Privacy Notice

1. About this notice

This notice explains how WAW Profi Limited ("we", "us", "our") collects and uses personal data in connection with the WAW Profi accounting platform (the "Platform"), our websites, and our related services. It is written to meet our obligations under the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 ("DPA 2018"), and the Privacy and Electronic Communications Regulations 2003 ("PECR"), and it follows the transparency requirements in Articles 13 and 14 of the UK GDPR.

Please read it alongside our Terms and Conditions.

Who we are

2. The two roles we play

This is the most important section of this notice, because it determines who is answerable to you for what.

We are the controller of personal data about the people who deal with us directly: the individuals who register for an account, the members of a subscribing organisation's team, people who contact our support desk, prospective customers, and visitors to our websites. For that data, we decide why and how it is processed, and this notice describes what we do.

We are a processor of the personal data that a subscribing organisation puts into the Platform about its own customers, suppliers, employees and contacts. That organisation is the controller of that data. It decides what to upload and why; we hold and process it on that organisation's documented instructions under the data processing terms in Schedule 1 to our Terms and Conditions.

If you are, for example, an employee of a business that uses WAW Profi to run its payroll, or a customer whose invoice sits in a WAW Profi ledger, then that business -- not us -- is the controller, and you should direct requests about your data to them in the first instance. We will assist them in responding to you.

Where a firm of accountants uses WAW Profi to manage its clients' books, the firm is a controller in respect of its own client records, and typically a processor for its clients. The allocation of roles between a firm and its clients is a matter for the engagement letter between them.

3. Personal data we collect

3.1 Account and identity data

• Name, business email address, and password (stored only as a salted hash -- we never see or store your password in readable form)
• Multi-factor authentication enrolment and, where you choose it, a trusted-device marker
• Your role within a workspace (owner, accountant, employee, or a custom role) and the module permissions attached to it
• Profile preferences such as theme, navigation layout, and notification settings

3.2 Organisation and tax registration data

• Business name, trading address, and business structure
• Companies House registration number, VAT registration number, and VAT scheme
• HMRC Unique Taxpayer Reference (UTR), employer PAYE reference, and Accounts Office reference
• Accounting period dates, base currency, and industry classification

Some of these identifiers relate to sole traders and partners, and are therefore personal data about identifiable individuals rather than only about a business.

3.3 Financial and transactional data

• Ledger entries, journals, invoices, bills, credit notes and payment allocations
• Bank account details and transaction data imported through an open banking connection or a statement upload
• Documents and attachments you upload, including receipts and invoices processed by optical character recognition

3.4 Payroll data

Where you use the payroll module, we process, on your instructions and as your processor:

• Employee names and contact details
• National Insurance numbers and PAYE tax codes
• Salary, pay frequency, and pension contribution rates
• Start and leaving dates, job title and department
• Right-to-work confirmation and contract status flags

We do not ask for, and the Platform is not designed to hold, special category data as defined in Article 9 of the UK GDPR (such as health, biometric, or trade union data), or criminal offence data under Article 10. Free-text note fields exist throughout the Platform, and you should not use them to record such data.

3.5 Practice management data

Where a firm of accountants uses the practice module, we process the firm's records about its clients, including client contact details, UK tax identifiers, deadlines, assigned staff, and the firm's own working notes.

3.6 Technical and usage data

• IP address, browser and device type, and operating system
• Pages visited, features used, and the timing of those actions
• Authentication events, including sign-in attempts and multi-factor challenges
• Error diagnostics and performance telemetry

3.7 Audit and access records

The Platform keeps an audit trail of significant actions taken in a workspace, recording who did what and when. This includes a record of every occasion on which a member of our support staff, or an authorised accountancy firm, opens a workspace. These records exist so that access can be accounted for, and they are visible to the workspace concerned.

3.8 Communications

Correspondence with our support desk, including the content of your messages, and any recordings or transcripts where we tell you in advance that a call is being recorded.

4. Where we get personal data from

Most of the personal data we hold comes from you directly, or from the organisation whose workspace you belong to. We also receive data:

• From Companies House, when a company registration number is looked up to pre-fill business details
• From HMRC, where you authorise a Making Tax Digital connection, including obligations, liabilities and payment data associated with your registration
• From your bank or payment provider, through an open banking connection you authorise
• From Stripe, our payment processor, which confirms to us that a payment has succeeded or failed and holds the underlying card details itself
• From an accountancy firm, where a firm sets up a workspace on your behalf

5. Why we use personal data, and our lawful basis

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interest does not override your rights and freedoms. You may ask us for a summary of that assessment at enquiry@wawprofi.com.

Where we rely on consent -- for example, for non-essential cookies, or for marketing to an individual subscriber where PECR requires it -- you may withdraw that consent at any time, and withdrawing it does not affect the lawfulness of processing carried out before you did so.

6. Automated processing and artificial intelligence

The Platform uses artificial intelligence in a small number of clearly identified places:

• Document extraction. Receipts and invoices you upload may be read by an optical character recognition model to propose the supplier, date, amount and tax treatment.
• Assistance and drafting. An in-product assistant can answer questions about your data and draft narrative commentary.
• Analytical commentary. Summary insights on dashboards, such as observations about cash position or outstanding work.

