Privacy notice
1. Who we are
A1 Books ("A1 Books", "we", "us"). The legal entity that provides the service will be named here once its registration is complete. Contact: [email protected]. For any privacy question or request, write to [email protected].
[COMPANY DETAILS, once registered: registered company name and legal form, registration number, registered address.]
[COMPANY DETAILS: EU and UK representatives, needed only if the company has no office in the EU or the UK]
2. Our two roles
- We decide how your data is used ("controller") for our website, demo and consultation requests, the waiting list (used only when new sign-ups are full), client account and user details, billing and support.
- We act on our client's instructions ("processor") for personal data inside a client's books and payroll, such as the names, bank details and salaries of the client's employees, customers and suppliers. Our client is the controller of that data. We use it only to provide the service, under our data processing agreement, which forms part of our terms of service. If your data is in a client's books, please contact that business first; we will help them answer you.
3. What we collect
- Demo and consultation form: your name, work email, company, country, whether you want a demo or a consultation, the plan you are interested in, and what you write about your companies, staff and transactions.
- Waiting list (only when new sign-ups are full): your name and email address, the page you signed up from, the time, and the country your connection comes from.
- Clients and their users: names, business email addresses, roles, login and two-step login details, and a record of actions taken in the portal (audit trail).
- Billing (once we take payments): company details, invoices and payment records. Card payments will be handled by a payment provider; we never store card details.
- Bookkeeping clients: business details, including the names and roles of directors, the names and shareholdings of owners with 25% or more, and a main contact's name, email and phone.
- Client books and documents: the records our clients send us, which may include personal data of their staff, customers and suppliers (see section 2).
- Emails and calls: what you tell us when you contact us or join a video call.
- Technical data: our hosting provider processes your IP address and basic browser data to deliver the site and block attacks.
Please do not send identity documents or financial records through the website form. Clients send documents through the portal or by email.
4. Why we use it, and on what legal basis
- To reply to your request, arrange a demo or consultation and prepare a quote: steps you ask for before a contract (GDPR and UK GDPR, Article 6(1)(b)).
- To provide the service, run client accounts, bill and support you: performance of our contract (Article 6(1)(b)).
- To keep accounting and tax records and answer lawful requests from authorities: legal obligation (Article 6(1)(c)).
- To keep a record of enquiries, secure the site and platform, prevent fraud and spam, and defend legal claims: our legitimate interests (Article 6(1)(f)).
- To tell you when a place opens, if you joined the waiting list: steps you asked for before a contract (Article 6(1)(b)). You can ask us to remove you at any time.
- To confirm who runs and owns the businesses we keep books for: legal obligation (Article 6(1)(c)) where anti-money-laundering or sanctions law applies to us, and otherwise our legitimate interest in preventing fraud and financial crime (Article 6(1)(f)).
- To send existing clients occasional service news. You can opt out at any time by replying or using the link in the email.
- To contact people at businesses that may use A1 Books about our services: our legitimate interests (Article 6(1)(f)). See section 4A.
Where the laws of the UAE, Saudi Arabia, Qatar, Lebanon or Canada apply, we rely on the equivalent grounds those laws allow, including your consent where it is required. We do not sell your data and we do not use it for advertising.
4A. People we contact about our services
[COMPANY DETAILS: A1 legal name, address, email] is the controller of this data.
- What we collect: the name, job title and business email of people at businesses that may use A1 Books, and where we found them. We collect these only from openly published sources, such as company websites and business directories.
- Why, and on what basis: to offer our services to businesses. The legal basis is our legitimate interest in business-to-business marketing. Our assessment is available on request.
- Who receives it: our email and AI drafting providers, under contract. A person reviews every email before it is sent. Where these providers are outside the UK or EEA, transfers are protected as set out in section 6.
- Your rights: you may access, correct, erase or restrict your data, object to marketing at any time, and complain to your data protection authority.
- How long we keep it: if you object, we keep only your email address on a do-not-contact list so you are never contacted again. If you do not reply, we delete your details 12 months after our first email.
5. Who receives it
We share personal data only with providers we need to run A1 Books. They act on our instructions under written contracts, except tax partners (see below).
- Cloudflare: website hosting, content delivery and security, on its global network.
- Cloudflare: database, document storage and sign-in for the client portal, with data stored in the EU.
- Website forms: stored with Cloudflare, in the EU.
