This policy explains how the Association of Professional Accountants and Auditors (APAA, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you visit this website, apply for membership, a certificate, or a CPD course, or otherwise interact with us. We are committed to handling your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
APAA is the data controller for the personal data described in this policy. Our registered office is 5 South Charlotte Street, Edinburgh, EH2 4AN, United Kingdom. Any question about this policy or about how we handle your data can be sent to info@apaauk.org .
2. Information We Collect
We collect the following categories of personal data:
- Identity and contact details you provide, such as your name, email address, postal address, phone number, and employer or firm.
- Membership and qualification details, including your application, grade, qualifications, professional history, and any certificates or CPD courses you enrol in or complete.
- Payment and billing details processed for membership fees, certificates, and courses.
- Correspondence and enquiries you send us, including by email or through the Website.
- Technical data such as your IP address, browser type, device information, and pages visited, collected automatically as you use the Website.
3. How We Use Your Information
We use your personal data to:
- Process your membership application, and admit, renew, or administer your membership.
- Assess and issue certificates, and administer CPD course enrolment and delivery.
- Verify a certificate or membership status when asked to do so by you or a third party you have authorised.
- Take payment and maintain accurate financial and membership records.
- Respond to your enquiries and provide member and course support.
- Send service communications and, where you have agreed, updates about our courses and events.
- Maintain the security of the Website and understand how it is used.
- Comply with our legal, accounting, and regulatory obligations.
4. Legal Basis for Processing
We rely on the performance of a contract with you (for membership, certificates, and course enrolment), our legitimate interests (such as running and securing the Website, and maintaining professional standards among Members), compliance with a legal obligation (such as financial record-keeping), and, where applicable, your consent (for example, to receive marketing communications, which you may withdraw at any time).
5. Sharing Your Information
We share personal data with service providers who process it on our behalf, including our membership portal and payment processing provider, IT and hosting providers, and email delivery services, each bound by contractual obligations to protect your data. Where relevant to a certificate or membership you hold, we may share confirmation of your status with an employer, alliance partner, or accrediting body you have asked us to notify. We may also disclose personal data where required by law, regulation, or a competent authority. We do not sell your personal data.
6. International Transfers
Some of our service providers may process data outside the United Kingdom. Where this happens, we take steps to ensure an adequate level of protection is in place, such as relying on a provider located in a country recognised as offering adequate protection, or using standard contractual clauses approved for this purpose.
7. Cookies
The Website uses cookies and similar technologies to remember your language preference, keep the Website secure, and understand how visitors use our pages. You can control or disable cookies through your browser settings; doing so may affect how parts of the Website function.
8. Data Retention
We keep personal data for as long as needed to provide membership, certificates, and courses, to maintain a verifiable record of qualifications awarded, and to meet our legal and accounting obligations. When data is no longer needed for these purposes, we delete or anonymise it.
9. Data Security
We maintain appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and while we work to protect your data we cannot guarantee its absolute security.
10. Your Rights
Under UK data protection law, you have the right to:
To exercise any of these rights, contact us at info@apaauk.org . If you are not satisfied with how we have handled your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
- Ask for a copy of the personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Ask us to erase your data, where we are not required to keep it for a legal or contractual reason.
- Ask us to restrict or object to certain processing of your data.
- Ask for your data to be provided to you, or transferred to another organisation, in a portable format.
- Withdraw consent at any time where processing is based on consent.
11. Children's Privacy
Our Services are intended for professionals and are not directed at children. We do not knowingly collect personal data from children.
12. Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or the law. The effective date at the top of this page shows when it was last revised. Where changes are significant, we will take reasonable steps to bring them to your attention.
13. Contact Us
Questions about this policy, or requests relating to your personal data, can be sent to info@apaauk.org , or by post to our registered office: