TERMS AND CONDITIONS
Implementing Relevant Accounting Framework
You accept that you are responsible for arranging training for your board and staff in the Irish GAAP financial reporting framework. You also accept responsibility for the following:
- The choice of the most appropriate financial reporting framework;
- Preparation of financial statements, including comparative figures;
- Choosing the most appropriate accounting policies and estimates and disclosing them in the financial statements;
- Making the necessary judgments regarding facts and figures in the financial statements and disclosing appropriate elements of those judgements in the financial statements;
- Assessing any impact on the going concern assessment;
- Maintaining a record of the company’s distributable reserves in accordance with the requirements of company law; and
- Choosing other experts in areas that may be required from time to time e.g. pensions liabilities or legal claims.
You are also responsible for:
- providing us with access to all relevant accounting records and financial information to enable us to meet our responsibilities, which will include, where relevant, valuations and the details of any valuation method used from yourselves or third parties;
- telling us if you intend to apply the ‘undue cost or effort’ exemption for any items in the financial statements and the rationale for so doing;
- communications with third parties, such as lenders, suppliers, regulators, grant aid and Governmental agencies, investors and employees, regarding the impact of the new accounting basis, including whether and how it might impact on any bank covenants, profit related pay or earn-outs on business combinations;
- ensuring that our systems are capable of capturing the information necessary for the preparation of the financial statements under the new accounting basis; and
- ensuring that, to the best of your knowledge and belief, the financial information supplied to us as reporting accountants is accurate and complete.
You accept that you will approve and sign the financial statements thereby acknowledging responsibility for them, including the appropriateness of the accounting basis on which they are compiled, the policies selected, and the disclosures given, and for providing us with all information and necessary explanations to complete your accounting responsibilities.
You are also responsible for making available to us, as and when required, all the company’s accounting records and all other relevant records and related information, including minutes of all meetings of Board of Directors as well as the minutes of the general meetings of the company. We are entitled to request from the company’s board such other information and explanations as we think necessary for the performance of our duties as reporting accountants.
You are responsible for ensuring that, to the best of your knowledge and belief, financial information, whether used by the company internally or for the financial statements, is reliable. You are also responsible for ensuring that the activities of the company are conducted honestly, that it complies with the laws and regulations applicable to its activities, that its assets are safeguarded, and for establishing arrangements designed to deter fraudulent or other dishonest conduct and to detect any that occurs.
Responsibilities of the Reporting Accountants
Our responsibility is to help in the preparation of the financial statements in accordance with relevant legal and regulatory requirements. We will not be carrying out an audit under the International Standards on Auditing (Ireland).
We will not be reporting to you our opinion as to whether the financial statements give a true and fair view and are properly prepared in accordance with the Companies Act, 2014.
Additional Legal Responsibilities – Criminal Law
Where, in the course of conducting professional work, it comes to the attention of certain “relevant persons” (the definition of which includes auditors), that information or documents indicate that an offence may have been committed under Section 59, Criminal Justice (Theft and Fraud Offences) Act, 2001, such suspicions must be reported to the Garda Síochána. This applies regardless of the apparent materiality of the suspected offence, or whether the suspected offence has already been reported to the relevant authorities. We have similar reporting obligations under the Criminal Justice Act, 2011.
Anti – Money laundering – Reporting Suspicions
The provision of audit, accounting and taxation services are businesses in the regulated sector under the Criminal Justice (Money Laundering and Terrorist Financing) Act, 2010 and the Criminal Justice Act, 2013 and, as such, partners and staff in audit, accounting and taxation firms are required, under the anti-money laundering regime in the Republic of Ireland, to report any suspicion that a criminal offence giving rise to proceeds from criminal conduct has been or is being committed, regardless of whether that offence has been committed or is being committed by their client or by a third party. If as part of our normal work, we form a suspicion that such an offence has been or is being committed we are required to make a report to the Garda Síochána and the Revenue Commissioners. In such circumstances, it is not our practice to discuss such reports with you because of the restrictions on disclosure imposed on us by the anti-money laundering legislation.
