Accounts is the name supplied as the registered business name. BBK Accounts, Bracetown Business Park, Unit
F1, Clonee, Dublin 15, D15 YDC1, Ireland. Website: bbk.ie. Privacy enquiries: [email protected].
For its own website, enquiries, client engagements and business administration, BBK Accounts generally determines
the purposes and means of processing and acts as controller. Its role for client-supplied payroll and other records
must be assessed by service and engagement: it may act as processor on documented client instructions or as an
independent controller where it determines processing purposes or must meet its own legal duties.
2. Scope of this notice
This notice explains the processing of personal data relating to website visitors, prospective and current clients, their
contacts, sole traders, directors, beneficial owners, employees and other individuals whose information is supplied in
connection with BBK services. Client-specific engagement notices or processor terms may supplement it.
3. Information we may process
• Identity and contact details: names, addresses, email addresses, phone numbers, job titles, signatures and
correspondence.
• Client and company details: company registration numbers, directorships, beneficial ownership information and
engagement records.
• Tax and financial data: PPS numbers or tax reference numbers where required, income, expenses, invoices, bank
details, accounting entries, returns and supporting records.
• Payroll data: employee identifiers, pay, deductions, working arrangements, statutory leave and benefit details, and
other payroll inputs as required.
• Verification data: identity documents, proof of address and due-diligence information where legally necessary.
• Website information: form submissions, IP addresses, device/browser data, consent choices and analytics events
where enabled.
• Occasionally sensitive data may appear in payroll or professional records (for example health-related absence
information); it requires a separate Article 9 condition and additional safeguards where applicable.
4. Purposes and lawful bases
Responding to enquiries and onboarding: steps before contract, legitimate interests in responding to business
enquiries, and legal obligations where identity checks apply.
Bookkeeping, accounts preparation, taxation and business advisory: performance of contracts with individual
clients where applicable, legitimate interests in delivering contracted business services, and legal obligations for
statutory filings and recordkeeping as applicable. A contract with a company does not automatically supply the Article
6(1)(b) basis for every employee or director whose data is processed.
Payroll administration: as instructed by client controllers where BBK acts as processor; otherwise the relevant
controller must establish an appropriate basis, including legal obligation or legitimate interests as applicable.
Additional Article 9 conditions are required for special-category data.
Anti-money laundering and professional compliance: compliance with applicable legal obligations, where those
obligations apply to BBK.
Security, fraud prevention and service administration: legitimate interests and, where relevant, legal obligations.
Non-essential analytics and marketing cookies: prior consent where required by Irish ePrivacy rules. Consent can
be withdrawn. Any direct marketing must separately comply with applicable electronic-marketing rules.
5. Sources of information
Information may come directly from individuals; from client businesses and their authorised representatives; from
employers and payroll administrators; from Revenue, CRO, RBO or other public bodies and registers; and from
authorised professional advisers or service providers. Where Article 14 GDPR applies to indirectly obtained data,
BBK must provide the required information unless a valid exemption applies.
6. Disclosures and recipients
Depending on the engagement and legal requirements, personal data may be disclosed to the Revenue
Commissioners, Companies Registration Office, relevant beneficial-ownership registers, banks, authorised advisers,
regulators, auditors and professional service providers. BBK also uses or plans to use Sage, Coretime, Trello and
Microsoft 365. The precise products, tenants, integrations, contractual entities, hosting regions, access permissions
and recipient roles have not yet been verified. Their mention here is not confirmation that every provider processes
every category of personal data.
BBK should assess the role of each recipient and use Article 28 processor agreements where required. Staff and
external IT support should have access limited to what is necessary for their authorised duties; the actual access
arrangements must be confirmed.
7. Website analytics, Google Analytics and Google Tag Manager
BBK has confirmed that the website uses Google Analytics and Google Tag Manager. Google Tag Manager is a
tag-management system; the actual tags it loads determine what additional processing occurs. Google Analytics may
collect usage and device information, including online identifiers and event data, subject to configuration.
Analytics and other non-essential tags should not run until valid consent has been obtained where required. The
website should offer equally accessible acceptance and rejection options, allow later withdrawal, and retain
appropriate consent records. The final cookie notice must identify actual cookies, purposes, durations, providers and
any additional tags; these have not been audited. Google Consent Mode configuration, if used, also needs
verification.
8. Data security and confidentiality
BBK is responsible for implementing security appropriate to the risks, particularly for payroll, tax, financial and identity
records. Measures to verify include multi-factor authentication, role-based access, secure file sharing, device
controls, backup and recovery, staff confidentiality arrangements, logging, incident response and secure employee
offboarding. This draft does not represent that any specific measure is already implemented.
9. Retention and deletion
BBK retains information for no longer than necessary for the relevant purpose, taking account of tax and
company-law recordkeeping, anti-money laundering obligations where applicable, professional obligations, limitation
periods and disputes. Different rules may apply to different categories and circumstances; no universal six-year
retention period should be assumed.
BBK must document and approve its retention schedule for tax and accounting files, payroll records, AML files,
enquiry submissions, website analytics, consent logs, emails, backups and client-supplied records. Where BBK acts
as processor, return or deletion at the end of service is subject to documented instructions and any applicable legal
retention requirement.
10. International transfers
Use of cloud software may involve access to or transfers of personal data outside the European Economic Area. The
actual data locations, subprocessors and transfer routes for Sage, Coretime, Trello, Microsoft 365 and Google
services have not been verified. Where restricted transfers occur, BBK must ensure an appropriate GDPR Chapter V
mechanism, such as an adequacy decision or Standard Contractual Clauses, with supplementary measures where
needed.
11. Your GDPR rights
Subject to applicable conditions and exemptions, individuals may request access, correction, erasure, restriction,
portability, and object to certain processing. Where processing is based on consent, consent may be withdrawn at
any time without affecting earlier lawful processing. Individuals also have rights concerning qualifying solely
automated decisions. Requests may be sent to [email protected]. BBK will normally respond within one month,
subject to permitted extensions and identity verification where necessary.
Where BBK processes personal data solely on behalf of a client controller, it may refer the request to that controller
and assist in accordance with its contractual and legal obligations.
12. Required information and consequences of not providing it
Certain identity, tax, payroll and accounting details may be required by law or necessary to provide services. If they
are not supplied, BBK may be unable to accept or complete an engagement. General website enquiries are
voluntary, although contact details may be necessary to respond.
13. Children and vulnerable individuals
The website is intended to present professional accountancy services rather than services directed at children.
Personal data relating to children or vulnerable persons may nonetheless be included in lawful client records, such as
payroll or benefit information. Processing and safeguards must be assessed in context.
14. Automated decision-making
No qualifying solely automated decision-making has been confirmed. BBK must verify whether any software-enabled
decisions produce legal or similarly significant effects; if so, additional Article 13/14 disclosures and Article 22
safeguards may be required.
15. Personal data breaches
BBK must assess suspected personal data breaches, document incidents, notify the Data Protection Commission
within 72 hours of awareness where Article 33 requires it (unless unlikely to result in risk), and notify affected
individuals without undue delay where Article 34 requires it. Processor-to-controller notifications must also be
addressed in relevant agreements.
16. External websites
Links to third-party websites are governed by those parties’ notices. BBK does not control their separate processing
activities.
17. Changes to this notice
This notice may be updated as services, systems, legal requirements and data practices change. The published
version should show its effective date and explain material changes where appropriate.
18. Contact and complaints
BBK Accounts
Bracetown Business Park, Unit F1, Clonee, Dublin 15, D15 YDC1, Ireland
Email: [email protected]
Website: https://bbk.ie
Individuals can lodge a complaint with the Irish Data Protection Commission: www.dataprotection.ie. They may also
have the right to complain to another competent supervisory authority.
19. Publication and related notices
This website notice should be read alongside a separate, accurate Cookie Policy and any client engagement privacy
information. If BBK processes payroll or other personal data for client controllers, the parties should assess and
document their respective GDPR roles and use suitable agreements where legally required.