Privacy Policy

Last updated: 1 March 2026

Cliénta is committed to protecting your privacy and handling your personal data responsibly. This policy explains how we collect, use, and safeguard information about you.

1. Who we are

Cliénta (“we”, “us”, “our”) is a software-as-a-service platform designed for UK accounting and bookkeeping firms. We provide tools to streamline client onboarding, automate AML compliance checks, and manage client relationships.

For the purposes of UK data protection law, Cliénta acts as a data controller in respect of the personal data of platform users (i.e. firm staff who log in to use the service), and as a data processor in respect of personal data about end clients that is collected and processed on behalf of our accounting firm customers.

If you have any questions about this policy or wish to exercise your rights, please contact us at: privacy@clienta.co.uk

2. What personal data we collect

Platform users (accounting firm staff):

• Name, email address, and job title
• Login credentials (passwords stored as hashed values - never in plain text)
• Activity logs and audit trail records
• IP addresses and device information for security purposes

End clients (collected on behalf of accounting firms):

• Full name, date of birth, and contact details
• Home and business address history
• Company registration details and Companies House data
• National Insurance number and tax identification information
• Source of funds and source of wealth declarations
• Identity verification data (processed via third-party AML providers)
• Politically Exposed Person (PEP) and sanctions screening results
• Directors, shareholders, and Persons with Significant Control (PSC) information
• Digital signatures and declaration acknowledgements

Automatically collected data:

• Browser type, operating system, and device type
• Pages visited and time spent on the platform
• Error logs and performance data

3. How we use your data

We process personal data for the following purposes and on the following legal bases:

4. Who we share data with

We do not sell your personal data. We may share data with the following categories of third parties where necessary to provide the service:

• Cloud hosting: Google Cloud Platform (data stored in the UK/EEA)
• AML providers: XamaTech, SmartSearch, Veriphy, Firmcheck, Veriff - only where your accounting firm has configured one of these providers
• Companies House: We access publicly available data via the Companies House API
• FCDO & HMRC: We access publicly available sanctions lists and HMRC APIs to perform compliance checks
• Accounting software: FreeAgent, Karbon, DocuSign, PandaDoc, Socket - only where your firm has connected these integrations
• Support tooling: Email providers used to deliver system notifications and support responses

All third-party processors are subject to data processing agreements and are required to handle data in compliance with UK GDPR.

We may also disclose data where required by law, court order, or in response to a request from a regulatory authority such as the Information Commissioner's Office (ICO).

5. How long we retain your data

We retain data for as long as necessary to provide the service and to fulfil our legal obligations:

• Platform user accounts: Retained for the duration of your subscription, plus 30 days following account closure to allow for data export.
• Client onboarding records and AML documentation: Retained for a minimum of 5 years from the end of the client relationship, in line with the requirements of the Money Laundering Regulations 2017 (Regulation 40).
• Audit logs: Retained for 7 years.
• Support communications: Retained for 3 years.
• Anonymised analytics data: Retained indefinitely.

Upon expiry of the relevant retention period, data is securely deleted.

6. Security

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

• All data is encrypted at rest (AES-256) and in transit (TLS 1.2+)
• Passwords are hashed using industry-standard algorithms and never stored in plain text
• Sensitive credentials (API tokens, OAuth secrets) are encrypted using Fernet symmetric encryption
• Access to production systems is restricted and logged
• Automated daily backups with point-in-time recovery
• Regular security reviews and penetration testing

If you become aware of any security vulnerability or breach, please notify us immediately at security@clienta.co.uk.

7. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate or incomplete data.
• Right to erasure: You can ask us to delete your data, subject to our legal retention obligations.
• Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests.
• Rights related to automated decision-making: We do not make solely automated decisions that significantly affect you.

To exercise any of these rights, please contact us at privacy@clienta.co.uk. We will respond within 30 days.

If you are unsatisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

Cliénta uses essential cookies to:

• Maintain your login session
• Store your preferences
• Prevent cross-site request forgery (CSRF)

We do not use advertising cookies or third-party tracking cookies. We do not sell or share cookie data with third parties for marketing purposes.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email and/or a notice within the platform. We encourage you to review this policy periodically.

Continued use of the platform following notification of changes constitutes your acceptance of the updated policy.

10. Contact us

If you have any questions, concerns, or requests relating to this Privacy Policy, please contact us: