Privacy Policy

DuoBooks is a software platform provided by Kletta Limited, a company incorporated in England and Wales under company number 13604802, registered with the Information Commissioner's Office under registration number ZB381833, with its registered office at 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ ("DuoBooks", "Kletta Limited", "we", "us" or "our").

DuoBooks provides software designed for accounting practices, bookkeepers and other professional service providers to manage clients, bookkeeping workflows, financial records and related administrative processes, and for their clients to record and share business information with them.

This Privacy Policy explains how we collect, use, disclose, store and protect personal data when you:

visit the DuoBooks website;

create or use a DuoBooks account, whether as a member of an accounting practice or as a client invited by your practice;

use the DuoBooks platform, web application or mobile app;

book a demonstration or contact us;

communicate with our support, sales or other teams; or

otherwise interact with DuoBooks.

It also explains the distinction between personal data for which Kletta Limited acts as a data controller and personal data processed through DuoBooks on behalf of our customers, for which we generally act as a data processor or sub-processor.

We process personal data in accordance with applicable data protection legislation, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR") and other applicable UK data protection laws.

For the purposes of this Privacy Policy, DuoBooks is the trading name and software service operated by Kletta Limited. [Confirm after trade mark clearance.]

Kletta Limited. Company number: 13604802. ICO registration number: ZB381833. Registered office: 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Email: legal@duobooks.ai.

Where Kletta Limited determines why and how personal data is processed, Kletta Limited acts as the Data Controller.

Where we process personal data solely on behalf of an accounting practice, bookkeeper or other customer using DuoBooks, we generally act as a Data Processor or, where the customer itself acts as a processor, as a Sub-processor. The terms on which we do so are set out in the DuoBooks Data Processing Agreement at [URL].

Kletta Limited is a subsidiary of Kletta Oy, a company incorporated in Finland, whose staff provide engineering, operations and support services for DuoBooks. Section 11 explains how that access is safeguarded. The DuoBooks mobile app is published on the Apple App Store and Google Play by [Kletta Limited / Kletta Oy on behalf of Kletta Limited; confirm the developer account holder]. Kletta Limited remains the data controller described in this policy whichever entity publishes the app.

This Privacy Policy may apply to:

accounting practices and bookkeeping businesses using DuoBooks (our "customers");

directors, owners, employees and contractors of our customers;

individual users authorised to access a DuoBooks account;

individuals who use DuoBooks at the invitation of our customer, such as sole traders, landlords and other clients of an accounting practice ("Client users");

prospective customers and people requesting demonstrations;

visitors to our website;

suppliers, partners and other business contacts; and

individuals whose information is processed through DuoBooks by one of our customers, including the customers, suppliers and employees of a Client user to the extent they appear in business records.

If you are a Client user, two sets of rules apply to you. For your login and account details, your device and usage data, your communications with our support team and the information we must send to HM Revenue & Customs, Kletta Limited is the data controller and this policy applies directly. For the business records you keep in DuoBooks, your accounting practice is the data controller and we process them on its instructions; questions about that information should go to your practice in the first instance.

Where your personal data has been entered into DuoBooks by an accounting practice, bookkeeper or another DuoBooks customer, that organisation will normally determine how and why your information is processed, and questions should be directed to that organisation first.

DuoBooks is a business service and is not intended for anyone under 18.

Depending on how you interact with DuoBooks, we may collect the following categories of personal data.

Identity and profile data. Name; job title; organisation; professional role; username or account identifier; and other information associated with your DuoBooks profile.

Contact data. Business email address; telephone number; postal or business address; and other contact information.

Account and authentication data. Account credentials; authentication information, including one-time passcodes; permissions; user roles; login records; and account security information. Passwords are not stored by us in readable form.

Billing and commercial data. Subscription information; billing details; invoices; payment status; transaction references; pricing arrangements; and information relating to your commercial relationship with us. Where payments are processed by a third-party payment provider, we do not receive or store complete payment-card information.

Technical and usage data. IP address; browser type and version; device type and identifiers; operating system; time zone; screen size; login timestamps; pages or features used; system activity; diagnostic information; application logs; information about how you interact with DuoBooks; and the device and connection information that HMRC requires us to send with every submission to its systems (see section 4.10).

Communications and support data. Emails; support requests; chat messages; meeting notes; feedback; survey responses; bug reports; and other communications with us.