Client identification
We are required to identify our clients for the purposes of the anti-money laundering legislation. We are likely to request from you, and retain, some information and documentation for these purposes and/or to make searches of appropriate databases.
If satisfactory evidence of your identify is not provided within a reasonable time, there may be circumstances in which we are not able to proceed with the appointment.
External Review
Accountants are subject to external review by their professional body and by highly experienced independent qualified accountants. Accordingly, our client files may be reviewed from time to time by an external reviewer who will be subject to the same confidentiality requirements as we are.
Applicable Law
This engagement letter shall be governed by, and construed in accordance with, Republic of Ireland Law. The Courts of the Republic of Ireland shall have exclusive jurisdiction in relation to any claim, dispute or difference concerning the engagement letter and any matter arising from it. Each party irrevocably waives any right it may have to object to an action being brought in those Courts, to claim that the action has been brought in an inconvenient forum, or to claim that those courts do not have jurisdiction.
Best Service
We shall endeavour at all times to provide you with a professional service of the highest quality. If, however, you are dissatisfied with our service in any way you should contact Peter O’Donovan, who will undertake to look into any complaint carefully and promptly. If we have given you a less than satisfactory service, we will undertake to do everything reasonable to put it right.
In the event that you are still dissatisfied, you may make a formal complaint to Chartered Accountants Ireland.
If you feel that a complaint is not properly addressed or if you consider that the partner responsible for your affairs is not appropriate for the initial contact, please contact Eileen Keyes.
Data Protection Agreement (DPA)
We are committed to ensuring the protection of the privacy and security of any personal data which we process. Your attention is drawn to these terms of business which detail how we treat personal data received by us in the provision of our services during our engagement with you. By signing this engagement letter, you confirm that you have read and understood the Data Protection clauses and any privacy notice referred to therein.
Definitions & Interpretation
In this DPA, the following definitions apply:
Alternative Adequate Level of Protection means (i) the country where the Firm or a Sub-processor is located is recognised by the European Union to have a similar or adequate level of protection of Personal Data as described in Data Protection Laws, or (ii) the Firm or the Sub-processor has fully implemented binding corporate rules which provide adequate safeguards as required by the Data Protection Laws, or has any other similar program that is recognised as providing an adequate level of protection.
Appropriate Security Measures means appropriate security measures required by Data Protection Laws to protect against unauthorised access to, alteration, disclosure or destruction of data and against their accidental loss or destruction and, in particular, where the processing involves the transmission of data over a network, it shall mean having regard to the state of technological development and the cost of implementing the measures, and ensuring that the measures provide a level of security appropriate to:
the harm that might result from unauthorised or unlawful processing, accidental or unlawful destruction or accidental loss of or damage to the data concerned, and
the nature of the data;
Client means the Client entity (as identified above) that is a party to DPA and who is the Data Controller of the Client Personal Data.
Client Group means all companies that are part of the Client company group.
Client Personal Data means personal data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the Client and that is provided to the Firm or collected by the Firm from the Client for the purpose of the Firm rendering Services to the Client.
Data Controller means the Client who, either alone or with others, controls the contents and use of personal data. Both the Firm and the Client shall each also be considered an independent data controller, in certain circumstances, in relation to the client personal data. Each of us will comply with all requirements and obligations applicable to us under the data protection legislation in respect of the client personal data.
Data Processor means any natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller but does not include an employee of the Data Controller who processes such data in the course of his employment.
Data Protection Laws means all legislation and regulations relating to the protection of personal data including (without limitation) the Data Protection Acts 1988 and 2003 of Ireland, the General Data Protection Regulation (‘GDPR’) (General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of The Council of 27 April 2016),including the ‘PECR’ and all other industry guidelines (whether statutory or non-statutory) or codes of practice or guidance issued by the Data Protection Commission or relevant Irish Supervisory Authority (as defined in the GDPR) relating to the processing of personal data or privacy or any amendments and re-enactments thereof.
