O’Neill Foley and O’Neill Foley Unlimited Company


Changes in the law

We will not accept responsibility if you act on advice given by us on an earlier occasion without first
confirming with us that the advice is still valid in the light of any change in the law or your

We will accept no liability for losses arising from changes in the law or the interpretation thereof that are
first published after the date on which the advice is given.

Client Monies

We may, from time to time, hold money on your behalf. Such money will be held in trust in a separately
denominated Clients’ Money bank account, which is segregated from the firm’s funds. The account will be operated, and all funds dealt with, in accordance with the Clients’ Monies Rules of the Central Bank of

Fees paid by you in advance for professional work to be performed and clearly identifiable as such shall not be regarded as clients’ monies.

Quality Control

As part of our ongoing commitment to providing a quality service, some of our files may periodically be
subject to an independent quality review. The reviewers are highly experienced and professional people
and, of course, are bound by the same requirements for confidentiality as our partners and staff.

Liability Provisions

We will provide the professional services outlined in this letter with reasonable care and skill. However, we will not be responsible for any losses, penalties, surcharges, interest or additional tax liabilities arising from the supply by you or others of incorrect or incomplete information, or from the failure by you or others to supply any appropriate information or your failure to act on our advice or respond promptly to communications from us or the Revenue Commissioners.

The total aggregate liability to you, as a chair partners, of whatever nature, whether in contract, tort or
otherwise, of O’Neill Foley and O’Neill Foley Unlimited Company their partners, directors or employees for any losses whatsoever and howsoever caused arising from or in any way connected with this engagement shall not exceed five times the estimated fees paid for this assignment. We are not seeking to exclude those liabilities (such as liability for our own fraud) which cannot be excluded by law.

The advice which we give to you is for your sole use and does not constitute advice to any third party to
whom you may communicate it.

Investment Business

The firm is registered with Chartered Accountants Ireland for carrying out investment business activities and may therefore provide a range of investment business services that arise out of the provision of our main professional services. If we are required to provide advice, we will issue a separate letter of engagement. As and from 1st October 2018 the Authorisation to carry on investment business will transfer to the Central Bank of Ireland under the appropriate transitional arrangements.

Commissions or Other Benefits

In some circumstances, commissions or other benefits may become payable to us or to one of our associates in respect of transactions which we or such associates arrange for you, in which case you will be notified in writing of the amount and terms of payment. The fees that would otherwise be payable by you as described will take into account the benefit to us of such amounts.

We will disclose to you, in writing the specific amount of any commission or other benefits being retained by us or, as the case may be, by our associates, in advance of obtaining your express written consent to retain such commissions.

Retention of Records

During the course of our work we will collect information from you and others acting on your behalf and
will return any original documents to you following preparation of your income tax return. You should
retain them for seven years from the end of the relevant accounting period. This period may be extended if the Revenue Commissioners enquire into your income tax returns.

Though certain documents may legally belong to you, we intend to destroy correspondence and other papers that we store which are more than seven years old, other than documents that we consider to be of continuing significance. You must inform us by letter if you require retention of a particular document.

We may choose to hold these documents where possible in an electronic format. In this event, we will
ensure these documents are readily accessible should they be requested by yourself or an authorised

Best Service

We shall endeavor at all times to provide you with a professional service of the highest quality. If,
however, you are dissatisfied with our service in any way you should contact, David Walsh Managing
Partner , who will undertake to look into any complaint carefully and promptly. If we have given you a
less than satisfactory service, we will undertake to do everything reasonable to put it right. If you feel
that a complaint is not properly addressed or if you consider that the partner responsible for your affairs
is not appropriate for the initial contact, please contact Alan Seery

If you are still dissatisfied, you may make a formal complaint to Chartered Accountants Ireland

Anti – Money laundering – Reporting Suspicions

The provision of audit, accounting and taxation services are businesses in the regulated sector under the
Criminal Justice (Money Laundering and Terrorist Financing) Act, 2010 and the Criminal Justice Act,
2013, and as such, partners and staff in audit, accounting and taxation firms are required, under the antimoney laundering regime in the Republic of Ireland, to report any suspicion that a criminal offence
giving rise to proceeds from criminal conduct has been or is being committed, regardless of whether that
offence has been committed or is being committed by their client or by a third party.