Marketing data. Marketing preferences; event registrations; responses to campaigns; website interactions; and information about your engagement with our communications.

Customer data processed through DuoBooks. Our customers and their Client users may upload, create, receive, store or otherwise process information through DuoBooks. Depending on how the platform is used, this may include: names and contact information; business details; tax and accounting information; transaction information; invoices; receipts; expenses; mileage and asset records; bookkeeping records; financial records; bank account identifiers, balances and transaction information obtained through Open Banking (see section 4.9); tax identifiers such as Unique Taxpayer Reference, National Insurance number and VAT number; HMRC authorisation, submission and correspondence information; documents uploaded to the platform; communications between a practice and its clients; client account information; and other information required by an accounting practice or bookkeeper to provide services to its clients.

The relevant DuoBooks customer determines which client information it places in DuoBooks.

If a Client user chooses to link bank accounts through DuoBooks, we use an open banking account information service provided by Plaid Financial Ltd. Please note:

Kletta Limited is an agent of Plaid Financial Ltd., an authorised payment institution regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number: 804718). Plaid provides regulated account information services through Kletta as its agent.

Regulated account information services include balance, transaction and merchant data for bank accounts that the Client user gives express permission to link to DuoBooks, for the purposes of bookkeeping and reconciliation. Access is read-only. Permission can be withdrawn at any time and must be renewed periodically as the regulations require. You can view Plaid's privacy policy at https://plaid.com/legal/#consumers

HMRC requires every software product that connects to its systems to send information about the device and connection used, to help HMRC detect fraud (known as fraud-prevention headers). When a Client user or a practice sends information to HMRC through DuoBooks, we send HMRC data such as an identifier that DuoBooks generates for the installation or browser (not a hardware identifier), device type and operating system, screen size, time zone, public and local IP addresses, the DuoBooks user identifier and whether multi-factor authentication was used. We do not collect hardware MAC addresses. The identifier is used only for this purpose and is not used to track you across other apps or websites. This is a legal requirement and cannot be switched off. The lawful basis is compliance with a legal obligation.

DuoBooks is not designed to process special category data. Financial records may incidentally reveal such information, for example health-related spending or trade union or religious subscriptions. We do not use it for any purpose, and customers should not upload more than their records require.

We may collect personal data:

Directly from you, for example when you create an account, request a demonstration, contact us, subscribe to DuoBooks, use the platform, submit a support request or communicate with our team.

From your organisation or your practice. An accounting practice or other organisation may create an account for you, invite you to DuoBooks or provide your professional contact information.

Through the DuoBooks platform. We automatically generate certain technical, security and usage information when the platform is used.

From Plaid Financial Ltd, when a Client user links a bank account (section 4.9).

From HMRC, when a Client user or practice connects an HMRC account or receives information from HMRC through DuoBooks.

From third parties, such as service providers, integration partners, analytics providers and payment providers, where permitted by law.

From our customers, who may submit information concerning their own clients in order to use DuoBooks.

Where Kletta Limited acts as Data Controller, we process personal data for the purposes and on the lawful bases set out below.

Create and administer DuoBooks accounts; authenticate users and manage permissions; provide and operate the DuoBooks service — Performance of a contract, or steps taken at your request before entering into one.

Manage subscriptions and billing — Performance of a contract; compliance with legal obligations (tax and accounting records).

Provide customer support and communicate about the service — Performance of a contract; our legitimate interest in supporting users.

Send the fraud-prevention information HMRC requires with each submission (section 4.10) — Compliance with a legal obligation.

Maintain security, prevent fraud or misuse, diagnose technical problems and monitor service performance — Our legitimate interest in keeping DuoBooks secure and reliable; compliance with legal obligations.

Improve and develop DuoBooks and understand how our website and platform are used — Our legitimate interest in improving our service, using aggregated or pseudonymised data where possible.

Manage our customer, partner and supplier relationships — Our legitimate interest in running our business.

Market DuoBooks and related services to business contacts — Our legitimate interest in promoting our service (see the marketing paragraph below).

Market DuoBooks to sole traders and other individual subscribers — Consent, or the PECR "soft opt-in" for existing customers.

Comply with legal and regulatory obligations; establish, exercise or defend legal claims — Compliance with a legal obligation; our legitimate interest in protecting our legal position.