Data Subject means the individual who is identified or an identifiable natural person whose Client Personal Data is, or is to be, Processed.
The Firm means the Firm entity (as identified above) that is a party to this DPA and who is the Data Processor of the Client Personal Data.
The Firm Group means all companies that are part of the Firm company group.
EEA means European Economic Area.
Firm means the incorporated or unincorporated accountancy firm that is the processor of the client data. In some circumstances the Firm will also be a data controller and will handle client data in accordance with Data Protection Laws.
Loss includes any demand, claim, proceeding, suit, judgement, loss, liability, cost, expense, fee, penalty or fine.
Permitted Purpose means the purpose required by the Client from the performance of the Services by the Firm or any Specific Request.
‘PECR’ means the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011 (SI 336 of 2011).
- Privacy Statement means the Firm privacy statement located at 13 Bridge House, St. Patrick’s Quay, Cork, updated from time to tim
Process or Processing means any operation or set of operations which is performed upon Client Personal Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction. Any derivative of the word Process has a corresponding meaning.
Specific Request means any instruction, in email or other form, to the Firm stating the specific services that the Client requires and containing the information required by the Firm to perform those specific Services.
Standard Contractual Clauses means the Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in non-adequate countries, as defined under Data Protection Laws.
Sub-processor means any Data Processor engaged by the Firm to perform Services.
Application of DPA: The provisions of this DPA shall apply to Client Personal Data to which the Firm had access on any date prior to the date of this DPA (the “Prior Date”) as if this DPA had been executed and come into force on the Prior Date and all Client Personal Data to which the Firm has had access since the Prior Date.
Status of the Parties
Status: The parties acknowledge that, in relation to Client Personal Data, and for the purposes of the Data Protection law, the Firm is a Data Processor. Both the Firm and the Client shall each also be considered an independent data controller, in certain circumstances, in relation to the client personal data. Each of us will comply with all requirements and obligations applicable to us under the data protection legislation in respect of the client personal data.
Cooperation: Upon the reasonable request of the other, we shall each co-operate with the other and take such reasonable commercial steps or provide such information as is necessary to enable each of us to comply with the data protection legislation in respect of the services provided to you in accordance with our engagement letter with you in relation to those services;
Ownership: As between the Client (the Data Controller) and the Firm (the Data Processor), all Client Personal Data shall at all times be the property of the Client and/or the Client’s Authorised Users, except in the case of audit working papers created by the Firm, while acting as principal, in which case the data is the property of the Firm.
Document Retention
It is our policy to retain engagement documentation for a period of seven years, after which time we will commence the process of destroying the contents of our engagement files. To the extent we accumulate any of your original records during the engagement, those documents will be returned to you promptly upon completion of the engagement, and you will provide us with a receipt for the return of such records.
The balance of our engagement file, other than the compiled financial statements, which we will provide to you at the conclusion of the engagement, is our property, and we will provide copies of such documents at our discretion and if compensated for any time and costs associated with the effort.
In the event we are required to respond to a subpoena, court order or other legal process for the production of documents and/or testimony relative to information we obtained and/or prepared during the course of this engagement, you agree to compensate us at our standard hourly rates then existing for the time we spend in connection with such response, and to reimburse us for all of our out-of-pocket costs incurred in that regard.
In the event that we are or may be obliged to pay any cost, settlement, judgment, fine, penalty, or similar award or sanction as a result of a claim, investigation, or other proceeding instituted by any third party, and if such obligation is or may be a direct or indirect result of any inaccurate or incomplete information that you provide to us during the course of this engagement, you agree to indemnify us, defend us, and hold us harmless as against such obligation.
Provision of Client Personal Data
The Client will provide Client Personal Data to the Firm or the Firm will collect Client Personal Data from the Client and/or the Client’s Authorised Users pursuant to this DPA for the purpose of the Firm rendering Services to the Client, or any other members of the Client Group, and the Firm will have access to the Client Personal Data provided by the Client in the course of rendering the Services.
