Privacy Policy

1. Who we are

CFO PAL LTD, company number 17396293, registered office 124 City Road, London, EC1V 2NX, is the data controller in respect of the personal data described in Part A of this policy. Our ICO registration number is ZC222112.

Our data protection contact is Mo Romanowicz, reachable at privacy@cfopal.co.uk. We are not required to appoint, and have not appointed, a statutory Data Protection Officer.

Contact: privacy@cfopal.co.uk

2. Two different roles

This distinction matters and we set it out plainly.

Part A: where we are a controller. For personal data about you as a visitor to our website, as a user of the Service, and as a billing contact, we decide how and why the data is processed. This policy governs that processing.

Part B: where we are a processor. For the financial and business data you import into the Service, including data about your own clients, employees, customers and suppliers, you are the controller and we process it on your instructions. That processing is governed by our Data Processing Agreement, not by this policy.

---

PART A: WHERE WE ARE THE CONTROLLER

3. What we collect

Account data: name, business email address, job title, company name, password (stored hashed), two-factor authentication settings.

Billing data: billing name and address, subscription plan, transaction history. Card details are handled by Stripe and are never stored on our systems.

Usage data: pages viewed, features used, session timestamps, IP address, browser and device information.

Support data: correspondence with our support team.

Marketing data: your preferences in relation to marketing communications.

4. Why we process it, and our lawful basis

Where we rely on legitimate interests, we have assessed that our interest in operating, securing and improving the Service does not override your rights. You may object at any time.

5. Who we share it with

We share personal data with the sub-processors listed at cfopal.co.uk/subprocessors, which include our hosting, database, email and payment providers.

We may also disclose data where required by law, to enforce our terms, or in connection with a merger, acquisition or sale of assets, in which case we will notify you.

We do not sell personal data.

6. International transfers

Some of our sub-processors are located outside the UK. Where personal data is transferred outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with appropriate supplementary measures. Details for each sub-processor are on our sub-processor page.

7. How long we keep it

Account data: for the life of the account, then 12 months after closure. Billing and transaction records: 7 years, to meet accounting and tax obligations. Support correspondence: 24 months. Usage and security logs: 12 months. Marketing data: until you withdraw consent or object.

8. Your rights

You have the right to access your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent.

To exercise any of these, contact privacy@cfopal.co.uk. We respond within one month.

You may complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Security

We describe our security measures at cfopal.co.uk/security. In summary: encryption in transit and at rest, two-factor authentication, role-based access controls, least-privilege internal access, logging and monitoring.

10. Cookies

We use only cookies that are strictly necessary for the Service to function, and we run no analytics or tracking. Our banner is therefore a notice rather than a consent request, and there is nothing to accept or reject. Full detail at cfopal.co.uk/cookies. If we ever introduce a non-essential cookie or any analytics, we will ask for your consent first.

11. Children

The Service is for business use and is not directed at anyone under 18.

12. Changes

We will post any changes here and, where material, notify you by email.

---

PART B: WHERE WE ARE A PROCESSOR

When you import financial data into CFO Pal, whether for your own business or, if you are an accounting practice, for a client business, that data may contain personal information about individuals such as your customers, suppliers, employees and directors.

For that data:

• You are the controller. You decide what to import and why.
• We are the processor. We act only on your documented instructions.
• You are responsible for having a lawful basis to import it, for informing the individuals concerned where required, and for your arrangements with any client business whose data you import.
• We provide a Data Processing Agreement at cfopal.co.uk/dpa, which forms part of your contract with us and sets out our obligations.

We do not use this data to train artificial intelligence or machine learning models. See our AI Policy at cfopal.co.uk/ai.

Aggregated statistics. We may derive aggregated, anonymised statistics from data across our customer base to operate, analyse and improve the Service. Aggregation applies minimum cohort sizes and suppresses small samples, so the result cannot be attributed to you, to any client business, or to any individual, and is not personal data. Your business is never named. Where we make aggregated output available within the Service, you can opt out of contributing in your account settings at any time without affecting your access to any feature. Where you are an accounting practice, opting out applies to every client business you manage.