Privacy policy

Who I am

Practice Insider is an independent publication serving operators inside accounting and advisory firms. The data controller is Abdur Rehman, trading as Practice Insider.

For anything in this policy, write to privacy@practiceinsider.com.

What I collect, why, and on what legal basis

Under UK GDPR every use of your data needs a lawful basis. Mine, in full:

The newsletter

• What: your email address.
• Why: to send you the newsletter you asked for.
• Basis: consent. Withdraw it with the unsubscribe link in any edition, or by emailing me. It takes effect immediately.

Being profiled in Profiles

• What:your name, role, email, optional phone, your firm's name, location, year established, size bands, software, services, and what you write about how you run the practice. If your profile proceeds, also a photograph and the profile text itself.
• Why: to assess the application against the published criteria, verify it, and, only if you consent and approve the result, publish it.
• Basis: consent, captured separately for each purpose. Nothing is published without your explicit consent and your approval of the finished profile.

Research

• What: anonymised, aggregated characteristics only, region, year established, size bands, industry mix, software, services. Never your name, firm, location, contact details, or revenue.
• Basis: a separate consent. Consenting to a profile is not consent to research use. They are distinct choices, and I treat them that way. If you did not tick the research box, your data is excluded from every export and every published figure.

Information I hold that is not published

Revenue band, contact details, and my internal notes are collected for verification and editorial judgement only. They are never published, and my systems prevent them being read by anyone outside the desk.

Preventing abuse of my forms

• What: a one-way scrambled version of your IP address. I cannot read your IP address from it, but I treat it as personal data.
• Why: to stop automated abuse of the public forms.
• Basis: legitimate interests, keeping the forms usable. Kept for 30 days.

Analytics

Plausible provides cookie-free aggregate measurement. Google Analytics loads only if you accept analytics in the privacy prompt (consent). Analytics do not run on my internal dashboard. Details are in my cookies policy.

Information I receive about you from someone else

Anyone can nominate a practice for Profiles. That means I may receive information about you, your name, your firm, its location, and the nominator's reasons, from a third party, before you know anything about it.

UK GDPR gives you specific protections here, and this is how I honour them:

• I will contact you within one month of receiving a nomination, or I delete it. Nominations I do not act on are deleted automatically after 30 days.
• A nomination is only ever a prompt for a conversation. Nothing about you is published unless you go through the application process yourself, consent, and approve the finished profile.
• You can ask me who nominated you, object to me holding the nomination at all, or ask me to delete it, at any time, by emailing privacy@practiceinsider.com.
• Basis: legitimate interests, considering practices for an editorial record, balanced against your rights, which is why the window is short and the outcome is always a conversation rather than a publication.

If you nominate someone, tell them. I may need to say who nominated them when I make contact, because a nomination out of nowhere is unsettling and people are entitled to ask.

How long I keep things

• Newsletter address: until you unsubscribe.
• Applications: 24 months after the outcome, so I have context if you apply again.
• Declined applications: 12 months.
• Nominations I do not act on: 30 days, deleted automatically.
• Published profiles: while published, then 12 months after removal.
• Form abuse-prevention data: 30 days.

Who else handles your data

I do not sell, rent, or trade personal data, and I never share it with third parties for their own marketing. I do rely on these providers:

• Supabase, database. Profile data is held in the United Kingdom (London region).
• Cloudflare, file storage. Photographs, and any documents you send me, are stored in the European Union. Moving them between the UK and the EU is permitted under the UK’s adequacy regulations for the EEA, which recognise EU data protection law as offering equivalent protection.
• Vercel, website hosting and delivery.
• Plausible, cookie-free analytics, hosted in the EU.
• Google Analytics, analytics, only after you accept. These involve transfers to the United States, made under the UK Addendum to the EU Standard Contractual Clauses and, where applicable, the UK extension to the EU-US Data Privacy Framework.

Your rights

You have the right to:

• see what I hold about you, and get a copy;
• have inaccurate information corrected;
• have your information deleted;
• restrict or object to how I use it;
• receive it in a portable, machine-readable form;
• withdraw any consent at any time, including asking me to unpublish your profile, which I will do.

Email privacy@practiceinsider.com and I will respond within one month. Withdrawing consent is as easy as giving it, and costs you nothing.

If you are unhappy with how I have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. I would rather you told me first so I can put it right, but that is entirely your choice.

Automated decisions

I do not make automated decisions about you. Every nomination and enquiry is read and judged by a person.

Cookies

Covered separately in my cookies policy.

Changes to this policy

Material changes will be noted at the top of this page with a revised “last updated” date.