Three points about this:

1. Output is a suggestion, not a decision. Every figure an AI feature proposes is presented for a person to review, amend or reject before it is posted to your books or submitted anywhere.
2. We do not carry out solely automated decision-making producing legal or similarly significant effects on you within the meaning of Article 22 of the UK GDPR.
3. Your data is not used to train third-party models. We use the providers named in section 7 under contractual terms that prohibit the use of our customers' data for training their general-purpose models.

7. Who we share personal data with

We do not sell personal data. We share it only as set out below.

7.1 Service providers acting on our instructions

Each of these providers is engaged under a written contract that meets the requirements of Article 28 of the UK GDPR.

7.2 Organisations you or your business have authorised

• HMRC, where you authorise a Making Tax Digital connection and initiate a submission. HMRC is an independent controller of the data it receives, and its own privacy notice applies.
• Companies House, where a company lookup is performed.
• Your accountant or bookkeeper, where you grant a firm access to your workspace. You can see who holds access, and every visit they have made, in your workspace settings, and you can withdraw that access at any time with immediate effect.

7.3 Others

• Professional advisers, auditors and insurers, where necessary and under a duty of confidentiality
• A purchaser or prospective purchaser of our business, subject to appropriate safeguards
• Law enforcement, regulators or courts, where we are legally required to disclose

8. Where your data is held, and international transfers

Please read this section carefully, because it may matter to you.

Our databases are provided by Supabase, which operates its platform on Amazon Web Services infrastructure. Our primary application database is located in Sydney, Australia. Payroll data is held in a separate database located in London, United Kingdom. Our application servers are operated by Vercel and are distributed internationally.

Australia is not covered by UK adequacy regulations. A transfer of personal data from the United Kingdom to Australia is therefore a restricted transfer, and it is made under the International Data Transfer Agreement issued by the Information Commissioner, supported by a transfer risk assessment.

For our other providers, transfers outside the United Kingdom rely on one of the following:

• UK adequacy regulations, where the destination country is covered by them -- this includes the European Economic Area
• The International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission's standard contractual clauses, together with a transfer risk assessment
• The UK extension to the EU-US Data Privacy Framework, where the recipient is certified under it

You may request a copy of the safeguards in place for any given transfer by writing to enquiry@wawprofi.com.

9. How long we keep personal data

We keep personal data only as long as we need it. Several retention periods are fixed by tax and company law rather than chosen by us.

Where an organisation closes its workspace, we delete or irreversibly anonymise its data after the applicable retention periods, except where a statutory obligation or an active legal claim requires us to keep it for longer. Records showing who filed a statutory return and when are retained even where the underlying workspace is closed, because that record must survive the relationship it arose from.

10. How we protect personal data

We maintain technical and organisational measures appropriate to the risk, including:

• Tenant isolation. Every record belonging to a workspace carries that workspace's identifier, and database queries are filtered by it automatically at the data-access layer rather than relying on individual queries to remember. Row level security is enabled on tables holding customer data.
• Encryption. Data is encrypted in transit using TLS, and at rest by our hosting providers. Third-party authorisation tokens, such as HMRC and open banking credentials, are encrypted with a separate key.
• Access control. Role-based permissions within each workspace, multi-factor authentication for administrative accounts, and least-privilege access for our staff.
• Accountability for privileged access. Where our staff or an authorised accountancy firm opens a workspace, a record is written that identifies the individual, the workspace and the time, and it is visible to the workspace concerned.
• Segregation of duties. Administrative functions are separated from customer-facing functions and are individually permissioned.
• Monitoring and logging of authentication events and significant changes.
• Backups, with restoration tested periodically.

No system can be guaranteed secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it where required, and will inform you without undue delay where the risk is high.

11. Your rights

Under the UK GDPR you have the right to:

• Be informed about how your data is used -- which is the purpose of this notice
• Access a copy of the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure of your data in certain circumstances
• Restrict processing in certain circumstances
• Data portability -- to receive data you provided in a structured, commonly used, machine-readable format
• Object to processing based on legitimate interests, and to object to direct marketing at any time and without giving a reason
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects
• Withdraw consent at any time, where we rely on consent

To exercise a right, write to enquiry@wawprofi.com or to the postal address in section 1. We will respond within one month. That period may be extended by a further two months where a request is complex or where several requests have been made, and we will tell you if that applies. There is normally no charge.

We may ask you to verify your identity before we act on a request, so that we do not disclose personal data to the wrong person. If the data is held in a customer's workspace, we are the processor and not the controller. We will refer your request to that organisation and support them in answering it.

12. Cookies and similar technologies

We use cookies and similar technologies that are strictly necessary to operate the Platform -- for example to keep you signed in, to remember a trusted device for multi-factor authentication, and to carry a session while an authorised accountant is working in a client's workspace. Under regulation 6(4) of PECR these do not require consent, because without them the service you have asked for cannot be provided.

Where we use non-essential cookies, we ask for your consent before setting them, and you can change or withdraw that choice at any time using the cookie controls on our website. You can also block or delete cookies through your browser settings, although parts of the Platform will not work if you block the strictly necessary ones.

13. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at enquiry@wawprofi.com, so that we have the chance to put it right. You also have the right to complain to the UK supervisory authority:

Complaining to the ICO does not affect any other legal remedy available to you.

14. Changes to this notice

We review this notice at least annually, and whenever we make a material change to how we use personal data. Where a change is significant, we will tell account holders by email or by a notice in the Platform before it takes effect. The version number and effective date at the top of this document identify the current version.