Last updated: September 2026
At Malone & Co., we respect your privacy and are committed to protecting your personal data.
This Privacy Notice explains how we collect, use, share and protect personal data, the legal grounds on which we process it and the rights available to you under data protection law.
It applies to personal data we process in connection with our professional services, business activities, website, recruitment and communications.
Malone & Co. provides accountancy, audit, tax, payroll, bookkeeping, advisory and related professional services.
Depending on the nature of the engagement and the services being provided, the data controller responsible for your personal data may be:
Malone & Company Accountants Limited
Registered in Ireland
Company Registration Number: 496503
and/or
Malone & Co Audit Limited
Registered in Ireland
Company Registration Number: 663450
A data controller determines why and how personal data is processed. In some circumstances, a Malone & Co. entity may process personal data on behalf of a client or another organisation. Where this applies, the relevant client or organisation may be the data controller and Malone & Co. may act as a data processor.
References in this Privacy Notice to “Malone & Co.”, “we”, “us” or “our” refer to the relevant Malone & Co. entity responsible for the processing.
Registered or business address: Landscape House, Baldonnell Business Park, Dublin 22, D22 P3K7, Ireland
Telephone: +353 (0)1 458 0911
Privacy enquiries: info@maloneaccountants.ie
This Privacy Notice may apply to:
Where we receive personal data about you from a client or another third party, that organisation may also be responsible for providing you with relevant privacy information
The personal data we collect depends on your relationship with us and the nature of the services we provide.
It may include:
Identity and contact information
This may include your name, title, date of birth, address, telephone number, email address, nationality, marital status, PPS number and other identifying information.
Client and business information
This may include details about your business, ownership interests, directorships, employment, professional activities, business relationships, governance responsibilities and correspondence with us.
Financial and tax information
This may include bank details, income, assets, liabilities, investments, transactions, financial statements, accounting records, tax information, tax reference numbers and details of payments made to or received from you.
Payroll and employment information
Where we provide payroll, tax or related services, we may process information about employment, remuneration, benefits, leave, deductions, pensions and payment details.
Identification and compliance information
This may include copies of identification documents, proof of address, information about beneficial ownership and information required for anti-money laundering, sanctions, fraud prevention and other regulatory checks.
Special-category personal data
In limited circumstances, we may process more sensitive information, such as health information, trade union membership or other special-category personal data.
We only process special-category personal data where it is necessary and where an appropriate legal basis and additional condition for processing apply.
Website and technical information
When you use our website, we may collect technical information such as your IP address, browser type, device information, operating system, pages viewed, referral source and interactions with the website.
Further information about the technologies used on our website is available in our Cookie Notice.
Recruitment information
If you apply for a role, we may collect your CV, employment history, qualifications, professional memberships, references, interview notes, right-to-work information and other information you provide during the recruitment process.
Communications
We may retain emails, letters, meeting notes, telephone records and other communications exchanged with you or relating to the services we provide.
We may collect personal data:
Where personal data has not been collected from you directly, we will provide the information required by data protection law unless an applicable exemption applies.
We may use personal data to:
The purpose for which we use your personal data will depend on the circumstances in which it was collected and your relationship with us.
We only process personal data where there is an appropriate legal basis.
Depending on the circumstances, we may rely on one or more of the following:
Performance of a contract
We may process personal data where it is necessary to enter into or perform a contract with you, including providing services you have requested.
Legal obligation
We may process personal data where necessary to comply with legal, regulatory and professional obligations. These may include obligations relating to tax, company law, audit, anti-money laundering, financial sanctions, employment, record-keeping and regulatory reporting.
Legitimate interests
We may process personal data where it is necessary for our legitimate business or professional interests, provided those interests are not overridden by your rights and interests.
These interests may include:
managing and developing our business;
providing and improving our services;
managing professional relationships;
maintaining appropriate client and business records;
ensuring the security of our premises, systems and information;
managing risk, quality and professional obligations;
preventing fraud and misuse;
recovering amounts owed to us; and
communicating with clients and professional contacts about relevant services, developments and events.
Where we rely on legitimate interests, we consider the nature of the information, the impact of the processing and the safeguards available to protect your rights.
Consent
We may rely on your consent for certain processing activities where consent is the appropriate legal basis.
Where we rely on consent, you may withdraw it at any time. Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.
Legal claims
We may process personal data where necessary to establish, exercise or defend legal claims.
For special-category personal data, we will also ensure that an additional condition permitted by data protection law applies.
The Irish Data Protection Commission requires organisations to explain why information is processed and the relevant legal basis. Where legitimate interests are relied upon, those interests should also be identified.
In some circumstances, we require personal data to:
If the required information is not provided, we may be unable to accept an engagement, continue acting, provide certain services or comply with your instructions.