If as part of our normal work, we form a suspicion that such an offence has been or is being committed
we are required to make a report to the Garda Síochána and the Revenue Commissioners. In such
circumstances, it is not our practice to discuss such reports with you because of the restrictions on
disclosure imposed on us by the anti-money laundering legislation.

Client identification

We are required to identify our clients for the purposes of the anti-money laundering legislation. We are
likely to request from you, and retain, some information and documentation for these purposes and/or to make searches of appropriate databases.

If satisfactory evidence of your identify is not provided within a reasonable time, there may be
circumstances in which we are not able to proceed with the appointment.

Additional Legal Responsibilities – Criminal Law

Where, in the course of conducting professional work, it comes to the attention of certain “relevant
persons” (the definition of which includes auditors), that information or documents indicate that an
offence may have been committed under Section 59, Criminal Justice (Theft and Fraud Offences) Act,
2001, such suspicions must be reported to the Garda Síochána. This applies regardless of the apparent
materiality of the suspected offence, or whether the suspected offence has already been reported to the
relevant authorities. We have similar responsibilities under the Criminal Justice Act, 2011.

Applicable Law

This engagement letter is governed by, and construed in accordance with, Republic of Ireland law. The
Courts of the Republic of Ireland will have exclusive jurisdiction in relation to any claim, dispute or
difference concerning this engagement letter and any matter arising from it. Each party irrevocably
waives any right it may have to object to any action being brought in those courts, to claim that the action has been brought in an inappropriate forum, or to claim that those courts do not have jurisdiction.

All work performed is conducted using the current legislation according to the accounting period. We
cannot be held responsible for future development and changes in the legislation.

Data Protection Agreement (DPA)

We are committed to ensuring the protection of the privacy and security of any personal data which we
process. Your attention is drawn to these terms of business which detail how we treat personal data received by us in the provision of our services during our engagement with you. By signing this engagement letter, you confirm that you have read and understood the Data Protection clauses and any privacy notice referred to therein.

Definitions & Interpretation

In this DPA, the following definitions apply:

Alternative Adequate Level of Protection means

  1. the country where the Firm or a Sub-processor is located
    is recognised by the European Union to have a similar or adequate level of protection of Personal Dataas described in Data Protection Laws, or
  2. the Firm or the Sub-processor has fully implemented binding corporate rules which provide adequate safeguards as required by the Data Protection Laws, or has any other similar program that is recognised as providing an adequate level of protection.

Appropriate Security Measures meansappropriate security measures required by Data Protection Laws to protect against unauthorised access to, alteration, disclosure or destruction of data and against their accidental loss or destruction and, in particular, where the processing involves the transmission of data over a network, it shall mean having regard to the state of technological development and the cost of implementing the measures, and ensuring that the measures provide a level of security appropriate to:

The harm that might result from unauthorised or unlawful processing, accidental or unlawful destruction or accidental loss of or damage to the data concerned, a the nature of the data;

Client means the Client entity (as identified on the cover page of this letter of engagement) that is a party to the DPA and who is the Data Controller of the Client Personal Data.

Client Group means all companies that are part of the Client ownership group.

Client Personal Data means personal data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the Client and that is provided to the Firm (being the accounting firm providing the services set out in this engagement letter) or collected by the Firm from the Client for the purpose of
the Firm rendering Services to the Client.

Data Controller means the Client who, either alone or with others (known as a ‘joint controller’ in Article 21 of the GDPR), controls the contents and use of personal data. Both the Firm and the Client shall each also be considered an independent data controller, and/or joint controllers, in certain circumstances, in relation to the client personal data. Each of us will comply with all requirements and obligations applicable to us under the data protection legislation in respect of the client personal data.

