Privacy Policy

1. Who we are

CFO PAL LTD, company number 17396293, registered office 124 City Road, London, EC1V 2NX, is the data controller in respect of the personal data described in Part A of this policy. Our ICO registration number is ZC222112.

Our data protection contact is Mo Romanowicz, reachable at privacy@cfopal.co.uk. We are not required to appoint, and have not appointed, a statutory Data Protection Officer.

Contact: privacy@cfopal.co.uk

2. Two different roles

This distinction matters and we set it out plainly.

Part A: where we are a controller. For personal data about you as a visitor to our website, as a user of the Service, and as a billing contact, we decide how and why the data is processed. This policy governs that processing.

Part B: where we are a processor. For the financial and business data you import into the Service, including data about your own clients, employees, customers and suppliers, you are the controller and we process it on your instructions. That processing is governed by our Data Processing Agreement, not by this policy.

---

PART A: WHERE WE ARE THE CONTROLLER

3. What we collect

Account data: name, business email address, job title, company name, password (stored hashed), two-factor authentication settings.

Billing data: billing name and address, subscription plan, transaction history. Card details are handled by Stripe and are never stored on our systems.

Usage data: pages viewed, features used, session timestamps, IP address, browser and device information.

Support data: correspondence with our support team.

Marketing data: your preferences in relation to marketing communications and, if you sign up from one of our adverts, the campaign details carried in that advert's link (for example the advertising network and campaign name, and for Google adverts the click identifier Google adds to the link), which we save with your account. We may later tell Google that a sign-up or payment came from its advert, sending only that click identifier and the time, with no name, email address or other detail about you. If you agree to it, we also keep those campaign details in a cookie on your device so that an advert you clicked on an earlier visit is still credited when you sign up later; if you do not agree, no such cookie is set and we can only see the advert when you sign up in the same visit. We never use any of this to build a profile of you or to target advertising at you. Full detail at cfopal.co.uk/cookies.

4. Why we process it, and our lawful basis

Where we rely on legitimate interests, we have assessed that our interest in operating, securing and improving the Service does not override your rights. You may object at any time.

5. Who we share it with

We share personal data with the sub-processors listed at cfopal.co.uk/subprocessors, which include our hosting, database, email and payment providers.

We may also disclose data where required by law, to enforce our terms, or in connection with a merger, acquisition or sale of assets, in which case we will notify you.

We do not sell personal data.

6. International transfers

Some of our sub-processors are located outside the UK. Where personal data is transferred outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with appropriate supplementary measures. Details for each sub-processor are on our sub-processor page.

7. How long we keep it

Account data: for the life of the account, then 30 days after closure or termination, as set out in our Terms of Service and Data Processing Agreement. Billing and transaction records: 7 years, to meet accounting and tax obligations. Support correspondence: 24 months. Usage and security logs: 12 months. Marketing data: until you withdraw consent or object.

8. Your rights

You have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent.

To exercise any of these, contact privacy@cfopal.co.uk. We respond within one month.

You may complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Security

We describe our security measures at cfopal.co.uk/security. In summary: encryption in transit and at rest, two-factor authentication, role-based access controls, least-privilege internal access, logging and monitoring.

10. Cookies

We use cookies that are strictly necessary for the Service to function, and these do not require consent. We also ask whether you are willing to accept an advertising measurement cookie, which remembers which advert or affiliate link brought you to us so that we can tell which adverts are worth paying for, and the button count described below, which sets no cookie. Our banner allows you to accept or reject both together, refusing is exactly as easy as accepting, and neither happens unless you accept.

You can change your answer at any time on cfopal.co.uk/cookies or, if you have an account, in Settings → Privacy & Support. Refusing deletes those cookies from your device as well as recording your decision.

We use no third-party analytics: no Google Analytics, no Tag Manager, no advertising pixel, no heatmaps and no session recording. If you agree to it, we count which of the two buttons at the top of our home page you click, recording the button, the page and the time and nothing else; it stores nothing on your device and carries no identifier, so it counts clicks rather than people. We never use cookies to build a profile of you or to target advertising at you, and we do not permit third parties to track you across other websites through our Service. Full detail at cfopal.co.uk/cookies.

11. Children

The Service is for business use and is not directed at anyone under 18.

12. Changes

We will post any changes here and, where material, notify you by email.

---

PART B: WHERE WE ARE A PROCESSOR

When you import financial data into CFO Pal, whether for your own business or, if you are an accounting practice, for a client business, that data may contain personal information about individuals such as your customers, suppliers, employees and directors.

For that data:

• You are the controller. You decide what to import and why.
• We are the processor. We act only on your documented instructions.
• You are responsible for having a lawful basis to import it, for informing the individuals concerned where required, and for your arrangements with any client business whose data you import.
• We provide a Data Processing Agreement at cfopal.co.uk/dpa, which forms part of your contract with us and sets out our obligations.

We do not use this data to train artificial intelligence or machine learning models. See our AI Policy at cfopal.co.uk/ai.

Aggregated statistics. We may derive aggregated, anonymised statistics from data across our customer base to operate, analyse and improve the Service. Aggregation applies minimum cohort sizes and suppresses small samples, so the result cannot be attributed to you, to any client business, or to any individual, and is not personal data. Your business is never named. Where we make aggregated output available within the Service, you can opt out of contributing in your account settings at any time without affecting your access to any feature. Where you are an accounting practice, opting out applies to every client business you manage.