When the Firm receives the completed and signed DPA as specified below, this DPA becomes a legally binding agreement.
Use of Client Personal Data
In providing the Services to the Client pursuant to the letter of engagement, the Firm may Process Client Personal Data on behalf of the Client. The Firm will comply with the provision of this DPA, with respect to the Processing of Personal Data provided or collected by and/or on behalf of the Client using the Services.
The Firm shall, as instructed by Client, correct, delete or block the data being Processed under the letter of engagement. If an individual should request the correction or deletion of their data, the Firm shall immediately pass this request to the Client. Such instruction shall not impact the delivery of the agreed services, and delivery failures caused by such instructions will be the Client’s responsibility.
Rights and Obligations of Client
The Client is the Data Controller of the Client Personal Data and is responsible for the legitimacy of the Processing of Client Personal Data and any transfer of Client Personal Data to a third party. Data Protection Laws determine the rights and obligations of the Client as a Data Controller as described in this DPA.
You shall only disclose client personal data to us where:
(i) you have provided the necessary information to the relevant data subjects (your employees) regarding its use (and you may use or refer to our privacy notice available at 13 Bridge House, St. Patrick’s Quay, Cork, updated from time to time.
(ii) you have a lawful basis upon which to do so, which, in the absence of any other lawful basis, shall be with the relevant data subject’s consent; and
(iii) you have complied with the necessary requirements under the data protection legislation to enable you to do so.
Should you require any further details regarding our treatment of personal data, please bet in touch contact your main point of contact in our Firm.
As the Data Controller, the Client shall use its right to issue instructions to the Firm, as the Data Processor, on the method of Processing Client Personal Data as well as the services performed by the Firm. The Client’s submission of Personal Data to the Firm and instructions for Processing of Personal Data will comply with Data Protection Laws.
The Client has the right, in relation to Client Personal Data, to review:
the security measures taken by the Firm;
the compliance with Data Protection Laws by the Firm; and
the compliance with this Data Processing Agreement by the Firm, at any time during normal working days and normal working hours, subject to notice given in advance with a reasonable notice period. The review may take place at the Firm’s place of business by inspecting the stored Client Personal Data in a storage facility or data centre and the Processing activities taking place at the premises of the Firm in accordance with the Firm’s security and access policies.
Data is handled exclusively in accordance with the agreed provisions and in accordance with the Client’s instructions. Any alterations to the data being Processed and the procedures employed will be discussed, agreed and recorded. The Firm may supply information to third parties or individuals only if the Client has given prior written consent.
The Firm will not use Client Personal Data for any other purposes, in particular, providing such data to third parties. No copies or duplicates of Client Personal Data will be made without the Client’s knowledge and agreement, except when copies must be made for security purposes to ensure that data can be preserved in order to comply with legal requirements.
Rights and Obligations of The Firm
The Firm shall only Process Client Personal Data to the extent necessary pursuant to the Client’s instructions and as set forth in the letter of engagement. The Client instructs the Firm to Process Client Personal Data:
in accordance with the letter of engagement;
(ii) as part of any Processing initiated by the Client in its use of the Services; and
(iii) to comply with the Client’s reasonable instructions to the extent they are consistent with the terms of the letter of engagement.
The Firm will conduct the Processing in compliance with Data Protection Laws.
The Firm will keep Client Personal Data confidential and ensure Appropriate Security Measures are in place and take appropriate technical, physical and organisational security measures as described in the Privacy Statement to protect Client Personal Data against unauthorised or unlawful Processing, accidental loss or damage or destruction.
For the purpose of providing our services to you, pursuant to our engagement letter, we may disclose the client personal data to members of our firm’s network, our regulatory bodies or other third parties (for example, our professional advisors or service providers). [The third parties to whom we disclose such personal data may be located outside of the European Economic Area (EEA).] We will only disclose client personal data to a third party (including a third party outside of the EEA), provided that the transfer is undertaken in compliance with the data protection legislation.
