Privacy Policy

1Introduction

This Privacy Policy is provided by Closed Period Ltd (Company Number 16494839), a company registered in England and Wales with registered office at 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF (Company, we, our, or us) for use of our web-based software-as-a-service platform (Services).

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data).

It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of your personal data is regulated by law, including under the UK General Data Protection Regulation (UK GDPR).

We are the controller of personal data that we collect and use for own purposes, including account registration, billing, security, service administration, support and our own legal, regulatory and business purposes. Where we process accounting, bookkeeping, tax, document, bank and ledger data processed from an accountancy practice (Practice) or client solely for the purpose of providing the Services on the Practice’s/client’s instructions, we act as a processor. In those circumstances, the relevant Practice or, where the Services are used directly by a client, the relevant client will generally act as the controller.

The Services are intended for business and professional users and are not directed to individuals under the age of 18.

2What this policy applies to

This privacy policy relates to your use of the Services only.

The Services may link to or rely on other apps, websites, APIs or services owned and operated by us or by certain trusted third parties to enable us to provide you with Services. These other apps, websites, APIs or services may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to these other apps, websites or services, please consult their privacy policies as appropriate. For more information see the section ‘Who we share your personal data with’ below.

3Personal data we collect about you

The personal data we collect about you depends on the particular activities carried out through the Services. We will collect and use the following personal data about you:

If you do not provide personal data we ask for where it is required for us to provide the Services, we may be unable to provide some or all of the Services to you. Where location data is required for an optional feature, such as GPS-based mileage or route tracking, choosing not to provide that data will only affect your ability to use that particular feature and will not prevent you from using the rest of the Services.

We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.

4Sensitive Data

Sensitive personal data (also known as special category data) means information related to personal data revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data (where used for identification purposes); data concerning health; data concerning a person’s sex life; and data concerning a person’s sexual orientation.

We do not collect any sensitive or special category data.

5How your personal data is collected

We collect personal data from you directly when you sign up to the Services, contact us directly or reach out to us via social media, make submissions via the Services, or indirectly, such as your activity while using the Services.

We use cookies and similar technologies which collect personal information about you, provided you have consented to our use of such cookies. You can find out about the cookies we use on our platform in our cookies policy here: [link to cookies policy]. You can consent or reject to cookies, and update your consents, at any time via our platform.

6How and why we use your personal data

Under data protection law, we can only use your personal data if we have a proper reason, e.g.:

(i)where you have given consent

(ii)to comply with our legal and regulatory obligations

(iii)for the performance of a contract with you or to take steps at your request before entering into a contract, or

(iv)for our legitimate interests or those of a third party

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see ‘How to contact us’ below).

The table below explains what we use your personal data for and why.

We use personal data processed through the Services to provide, maintain, secure and improve the Services. Within your own account, the Services learn from your activity and corrections — for example, how transactions are categorised — to improve the accuracy and usefulness of the Services for you.

We may also use process limited data to create anonymised and aggregated information, from which you, your clients and individual businesses can no longer be identified, to develop and improve the Services, including the accuracy of transaction categorisation across our platform. The resulting cross-customer dataset contains only anonymised and aggregated information (for example, that a particular merchant is commonly categorised to a particular account); it does not include your personal data, your clients' personal data, transaction amounts or other transaction details, and no information that could identify you or your clients is shared between customers.

We do not use your personal data to train or improve general-purpose or third-party artificial intelligence or machine-learning models, and we do not sell your personal data. Where we use third-party AI providers, including Anthropic and OpenAI, personal data is processed only to provide the relevant functionality and is subject to contractual no-training and, where applicable, zero-retention or equivalent data-handling terms. You can opt out of contributing to our anonymised cross-customer improvement dataset at any time in your account settings, and opting out will not affect your ability to use the Services.

See ‘Who we share your personal data with’ for further information on the steps we will take to protect your personal data where we need to share it with others.

7Special category data

The Services are not specifically designed for the routine collection of Special Category Data or Criminal Offence Data. However, depending on how the Services are used, such information may be included in customer data submitted to or processed through the Services. For example, accounting, payroll, expense or supporting documents may incidentally contain Special Category Data, such as information concerning health, trade union membership, religious beliefs or other information protected under Article 9 of the UK GDPR. Certain AML, compliance or screening functionality may also involve the processing of personal data relating to criminal convictions, offences, alleged offences or related security measures, which is subject to Article 10 of the UK GDPR.

Where we process such information solely on behalf of a Practice or other client in providing the Services, we act as a Processor and process that information in accordance with the Practice’s or the client’s documented instructions and our data processing agreement. The relevant Practice/client, as Controller, is responsible for determining the appropriate lawful basis and any additional Article 9, Article 10 or Data Protection Act 2018 Schedule 1 condition required for that processing.

