GDPR Compliance

Accounting firms handle some of the most sensitive information their clients have. This page explains how Ledger AI meets its obligations under the UK General Data Protection Regulation, the Data Protection Act 2018 and the EU GDPR, and what our role is when you process client records through the platform.

It sits alongside our Privacy Policy, which describes our handling of personal data generally, and our Terms of Use.

1. Controller and processor roles

Data protection law distinguishes between the party who decides why and how personal data is processed (the controller) and the party who processes it on that party’s behalf (the processor).

• You are the controller of the client records you upload — the bank statements, invoices, receipts and the transaction data extracted from them. You decide whose data is uploaded, why, and how long it is kept.
• We are your processor for that data. We process it only on your documented instructions, as set out in our Terms of Use and any data processing agreement between us.
• We are the controller of the data you give us directly about yourself and your firm: account details, contact information, billing records, support correspondence and website usage data.

2. Data processing agreement

We enter into a written data processing agreement (“DPA”) with customers, incorporating the terms required by Article 28 of the UK GDPR. Our DPA covers:

• The subject matter, duration, nature and purpose of processing
• The types of personal data and categories of data subjects involved
• Our commitment to process only on your documented instructions
• Confidentiality obligations on everyone we authorise to process the data
• The security measures we implement under Article 32
• The conditions under which we engage sub-processors
• Our assistance with data subject requests, impact assessments and breach notification
• Deletion or return of personal data at the end of the service
• Your right to information and audits demonstrating our compliance

To request a copy of our DPA, or to have it signed for your firm, email [email protected].

3. What we process on your behalf

Categories of data subjects: your firm’s clients and their personnel, and third parties named in the documents you upload — for example suppliers, customers, employees and payees.

Categories of personal data: names, business and personal addresses, contact details, bank account names, sort codes and account numbers, payment references, transaction descriptions, amounts and dates, and any other personal data contained in the documents you choose to upload.

Purpose of processing: extracting and structuring transaction data from documents, categorising transactions, generating trial balances, reports and alerts, and making the results available to you.

We ask that you do not upload special category data under Article 9 — such as health or biometric data — as the platform is not designed to process it.

4. Lawful basis

As processor, we do not determine the lawful basis for the client data you upload; you do, as controller. You are responsible for ensuring you have a valid basis for processing that data and for having provided the required privacy information to the individuals concerned.

For the data we control ourselves, the bases we rely on are set out in our Privacy Policy.

5. Data subject rights

Individuals have the rights of access, rectification, erasure, restriction, objection and portability, and the right not to be subject to solely automated decisions with legal or similarly significant effects.

Where an individual contacts us about data we process on your behalf, we will not respond to the substance of the request. We will refer them to you as controller, tell you promptly, and provide the technical assistance you need to locate, export, correct or delete the relevant records within the statutory deadline.

Where the request concerns data we control, we handle it directly and respond within one month.

6. Security measures

Our technical and organisational measures under Article 32 include:

• Encryption of data in transit using TLS, and encryption at rest
• Role-based access control on the principle of least privilege, with multi-factor authentication for administrative access
• Logical separation of customer data, so one customer’s records are not accessible to another
• Audit logging and monitoring of access to production systems
• Regular patching, dependency scanning and vulnerability management
• Backups with tested restore procedures, and documented business continuity planning
• Confidentiality undertakings and data protection training for staff
• Vetting of suppliers and contractual security commitments from sub-processors
• A documented incident response process, reviewed periodically

7. Sub-processors

We use a small number of vetted sub-processors — primarily cloud hosting, storage, email delivery and monitoring providers — each engaged under a written contract imposing data protection obligations no less protective than our own.

We maintain a current list of sub-processors, available on request from [email protected]. We will give customers reasonable notice before adding or replacing a sub-processor, and you may object on reasonable data protection grounds.

8. International transfers

We host and process customer data in the United Kingdom and the European Economic Area wherever possible. Where a transfer outside the UK or EEA is necessary, we rely on an adequacy decision where one applies, or otherwise on appropriate safeguards — the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the Standard Contractual Clauses themselves — supported by a transfer risk assessment.

9. Retention and deletion

We retain personal data processed on your behalf for as long as your account is active or as instructed by you. On termination, or on your written request, we delete or return that data within a reasonable period, except where we are required by law to retain it. Residual copies in backups are removed on the normal backup rotation cycle.

Retention periods for data we control are set out in our Privacy Policy.

10. Personal data breaches

We maintain an incident response process for detecting, investigating and containing personal data breaches. If a breach affects data we process on your behalf, we will notify you without undue delay after becoming aware of it, with the information you need to meet your own 72-hour notification obligation to the Information Commissioner’s Office, and we will assist your investigation and remediation.

Where a breach affects data we control, we notify the ICO within 72 hours where the breach is likely to result in a risk to individuals, and we notify affected individuals where the risk is high.

11. Automated processing and AI

Ledger AI uses machine learning to read documents and suggest categorisations. The output is presented for human review and correction, and is not applied as a final determination about any individual. As such, the platform does not carry out solely automated decision-making producing legal or similarly significant effects under Article 22.

We do not use customer documents or the client data within them to train models made available to other customers.

12. Data protection impact assessments

Where your use of the platform requires a data protection impact assessment, we will provide the information about our processing, security measures and sub-processors that you need to complete it. Contact [email protected] to request it.

13. Records and accountability

We maintain records of processing activities under Article 30, apply data protection by design and by default in how we build the product, and review our policies and security measures periodically.

14. Your responsibilities as controller

To use Ledger AI compliantly, you should:

• Have a valid lawful basis for processing the client data you upload
• Provide the required privacy information to the individuals concerned
• Upload only the data you need for the purpose, and avoid special category data
• Configure retention settings and remove data you no longer need
• Manage your users’ access, and revoke it promptly when someone leaves
• Keep your own records of processing and respond to data subject requests you receive
• Have a signed DPA in place with us

15. Contact and complaints

• Data protection enquiries: [email protected]
• General support: [email protected]

If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113. We would appreciate the opportunity to resolve your concern first.