The Firm is obliged to provide information and cooperate when the Client conducts a review as described in Section 6.4; however, the Firm shall not be required to disclose any commercial or trade secrets (including, without limitation, algorithms, source codes, etc.). The Firm also will reasonably assist the Client (at the Client’s expense) in the event of data protection checks or audits by a data protection authority, to the extent that such checks or audits relate to the Processing under this DPA.
All persons under the Firm’s employ or control who can access Client Personal Data during performing their duties for the Firm must understand the obligations to keep the data confidential and must be bound by an appropriate non-disclosure agreement. The Firm and the Client must instruct their respective employees on their particular data protection obligations arising from this DPA and the existence of their duty to act as directed or for the purpose stipulated.
The Firm will promptly inform the Client of any actual or suspected security breach involving Client Personal Data. The Firm must take adequate remedial measures immediately and must promptly provide the Client with all the relevant information and assistance as reasonably requested by the Client regarding the actual or suspected security breach.
The Firm shall inform the Client as soon as reasonably possible if: (i) a formally designated authority demands the access to Client Personal Data, or (ii) a formally designated authority has taken measures against the Firm, unless the Firm is by law prohibited from informing the Client about the request of such authority or the measures taken.
The Firm agrees with the Client that for the duration of the provision of the Services it shall only process, use and disclose the Client Personal Data for the Permitted Purpose and strictly in accordance with the instructions of the Data Controller as set out in a Specific Request from time to time and in accordance with the terms of this DPA;
The Firm agrees with the Client that for the duration of the provision of the Services it shall not sell, transfer, disclose or allow access to any Client Personal Data to any other party other than those of its officers, employees, agents and contractors to whom, and to the extent to which, such disclosure is necessary for the Permitted Purpose or in accordance with the express approval of the Client;
The Firm agrees with the Client that for the duration of the provision of the Services it shall take reasonable steps to ensure that the Client Personal Data is accurately recorded and kept up to date; and
The Firm agrees with the Client that for the duration of the provision of the Services it shall not perform the Services in such a way as to cause the Client to breach any of its obligations under the Data Protection Laws.
Additional Requirements for Transfer Of Personal Data Outside the EEA
The Client acknowledges and agrees that the performance of the Services involves from time to time a transfer of Client Personal Data from the Firm to Sub-Processors located outside the EEA. In respect of such transfers and where no Alternative Level of Protection applies, the Firm shall ensure that in addition to the requirements described in Section 6 of this DPA, certain additional requirements shall be met.
The additional requirements which must be met pursuant to Section 7.1 above are incorporated in Standard Contractual Clauses which, where required, must be entered between the Firm and a Sub-Processor.
Sub-Processors
The Client acknowledges and expressly agrees that the Firm is entitled to retain any member of the Firm Group (“the Firm Affiliates”) as further sub-processors for the Firm and that the Firm or the Firm Affiliates respectively may engage third-party service providers as sub-processors that may provide Client support, including processing of Client Personal Data, in connection with the Services.
Sub-processors. The Firm shall make available to the Client for the Client’s approval a current list of sub-processors for the Services with the identities of those Sub-processors (“Sub-processor List”) (such approval not to be unreasonably delayed or withheld). This shall be done prior to the Firm authorising those sub-contractors to Process Personal Data supplied by the Client.
Objection Right for new Sub-processors. If the Client has a reasonable basis to object to the Firm’s use of a new Sub-processor, the Client shall notify the Firm promptly in writing within 10 business days after receipt of the Firm’s notice. In the event the Client objects to a new Sub-processor(s) and that objection is not unreasonable, the Firm will use reasonable efforts to make available to the Client a change in the affected Services or recommend a commercially reasonable change to the Client’s configuration or use of the affected Services to avoid processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening the Client. If the Firm is unable to make available such change within a reasonable period of time, which shall not exceed sixty (60) days, the Client may terminate the applicable Service(s) in respect only to those Services which cannot be provided by the Firm without the use of the objected-to new Sub-processor, by providing written notice to the Client. The Client shall receive a refund of any prepaid fees for the period following the effective date of termination in respect of such terminated Services.