Where we process Special Category Data or Criminal Offence Data for a separate purpose for which we determine the purposes and means of processing, we will only do so where we have identified an appropriate lawful basis and any additional condition or safeguard required by applicable data protection laws.

8Location data

Where you choose to enable the mileage or route-capture feature within the expense-tracking functionality, the Services may collect and process precise location data from your device, including GPS data, for the purpose of recording journeys, calculating mileage and supporting related expense records.

This feature is optional and will only operate where you have enabled the relevant location permissions on your device. You can withdraw or change those permissions at any time through your device or browser settings, although doing so may prevent the mileage or route-capture feature from functioning properly.

We do not use precise location data for unrelated purposes such as advertising or general location tracking.

9Marketing

We may send you marketing emails to inform you of our services including new products and technology.

We will always ask you for your consent before sending you marketing communications, unless you have previously opted in to receive such communications from us or we are permitted to contact you under the “soft opt-in” rules. This may apply where we obtained your contact details directly from you when you signed up to the Services, the marketing relates to our own similar products or services, and you were given a clear opportunity to opt out when your details were collected and in each subsequent marketing communication.

You will have the right to opt out of receiving marketing communications at any time by:

• contacting us at privacy@closedperiod.com; or
• using the ‘unsubscribe’ link included in all marketing emails you may have received from us.

For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your rights’ below.

10Who we share your personal data with

We routinely share personal data with third party service providers we use to help us operate, secure, support and provide the Services. Depending on the particular processing activity, these third parties may act as our processor or sub-processor, or as an independent controller where they determine their own purposes and means of processing.

The third parties we use include, where applicable:

• Amazon Web Services EMEA SARL (UK Branch) (AWS), which provides cloud hosting, storage, database, key-management, notification and related infrastructure services. Our primary AWS hosting environment is located in the United Kingdom (London region);
• Anthropic PBC, which provides language-model functionality used to assist with document understanding, transaction categorisation and other machine-assisted accounting functionality;
• OpenAI OpCo, LLC, which provides certain legacy language-model functionality used within the Services;
• Lido and Affinda, which provide optical character recognition (OCR), document extraction and related processing used to extract information from invoices, receipts, statements and other documents;
• Stripe Payments UK Ltd, which provides subscription billing and related payment functionality;
• GoCardless Ltd, which provides Bacs Direct Debit payment services;
• Wise Payments Ltd, which may provide international and multi-currency payment services;
• Amazon SES, which provides transactional and notification email services;
• Twilio Inc., including SendGrid, which provides SMS, email and other communications functionality;
• Sentry, which provides error, application-performance and security monitoring services and may process limited technical and diagnostic information in connection with those services;
• Loqate, which provides address verification services within our contacts module (process postal address information in connection with the Services); and
• Lido and Affinda, which provide document OCR and data extraction services and may process personal data contained in documents uploaded to the Services.

Where you connect a bank account to the Services using Open Banking, the regulated account-information service is provided through Finexer Ltd (FCA firm reference number 925695). We provide the software through which the Open Banking functionality is made available but do not ourselves provide the regulated account-information service.

The Open Banking provider has not been treated as our sub-processor solely by reason of providing that service. Its processing of personal data in connection with the regulated Open Banking service may be carried out in its own capacity and may be subject to its own privacy information and regulatory obligations.

We only appoint processors or sub-processors to process your personal data where we are satisfied they provide appropriate safeguards to protect your personal data. Where required by applicable data protection laws, we impose contractual obligations on those providers governing their processing of personal data on our behalf, including appropriate confidentiality, security and data-protection obligation.

We or our service providers may occasionally also need to share your personal data with:

• external auditors, e.g. in relation to the audit of our accounts and our company —the recipient of the information will be bound by confidentiality obligations
• professional advisors (such as lawyers and other advisors)—the recipient of the information will be bound by confidentiality obligations
• law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations
• other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised but this may not always be possible, however, the recipient of the information will be bound by confidentiality obligations

Where you instruct us to submit information through the Services to HMRC, Companies House or another authorised recipient, we will disclose the relevant personal data in accordance with your instructions. HMRC and Companies House process information received by them in accordance with their own statutory functions and data-protection responsibilities and are not our sub-processors merely because the Services facilitate the transmission of information to them.

If you would like more information about who we share our data with and why, please contact us (see ‘How to contact us’ below).

We do not sell your personal data. We will not disclose personal data to third parties except as described in this Privacy Policy, where reasonably necessary to provide or operate the Services, where you instruct or authorise us to do so, or where disclosure is otherwise required or permitted by applicable laws.