Data Processor means any natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller but does not include an employee of the Data Controller who processes such data in the course of his employment.

Data Protection Laws means all legislation and regulations relating to the protection of personal data
including (without limitation) the Data Protection Acts 1988 to 2018 of Ireland, the General Data
Protection Regulation (‘GDPR’) (General Data Protection Regulation (Regulation (EU) 2016/679 of
the European Parliament and of The Council of 27 April 2016),including the ‘PECR’ and all other
industry guidelines (whether statutory or non-statutory) or codes of practice or guidance issued by the
Data Protection Commission or relevant Irish Supervisory Authority (as defined in the GDPR) relating
to the processing of personal data or privacy or any amendments and re-enactments thereof.

Data Subject means the individual who is identified or an identifiable natural person who’s Client Personal Data is, or is to be, processed.

The Firm means O’Neill Foley and O’Neill Foley Unlimited Company that is a party to this DPA and who is the Data Processor of the Client Personal Data.

The Firm Group means the firm and all companies that are part of the Firm company group, including nontrading entities; ONF Cloud Accountants Ltd, ONF Corporate Secretaries Ltd and ONF Financial
Services Ltd.

EEA means European Economic Area.

Firm means the incorporated or unincorporated accountancy firm that is the processor of the client data. In some circumstances the Firm will also be a data controller and will handle client data in accordance with Data Protection Laws.

Loss includes any demand, claim, proceeding, suit, judgement, loss, liability, cost, expense, fee, penalty or fine.

Permitted Purpose means the purpose required by the Client from the performance of the Services by the Firm or any Specific Request.

‘PECR’ means the European Communities (Electronic Communications Networks and Services) (Privacy
and Electronic Communications) Regulations 2011 (SI 336 of 2011).

Privacy Statement means the Firm privacy statement located at www.onf.ie/privacystatement updated from time to time.

Process or Processing means any operation or set of operations which is performed upon Client Personal Data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction. Any derivative of the word Process has a corresponding meaning.

Specific Request means any instruction, in email or other form, to the Firm stating the specific services that the Client requires and containing the information required by the Firm to perform those specific Services.

Standard Contractual Clauses means the Commission Decision of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in non-adequate countries, as defined under Data Protection Laws.

Sub-processor means any Data Processor engaged by the Firm to perform Services.

Application of DPA: The provisions of this DPA shall apply to Client Personal Data to which the Firm had access on any date prior to the date of this DPA (the “Prior Date”) as if this DPA had been executed
and come into force on the Prior Date and all Client Personal Data to which the Firm has had accesssince the Prior Date.

Status of the Parties

Status: The parties acknowledge that, in relation to Client Personal Data, and for the purposes of the Data Protection law, the Firm is a Data Processor. Both the Firm and the Client shall each also be considered an independent data controller, in certain circumstances, in relation to the client personal data. Each of us will comply with all requirements and obligations applicable to us under the data protection legislation in respect of the client personal data.

Cooperation: Upon the reasonable request of the other, we shall each co-operate with the other and take such reasonable commercial steps or provide such information as is necessary to enable each of us to comply with the data protection legislation in respect of the services provided to you in accordance with our engagement letter with you in relation to those services;

Ownership: As between the Client (the Data Controller) and the Firm (the Data Processor), all Client Personal Data shall at all times be the property of the Client and/or the Client’s Authorised Users, except in the case of audit working papers created by the Firm, while acting as principal, in which case the data is the property of the Firm.

Document Retention

It is our policy to retain engagement documentation for a period of seven years, after which time we will
commence the process of destroying the contents of our engagement files. To the extent we accumulate any of your original records during the engagement, those documents will be returned to you promptly upon completion of the engagement, and you will provide us with a receipt for the return of such records.

The balance of our engagement file, other than the [compiled financial statements and] [income tax return submitted] [amend as necessary], which we will provide to you at the conclusion of the engagement, is our property, and we will provide copies of such documents at our discretion and if compensated for any time and costs associated with the effort.