All Sub-processors will be subject to data protection obligations at least equivalent to those contained in this DPA under a written agreement, and such sub-processors shall be obliged to comply with applicable Data Protection Laws. Where the Sub-processor fails to fulfil its data protection obligations under such written agreement The Firm shall remain fully liable to the Client for the performance of the sub- processor’s obligations under such agreement.
The Firm shall audit third-party sub-processors that are not the Firm Affiliates at least once per year to ensure they have appropriate physical, technical, organisational, and administrative controls in place. Upon the Client’s reasonable request at reasonable intervals, the Firm shall provide the Client with an executive summary of the most recent audits of such third-party sub-processors.
Upon the Client’s request, the Firm agrees to promptly make available to the Client a copy of an applicable sub-processor data processing agreement executed in relation to this DPA, provided that the Firm may remove any commercial information contained in such agreement. The Client may make available a summary of the agreement, or the agreement if required, to the Client provided that such summary, or the agreement if required, is treated as Confidential Information, including that the Client has entered into a non-disclosure agreement containing confidentiality provisions substantially similar to those set forth in the letter of engagement to protect the Firm’s Confidential Information.
Security
The Firm shall implement Appropriate Security Measures with a view to preventing accidental or unauthorised, loss, destruction, damage, alteration, disclosure or unlawful or unauthorised access to any Client Personal Data in the custody of the Firm, and the Firm shall ensure that its personnel are aware of and comply with those measures. This will include but is not limited to maintaining commercially reasonable and appropriate security measures, including administrative, physical and technical safeguards, to protect against unauthorised or unlawful processing of the client personal data and against accidental loss or destruction of, or damage to, the client personal data
Breach
Notice: The Firm shall notify all incidents of loss of control of Client Personal Data to the Client, as soon as it becomes aware of the incident and in any event no later than 24 hours after so becoming aware.
Remedy: In the event of any such breach, the Firm shall:
take prompt action at its own expense on the instruction of the Client to remedy the cause of the breach;
bear the costs of investigation into said breach; and
promptly, and at its own expense provide the Client on request with all information required by the Client to fulfil its obligations, as data controller, under all applicable laws, regulations and codes of practice.
The Firm shall promptly notify the Client of each request from a data subject for access to Client Personal Data relating to him or her. The Firm shall not accede to any such request for access except on the instructions of the Client.
Indemnity
The Client shall indemnify the Firm on demand from time to time from and against all Losses suffered or incurred by the Firm arising out of or in connection with the breach by the Client of its obligations under this DPA. The provision of this Clause shall continue in force and effect without limit in time after the termination of the provision of the Services.
Duration
This DPA will enter into effect on the Effective Date and will remain effective notwithstanding termination of the letter of engagement. Where Client Personal Data is no longer required by the Firm for the performance of the Services, the Firm will either return such data immediately after termination of the letter of engagement or destroy it if requested to do so by the Client. At such time when Client Personal Data is either returned or destroyed, this DPA will expire automatically.
To the extent required by applicable Data Protection Laws, this DPA shall be governed by the applicable law of the applicable jurisdiction. In other cases, this DPA will be governed by the laws of the same jurisdiction in the letter of engagement.
Conflicting Provisions
The DPA supersedes any conflicting terms in the letter of engagement. Notwithstanding the foregoing, the letter of engagement and the terms of this DPA apply only between the parties and do not confer any rights to any third-party Data Subjects.
This DPA does not replace any additional rights or obligations related to processing of Client Data in the letter of engagement.
Notices
The parties will send any communications or notices required under this DPA in writing, which includes by fax or e-mail, to the address of the Firm shown on the covering letter attached to this, agreement.