The personal data we hold, and your rights over it.

Innate Audit provides statutory audit services to UK companies. For the personal data described on this page, we are the data controller. You can reach us about anything here through the contact details on this site.

This page covers personal data — information about identifiable people. How we handle client business records during an audit is described on the data processing page, and the services that process data on our behalf are listed on the sub-processors page.

Enquiries and quotes: the name, email address and company details you give us when you ask for a quote, so we can respond. Documents sent with a quote request are deleted if you do not go ahead.

Client portal accounts: the name, email address and role of the people our clients invite to their engagement, so the right people can sign in and we can attribute what is done in the portal to who did it. Sign-in is handled by our authentication provider; we never see or store passwords.

Audit confirmations: where we write to a client's bank or customers as part of an audit, we hold the business contact details used, and when a reply comes through our reply page we record the responder's email address, the time, and a hashed form of their network address — audit evidence must show where it came from.

The audit trail: the portal records who did what and when. That is a professional requirement of audit documentation, not analytics.

Performing an audit engagement and running the portal that delivers it: contract, and our legal obligations as auditors. Responding to enquiries: our legitimate interest in answering people who contact us. Confirmation records and the audit trail: our legal obligations under auditing standards.

Personal data is held in the UK and EU (our primary storage is London, AWS eu-west-2), encrypted at rest. It is never used to train any model, by us or by any vendor we use, and we do not sell it.

Anything that forms part of audit documentation is retained for at least six years from the date of the auditor's report, as ISQM (UK) 1 requires — during that period the assembled file cannot be altered or deleted, by us or anyone else. Enquiry data that does not lead to an engagement is deleted.

You can ask us what we hold about you, ask for corrections, and — where the data is not something we are required to keep as audit documentation — ask for deletion. UK GDPR gives us one month to respond.

If you are not satisfied with how we handle your data or your request, you can complain to the Information Commissioner's Office at ico.org.uk.

The site and portal use the cookies needed to keep you signed in and to protect forms from abuse, and basic product analytics that help us see what is used. Nothing here tracks you across other sites, and there is no advertising.