- Email delivery: Resend (Resend, Inc.) sends account and service emails, from its EU region. Business mailboxes: Zoho Mail (Zoho Corporation), EU data centre.
- Video calls for demos and consultations: Google Meet (Google).
- Google Fonts: delivers the website's fonts and receives your IP address.
- Payroll providers and e-invoicing providers: only in the countries and for the clients that use them.
- Tax partners: if a client orders our filing service, we share that client's records and year-end figures with the independent, qualified tax professional who prepares, signs and files the return (the "Tax Partner"). We tell the client the Tax Partner's name before the client orders the service. The Tax Partner is not one of our providers: it uses the data as an independent controller, under its own professional duties and privacy notice, and only for that return.
- Our own staff and contractors, who are bound by confidentiality, and our professional advisers.
- Authorities, courts or regulators, when the law requires it.
We keep an up-to-date list of the providers that handle client data and tell clients by email at least 30 days before adding or replacing one, so they can object.
6. International transfers
We serve clients in North America, Europe and the Middle East, and some providers are based in other countries, including the United States. When personal data leaves the country where it was collected, we use the safeguards that country's law requires:
- EU and EEA: an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or the European Commission's standard contractual clauses.
- United Kingdom: UK adequacy regulations, or the UK International Data Transfer Agreement or the UK Addendum to the EU clauses.
- United Arab Emirates: the conditions of Federal Decree-Law No. 45 of 2021 (PDPL). If you are in the DIFC or ADGM, their own data protection rules apply.
- Saudi Arabia: the conditions of the Personal Data Protection Law and its transfer regulations, such as standard contractual clauses.
- Qatar: Law No. 13 of 2016 on the protection of personal data.
- Lebanon: Law No. 81 of 2018 on electronic transactions and personal data.
- Canada and the United States: contracts that give comparable protection, as Canadian privacy law requires.
You can ask us for a copy of the safeguards that apply to your data.
7. How long we keep it
- Enquiries that do not become clients: deleted after 24 months.
- People we contact about our services: deleted 12 months after our first email if you do not reply; if you object, only your email address is kept on a do-not-contact list (section 4A).
- Waiting-list details: deleted once we have told you a place is open, or earlier if you ask.
- Business details of bookkeeping clients (who runs and owns the business): kept while you are a client and for 5 years afterwards, or longer if the law requires it.
- Client books and documents: kept while you are a client, then for 90 days of read-only access after you leave, then deleted within 30 days unless the client asks us to keep them longer or the law requires it.
- Our own contracts, invoices and billing records: kept for [COMPANY DETAILS: period the law of our country of registration requires].
- Backups: overwritten on a rolling basis within 35 days.
8. Security
The website is served over HTTPS, and only authorised staff can read form submissions. The client portal uses encrypted connections, daily backups, two-step login for every account, roles and permissions, and an audit trail on every entry. Staff and contractors access client data only as needed and under confidentiality duties. No system is perfectly secure, so please tell us at once if you think your account has been misused.
9. Data breaches
If a security incident affects personal data, we act at once to contain it. We tell affected clients without undue delay and within 48 hours of becoming aware of it, with the information they need to meet their own duties. Where we are the controller, we notify the relevant authority and affected people when the law requires it, for example within 72 hours under the GDPR.
10. Your rights
Depending on where you are, you can ask to see, correct, delete or receive a copy of your data, to restrict or object to how we use it, and to withdraw consent. Write to [email protected]; we may need to confirm who you are, and we reply within one month (or sooner where local law requires).
You can also complain to a data protection authority, such as the one where you live or work, or [COMPANY DETAILS: our lead authority, which depends on where the company is registered]. Examples: the UK Information Commissioner's Office (ico.org.uk), the UAE Data Office, or the Saudi Data & AI Authority (SDAIA).
11. Cookies and browser storage
We do not use advertising or analytics cookies. The site saves the region you choose in your own browser, so the page remembers it; this is strictly necessary and is not sent to us. The website's fonts are loaded from Google Fonts, which receives your IP address. Product screens shown on the site are part of the page itself. The client portal uses one strictly necessary cookie to keep you signed in. If we ever add analytics, we will update this notice and ask for consent where required.
12. Business use only
Our services are for businesses. We do not knowingly collect data from children through this website.
13. Changes
If we change this notice, we update the date at the top of this page, and we tell clients by email about important changes.