Where we rely on legitimate interests, we consider whether those interests are overridden by your rights and freedoms. You can ask us for details of that assessment.

Artificial intelligence. DuoBooks uses AI services to extract information from receipts and documents, suggest categories for transactions and highlight items that may need attention. These outputs are suggestions. Before a user's document is first processed by an AI service, the app asks for the user's permission, which can be withdrawn in Settings. A person, either the user or their practice, reviews the result before it is relied on or sent to HMRC. We do not make any decision that produces legal or similarly significant effects on an individual by automated means alone. Our AI providers are listed in our sub-processor list and are contractually prohibited from using personal data to train their models. [Confirm: Kletta does not use customer data to train its own models.]

Marketing. We may send marketing about DuoBooks to business contacts at accounting practices and companies on the basis of our legitimate interests. Sole traders and other individual subscribers receive marketing only with their consent or, where they are existing customers, under the PECR soft opt-in for similar services. Every marketing message contains an unsubscribe link, and you can opt out at any time by using it or by emailing legal@duobooks.ai.

A core purpose of DuoBooks is to enable accounting practices and bookkeepers to manage information relating to their clients. Where a customer uses DuoBooks to process personal data on behalf of its clients, Kletta Limited does not generally determine the purposes for which that client data is processed. Instead, we process that data on the documented instructions of our customer and in accordance with our contractual obligations.

Depending on the relationship, the accounting firm's client may be the Data Controller; the accounting practice may itself be the Data Controller or Data Processor; and Kletta Limited may act as Data Processor or Sub-processor. The precise roles depend on the relevant processing activity and contractual relationship.

When acting as a processor or sub-processor, we process personal data only in accordance with applicable law, the DuoBooks Data Processing Agreement at [URL] and the documented instructions of the relevant controller or processor. The AI-assisted processing described in section 6 is carried out as part of the service on those instructions.

Customers using DuoBooks are responsible for ensuring that their use of the platform complies with applicable data protection laws. This includes, where applicable:

establishing an appropriate lawful basis for processing;

providing required privacy information to individuals, including telling their clients about the information sent to HMRC (section 4.10);

obtaining necessary permissions or consents, and not initiating a bank connection for a client without that client's express permission (section 4.9);

ensuring information entered into DuoBooks is appropriate and lawful;

responding to data subject requests;

configuring access rights appropriately; and

ensuring that users authorised to access their DuoBooks account have an appropriate reason to do so.

DuoBooks does not determine the professional, accounting or legal obligations of an accounting practice towards its clients.

We may share personal data with third parties where reasonably necessary to operate DuoBooks. These include:

HM Revenue & Customs, when a user or practice submits information to HMRC through DuoBooks, including the fraud-prevention information described in section 4.10;

Plaid Financial Ltd, which provides Open Banking account information services through Kletta as its agent (section 4.9);

Kletta Oy, our parent company in Finland, which provides engineering, operations and support services;

providers of cloud hosting and infrastructure, authentication and security, communications, customer support, analytics, software monitoring, payment processing, email and SMS delivery, AI-assisted document processing, professional advisory services and other technology necessary to operate the platform.

Our current sub-processors and their locations are listed at [URL of the published sub-processor list]. Where a third party processes personal data on our behalf, we require appropriate contractual and data protection safeguards.

We may also disclose personal data where required by law; in response to a lawful request from a regulator, court or public authority; where necessary to protect our legal rights; to investigate fraud, security incidents or misuse; in connection with a merger, acquisition, financing, restructuring or sale of all or part of our business; or where you or the relevant controller has instructed or authorised us to do so.

We may appoint third-party sub-processors to assist in providing DuoBooks. Where we process personal data on behalf of a customer, we ensure that sub-processors are subject to appropriate data protection obligations, and we remain responsible for managing them in accordance with applicable law and our contractual obligations. The current list is published at [URL]. We give customers at least [30] days' notice of additions or replacements, as set out in the Data Processing Agreement.

DuoBooks is hosted in the United Kingdom [Amazon Web Services, London region]. Some of the organisations we work with process personal data outside the United Kingdom:

Finland (European Economic Area): Kletta Oy staff who provide engineering, operations and support; [Enable Banking Oy, if in scope]. Transfers to the EEA are covered by the UK adequacy regulations.