We may share personal data where necessary for our services, business operations, legal obligations or another lawful purpose.
Depending on the circumstances, recipients may include:
Where a third-party service provider processes personal data on our behalf, we require it to protect the information and process it only in accordance with our instructions and applicable law.
We do not sell personal data.
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to meet applicable legal, regulatory, contractual and professional obligations.
The appropriate retention period depends on factors including:
At the end of the applicable retention period, personal data will be securely deleted, destroyed or anonymised, unless there is a lawful reason to retain it for longer.
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
These measures may include access controls, authentication requirements, security monitoring, staff training, secure storage, backup procedures, supplier due diligence and contractual protections.
Access to personal data is limited to individuals and service providers who require it for an authorised purpose.
While we take reasonable steps to protect personal data, no system or method of transmission can be guaranteed to be completely secure.
Where permitted by law, we may use your contact information to send you relevant updates, insights, event invitations and information about our services.
We may rely on consent or legitimate interests, depending on the communication, your relationship with us and the requirements of applicable law.
You can ask us to stop sending marketing communications at any time by:
Opting out of marketing will not prevent us from contacting you about an existing engagement, a service you have requested, a legal or regulatory matter or another non-marketing purpose.
Our website may use cookies and similar technologies to operate effectively, remember preferences, understand how the website is used and improve the user experience.
Where required by law, non-essential cookies will only be used with your consent. You can manage your preferences through our cookie banner or settings tool.
More information about the cookies and technologies used on our website, including their purposes and duration, is available in our Cookie Notice.
We do not make decisions about individuals based solely on automated processing where those decisions produce legal or similarly significant effects, unless we have informed the individual and the processing is permitted by law.
If this changes, we will provide appropriate information about the processing, the logic involved, the likely consequences and the rights available to affected individuals.
Subject to applicable conditions, restrictions and exemptions, you may have the right to:
Access your personal data
You can ask for confirmation that we process your personal data and request a copy of that information.
Correct your personal data
You can ask us to correct personal data that is inaccurate or complete information that is incomplete.
Request erasure
You can ask us to delete personal data in certain circumstances.
The right to erasure is not absolute. We may need to retain information to comply with a legal or regulatory obligation, provide professional services, maintain required records or establish, exercise or defend legal claims.
Restrict processing
You can ask us to restrict the use of personal data in certain circumstances.
Object to processing
You can object to processing based on legitimate interests or the performance of a task in the public interest.
You also have the right to object at any time to the use of your personal data for direct marketing.
Data portability
In certain circumstances, you can ask to receive personal data you provided to us in a structured, commonly used and machine-readable format. You may also ask us to transmit that information to another controller where technically feasible.
Withdraw consent
Where we rely on consent, you can withdraw it at any time. Withdrawal will not affect the lawfulness of processing carried out before consent was withdrawn.
Rights relating to automated decisions
Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.
Make a complaint
You have the right to raise a concern with us and to make a complaint to the Irish Data Protection Commission.
These rights are not absolute and will depend on the circumstances and the legal basis for processing. The GDPR provides rights including access, correction, erasure, restriction, objection and portability, subject to the relevant conditions and exceptions.
Email: info@maloneaccountants.ie
Post: Landscape House, Baldonnell Business Park, Dublin 22, D22 P3K7, Ireland
Telephone: +353 (0)1 458 0911
Please provide enough information to help us identify you, understand your request and locate the relevant personal data.
We may need to request proof of identity or additional information before responding. This is to ensure that personal data is not disclosed to someone who is not entitled to receive it.
We will respond without undue delay and normally within one month. In certain circumstances, the response period may be extended by a further two months if the request is complex or if multiple requests have been made. If an extension is required, we will explain the reason.
We will not normally charge a fee. However, GDPR permits a reasonable fee or refusal where a request is manifestly unfounded or excessive, particularly where it is repetitive.
If you have concerns about how we process your personal data, please contact us first so that we have an opportunity to address them.
You also have the right to make a complaint to the Irish supervisory authority:
Data Protection Commission
21 Fitzwilliam Square South
Dublin 2
D02 RD28
Ireland
Website: www.dataprotection.ie
Telephone: +353 1 765 0100
Lo-call: 1800 437 737
The Data Protection Commission is Ireland’s supervisory authority for GDPR under the Data Protection Act 2018.
Our website may contain links to websites operated by third parties.
We are not responsible for the privacy, security or content of third-party websites. We recommend reviewing the privacy notice of any third-party website before providing personal data.
We may update this Privacy Notice from time to time to reflect changes in our services, processing activities, systems or legal and regulatory obligations.
The most recent version will be published on our website with the date on which it was last updated. Where appropriate, we may also notify affected individuals of material changes.