In the event we are required to respond to a subpoena, court order or other legal process for the production of documents and/or testimony relative to information we obtained and/or prepared during the course of this engagement, you agree to compensate us at our standard hourly rates then existing for the time we spend in connection with such response, and to reimburse us for all of our out-of-pocket costs incurred in that regard.

In the event that we are or may be obliged to pay any cost, settlement, judgment, fine, penalty, or similar award or sanction as a result of a claim, investigation, or other proceeding instituted by any third party, and if such obligation is or may be a direct or indirect result of any inaccurate or incomplete information that you provide to us during the course of this engagement, you agree to indemnify us, defend us, and hold us harmless as against such obligation.

Provision of Client Personal Data

The Client will provide Client Personal Data to the Firm or the Firm will collect Client Personal Data from the Client and/or the Client’s Authorised Users pursuant to this DPA for the purpose of the Firm rendering Services to the Client, or any other members of the Client Group, and the Firm will have access to the Client Personal Data provided by the Client in the course of rendering the Services.

When the Firm receives the completed and signed Letter of Engagement including this DPA, this
DPA becomes a legally binding agreement.

Use of Client Personal Data

In providing the Services to the Client pursuant to the letter of engagement, the Firm may Process Client
Personal Data on behalf of the Client. The Firm will comply with the provision of this DPA, with respect
to the Processing of Personal Data provided or collected by and/or on behalf of the Client using the Services.

The Firm shall, as instructed by Client, correct, delete or block the data being processed under the letter ofengagement. If an individual should request the correction or deletion of their data, the Firm shall
immediately pass this request to the Client. Such instruction shall not impact the delivery of the agreed
services, and delivery failures caused by such instructions will be the Client’s responsibility.

Rights and Obligations of Client

The Client is the Data Controller of the Client Personal Data and is responsible for the legitimacy of the
Processing of Client Personal Data and any transfer of Client Personal Data to a third party. Data Protection Laws determine the rights and obligations of the Client as a Data Controller as described in this DPA.

You shall only disclose client personal data to us where:

  1. You have provided the necessary information to the relevant data subjects (your employees)
    regarding its use (and you may use or refer to our privacy statement available at www.onf.ie/privacystatement)
  2. You have a lawful basis upon which to do so, which, in the absence of any other lawful basis, shall
    be with the relevant data subject’s consent; and
  3. You have complied with the necessary requirements under the data protection legislation to enable
    you to do so.

Should you require any further details regarding our treatment of personal data, please get in touch contact your main point of contact in our Firm.

As the Data Controller, the Client shall use its right to issue instructions to the Firm, as the Data Processor, on the method of Processing Client Personal Data as well as the services performed by the Firm. The Client’s submission of Personal Data to the Firm and instructions for Processing of Personal Data will comply with Data Protection Laws.

The Client has the right, in relation to Client Personal Data, to review:

The security measures taken by the Firm;

The compliance with Data Protection Laws by the Firm; and

The compliance with this Data Processing Agreement by the Firm, at any time during normal        working days and normal working hours, subject to notice given in advance with a reasonable notice period. The review may take place at the Firm’s place of business by inspecting the stored Client Personal Data in a storage facility or data centre and the Processing activities taking place at the premises of the Firm in accordance with the Firm’s security and access policies.

Data is handled exclusively in accordance with the agreed provisions and in accordance with the Client’s
instructions. Any alterations to the data being Processed and the procedures employed will be discussed,
agreed and recorded. The Firm may supply information to third parties or individuals only if the Client has given prior written consent.

The Firm will not use Client Personal Data for any other purposes, in particular, providing such data to third parties. No copies or duplicates of Client Personal Data will be made without the Client’s knowledge and agreement, except when copies must be made for security purposes to ensure that data can be preserved in order to comply with legal requirements.