United States: certain technology providers, including our AI, messaging, payment, SMS and CRM providers, as identified in the sub-processor list. Transfers are covered by the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or, where the provider is certified, the UK Extension to the EU-US Data Privacy Framework.

Plaid Financial Ltd is a United Kingdom company; any onward transfers it makes are covered by its own safeguards and described in its privacy policy. You can ask us for details of the transfer mechanism that applies to a particular provider.

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include, where appropriate: encryption in transit and at rest; access controls and multi-factor authentication for staff; role-based permissions; logging and monitoring; secure software-development practices; infrastructure security; backups; vulnerability management and penetration testing; and organisational confidentiality requirements.

No online service can guarantee absolute security. Customers and users are also responsible for protecting their credentials, devices and user access.

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to satisfy legal, accounting, contractual and regulatory requirements. Our indicative retention periods are:

Account and billing data of customers and users — Duration of the customer relationship plus [6] years, to meet tax and accounting record requirements and to defend legal claims.

Customer data processed on behalf of a customer — Duration of the subscription, then deleted or returned under the Data Processing Agreement: [30] days read-only export access, deletion from live systems within [90] days and from backups within a further [90] days, unless the law requires retention.

Technical and security logs — [12] months.

Records of information sent to HMRC — As required by HMRC rules [confirm period].

Support communications — [3] years after the matter is closed.

Marketing data — Until you opt out or after [2] years of inactivity.

Website analytics and cookie data — As set out in the Cookie Notice.

Data may be deleted or anonymised earlier when it is no longer required, subject to lawful retention obligations and backup processes. Where we act as a processor, we also follow the instructions of our customer.

Depending on the circumstances, UK data protection law may give you the right to be informed; of access; to rectification; to erasure; to restrict processing; to data portability; to object to processing; to withdraw consent at any time where processing is based on consent; and rights relating to certain automated decision-making. These rights are not absolute and may be subject to legal exceptions.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. The AI-assisted features of DuoBooks produce suggestions that a person reviews (section 6).

Deleting your account. Users of the DuoBooks app can delete their account at any time in the app under Settings, Account, Delete account, or by emailing legal@duobooks.ai. [Feature to be built before launch.] Deleting an account removes the user's login, profile, device and usage data within [30] days, subject to the retention periods in section 13 for billing and legal records. Business records that a practice holds in DuoBooks about its clients are retained for the practice under the Data Processing Agreement and tax law; requests about those records should go to the practice.

Where Kletta Limited acts as Data Controller, you may exercise your rights by emailing legal@duobooks.ai. We will respond within one month, or tell you if we need longer. Where your personal data is processed through DuoBooks on behalf of an accounting practice or bookkeeper, you should normally direct your request to that organisation; we will provide reasonable assistance to our customer where required under applicable data protection law.

You also have the right to lodge a complaint with the UK Information Commissioner's Office at https://ico.org.uk or on 0303 123 1113. We would appreciate the chance to deal with your concerns first.

The DuoBooks website and web application use cookies and similar technologies for essential functionality, security, remembering preferences, analytics and, where permitted, marketing. Non-essential cookies are used only after you have given consent through our cookie banner. Full details, including how to change your choices, are in our Cookie Notice at [URL].

DuoBooks may allow customers and Client users to connect third-party services or integrations, including bank connections through Plaid (section 4.9) and HMRC accounts (section 4.10). Where you choose to activate such an integration, information is exchanged with the relevant third party. Third-party services operate under their own terms and privacy policies, which you should review before enabling an integration.

If Kletta Limited or the DuoBooks business is involved in a merger, acquisition, financing, restructuring, sale of assets or similar corporate transaction, personal data may be disclosed or transferred as part of that transaction, subject to applicable data protection requirements.

We may update this Privacy Policy from time to time to reflect changes to DuoBooks, our processing activities, applicable laws or regulatory guidance. We will notify customers and users of material changes by email or in the platform at least [30] days before they take effect, where practicable. The latest version will be published on the DuoBooks website with its effective date.

DuoBooks is provided by Kletta Limited, company number 13604802, ICO registration number ZB381833, registered office 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

For privacy enquiries or requests relating to personal data, email legal@duobooks.ai or write to us at the address above.

If you have concerns about our handling of your personal data, you also have the right to complain to the UK Information Commissioner's Office.