11How long your personal data will be kept

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, comply with our legal and regulatory obligations, resolve disputes, maintain appropriate business and financial records, and establish, exercise or defend legal claims.

The applicable retention period depends on the nature of the personal data and the purpose for which we process it. In particular:

• Customer and Client data processed through the Services will generally be retained for the duration of the relevant subscription. Following termination or expiry, personal data may remain available for export for 30 days, after which it will be deleted from active systems in accordance with our data processing agreement, unless we are required by law to retain it for longer.
• Backup copies may remain for a limited period after deletion from active systems and will be securely deleted or overwritten through our ordinary rolling backup cycle, which will not normally exceed 90 days, unless longer retention is required by law.
• Account and user information will generally be retained for so long as the relevant Account remains active and thereafter for so long as reasonably necessary for account administration, security, fraud prevention, dispute resolution or compliance purposes.
• Billing, payment, contractual and financial records may be retained for up to six years or such longer period as may be required by applicable tax, accounting or legal requirements.
• Security, technical and audit records will be retained for the period reasonably necessary for security, fraud prevention, troubleshooting and compliance purposes for up to 12 months from the date of collection, unless a longer period is required to investigate security incidents, comply with legal obligations, or establish, exercise or defend legal claims.

Where the Services are used for anti-money laundering or customer due diligence purposes, relevant records may be retained for up to five years where required under applicable anti-money laundering legislation or in accordance with the instructions of a Practice/client that is subject to those requirements. This retention period is subject to confirmation of the regulatory obligations applicable to us and our clients.

Where we no longer need personal data for the purposes for which it was collected, we will delete or anonymise it unless we are required or permitted by applicable law to retain it for longer.

12Transferring your personal data out of the UK

We primarily host the Services in the United Kingdom. However, some of the service providers and sub-processors we use are located in, or may access personal data from, countries outside the United Kingdom, including the United States, Australia and countries within the European Economic Area.

Where personal data is transferred to a separate organisation outside the United Kingdom and the transfer constitutes a restricted transfer under UK data protection laws, we take steps to ensure that an appropriate lawful transfer mechanism is in place.

Depending on the recipient and destination, we may rely on:

1.UK adequacy regulations, including those applicable to countries within the European Economic Area and, where the relevant US recipient is eligible and appropriately certified, the UK Extension to the EU-US Data Privacy Framework;

2.an appropriate safeguard recognised under UK data protection laws, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the European Commission Standard Contractual Clauses;

Where we rely on the IDTA or UK Addendum, we will carry out any transfer risk assessment or data protection test required by Data Protection Laws and implement any additional safeguards required as a result of that assessment.

If a transfer mechanism on which we rely ceases to be available or valid, we will not continue the relevant restricted transfer unless and until we are able to rely on another lawful transfer mechanism, safeguard or exception permitted under applicable UK data protection law.

13Your rights

You generally have the following rights, which you can usually exercise free of charge. For more information regarding these rights, please visit the ICO website here.

For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see ‘How to contact us’ below). You may also find it helpful to refer to the guidance from the UK’s Information Commissioner on your rights under the UK GDPR.

If you would like to exercise any of those rights, please contact us via the platform or email, call or write to us—see below: ‘How to contact us’. When contacting us please:

• provide enough information to identify yourself (e.g., your full name and username) and any additional identity information we may reasonably request from you, and
• let us know which right(s) you want to exercise and the information to which your request relates.

14Keeping your personal data secure

We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it.

We use appropriate technical and organisational measures to protect personal data processed through the Services. Customer’s personal data is encrypted in transit across the platform and when transmitted to our sub-processors, including through the use of TLS 1.2 or higher where applicable, and is encrypted at rest within our AWS UK hosting environment. Our sub-processors are also required to maintain appropriate security measures for personal data processed on our behalf, including encryption in accordance with their own technical and contractual arrangements.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

15How to complain

Please contact us if you have any queries or concerns about our use of your information (see below ‘How to contact us’). We hope we will be able to resolve any issues you may have.

You also have the right to lodge a complaint with the Information Commissioner.

The Information Commissioner can be contacted at https://ico.org.uk/make-a-complaint or telephone: 0303 123 1113.

16Changes to this privacy policy

Where a Practice uses the Services on behalf of a client, we may receive personal data about that client and other individuals connected with the client directly from the Practice. We may change this privacy policy from time to time. When we make significant changes we will take steps to inform you, for example via the Services or by other means, such as email.

17How to contact us

You can contact us by post, email or telephone if you have any questions about this privacy policy or the information we hold about you, to exercise a right under data protection law or to make a complaint.

Our contact details are shown below:

• 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF
• privacy@closedperiod.com