Rights and Obligations of the Firm

The Firm shall only Process Client Personal Data to the extent necessary pursuant to the Client’s instruction and as set forth in the letter of engagement. The Client instructs the Firm to Process Client Personal Data:

In accordance with the letter of engagement;

  1. As part of any Processing initiated by the Client in its use of the services outlined in this letter; a
  2. To comply with the Client’s reasonable instructions to the extent they are consistent with the terms of the letter of engagement.

The Firm will conduct the Processing in compliance with Data Protection Laws.

The Firm will keep Client Personal Data confidential and ensure Appropriate Security Measures are in
place and take appropriate technical, physical and organisational security measures as described in the
Privacy Statement to protect Client Personal Data against unauthorised or unlawful Processing, accidental loss or damage or destruction.

For the purpose of providing our services to you, pursuant to our engagement letter, we may disclose the client personal data to our regulatory bodies or other third parties (for example, our professional advisors or service providers). [The third parties to whom we disclose such personal data may be located outside of the European Economic Area (EEA).] We will only disclose client personal data to a third party (including a third party outside of the EEA), provided that the transfer is undertaken in compliance with the data protection legislation.

The Firm is obliged to provide information and cooperate when the Client conducts a review as described in Section 6.4; however, the Firm shall not be required to disclose any commercial or trade secrets (including, without limitation, algorithms, source codes, etc.). The Firm also will reasonably assist the Client (at the Client’s expense) in the event of data protection checks or audits by a data protection authority, to the extent that such checks or audits relate to the Processing under this DPA.

All persons under the Firm’s employ or control who can access Client Personal Data during performing their duties for the Firm must understand the obligations to keep the data confidential and must be bound by an appropriate non-disclosure agreement. The Firm and the Client must instruct their respective employees on their particular data protection obligations arising from this DPA and the existence of their duty to act as directed or for the purpose stipulated.

The Firm will promptly inform the Client of any actual or suspected security breach involving Client
Personal Data. The Firm must take adequate remedial measures immediately and must promptly provide the Client with all the relevant information and assistance as reasonably requested by the Client regarding the actual or suspected security breach.

The Firm shall inform the Client as soon as reasonably possible if: (i) a formally designated authority
demands the access to Client Personal Data, or (ii) a formally designated authority has taken measures against the Firm, unless the Firm is by law prohibited from informing the Client about the request of such authority or the measures taken.

The Firm agrees with the Client that for the duration of the provision of the Services it shall only process, use and disclose the Client Personal Data for the Permitted Purpose and strictly in accordance with the instructions of the Data Controller as set out in a Specific Request from time to time and in accordance with the terms of this DPA;

The Firm agrees with the Client that for the duration of the provision of the Services it shall not sell, transfer, disclose or allow access to any Client Personal Data to any other party other than those of its officers, employees, agents and contractors to whom, and to the extent to which, such disclosure is necessary for the Permitted Purpose or in accordance with the express approval of the Client;

The Firm agrees with the Client that for the duration of the provision of the Services it shall take reasonable steps to ensure that the Client Personal Data is accurately recorded and kept up to date; and

The Firm agrees with the Client that for the duration of the provision of the Services it shall not perform the Services in such a way as to cause the Client to breach any of its obligations under the Data Protection Laws.

Additional Requirements for Transfer of Personal Data outside the EEA

The Client acknowledges and agrees that the performance of the Services involves from time to time a
transfer of Client Personal Data from the Firm to Sub-Processors located outside the EEA. In respect of such transfers and where no Alternative Level of Protection applies, the Firm shall ensure that in addition to the requirements described in Section 6 of this DPA, certain additional requirements shall be met. The additional requirements which must be met pursuant to Section 7.1 above are incorporated in Standard Contractual Clauses which, where required, must be entered between the Firm and a Sub-Processor.


The Client acknowledges and expressly agrees that the Firm is entitled to retain any member of the Firm
Group (“the Firm Affiliates”) as further sub-processors for the Firm and that the Firm or the Firm Affiliates respectively may engage third-party service providers as sub-processors that may provide Client support, including processing of Client Personal Data, in connection with the Services.

Sub-processors. The Firm shall make available to the Client for the Client’s approval a current list of subprocessors for the Services with the identities of those Sub-processors (“Sub-processor List”) (such approval not to be unreasonably delayed or withheld). This shall be done prior to the Firm authorising those subcontractors to Process Personal Data supplied by the Client.

Objection Right for new Sub-processors. If the Client has a reasonable basis to object to the Firm’s
use of a new Sub-processor, the Client shall notify the Firm promptly in writing within 10 business days
after receipt of t he Firm’s notice. In the event the Client objects to a new Sub-processor(s) and that
objection is not unreasonable, the Firm will use reasonable efforts to make available to the Client a change in the affected Services or recommend a commercially reasonable change to the Client’s configuration or use of the affected Services to avoid processing of Personal Data by the objected-to new Sub-processor without unreasonably burdening the Client. If the Firm is unable to make available such change within a reasonable period of time, which shall not exceed sixty (60) days, the Client may terminate the applicable Service(s) in respect only to those Services which cannot be provided by the Firm without the use of the objected-to new Sub-processor, by providing written notice to the Client. The Client shall receive a refund of any prepaid fees for the period following the effective date of termination in respect of such terminated Services.

All Sub-processors will be subject to data protection obligations at least equivalent to those contained in
this DPA under a written agreement, and such sub-processors shall be obliged to comply with applicable
Data Protection Laws. Where the Sub-processor fails to fulfil its data protection obligations under such
written agreement The Firm shall remain fully liable to the Client for the performance of the sub- processor’s obligations under such agreement.

The Firm shall audit third-party sub-processors that are not the Firm Affiliates at least once per year to
ensure they have appropriate physical, technical, organisational, and administrative controls in place. Upon the Client’s reasonable request at reasonable intervals, the Firm shall provide the Client with an executive summary of the most recent audits of such third-party sub-processors.

Upon the Client’s request, the Firm agrees to promptly make available to the Client a copy of an applicable sub-processor data processing agreement executed in relation to this DPA, provided that the Firm may remove any commercial information contained in such agreement. The Client may make available a summary of the agreement, or the agreement if required, to the Client provided that such summary, or the agreement if required, is treated as Confidential Information, including that the Client has entered into a nondisclosure agreement containing confidentiality provisions substantially similar to those set forth in the letter of engagement to protect the Firm’s Confidential Information.


The Firm shall implement Appropriate Security Measures with a view to preventing accidental or
unauthorised, loss, destruction, damage, alteration, disclosure or unlawful or unauthorised access to any Client Personal Data in the custody of the Firm, and the Firm shall ensure that its personnel are aware of and comply with those measures. This will include but is not limited to maintaining commercially reasonable and appropriate security measures, including administrative, physical and technical safeguards, to protect against unauthorised or unlawful processing of the client personal data and against accidental loss or destruction of, or damage to, the client personal data.


Notice: The Firm shall notify all incidents of loss of control of Client Personal Data to the Client, as soon as it becomes aware of the incident and in any event no later than 24 hours after so becoming aware.

Remedy: In the event of any such breach, the Firm shall:

Take prompt action at its own expense on the instruction of the Client to remedy the cause of the breach;

Bear the costs of investigation into said breach; and

Promptly, and at its own expense provide the Client on request with all information required by the
Client to fulfil its obligations, as data controller, under all applicable laws, regulations and codes of

Data Subject Requests

The Firm shall promptly notify the Client of each request from a data subject for access to Client Personal Data relating to him or her. The Firm shall not accede to any such request for access except on the instructions of the Client.


The Client shall indemnify the Firm on demand from time to time from and against all Losses suffered or incurred by the Firm arising out of or in connection with the breach by the Client of its obligations under this DPA. The provision of this Clause shall continue in force and effect without limit in time after the termination of the provision of the Services.