Privacy policy
The short version
- We only collect what we need to answer enquiries, run our service and meet our legal duties.
- Our website sets no cookies and uses no analytics or advertising trackers.
- We never sell your information or use it to train AI tools.
- When we work inside a client's QuickBooks Online or Xero file, we act for that client under a data processing agreement.
1. Who we are
Alloca ("Alloca", "we", "us") is the trading name of Lee Metcalfe, a sole trader based in England.
For the personal information described in sections 2 to 4, we are the controller. That means we decide how and why it is used, and we are responsible for looking after it.
Questions about this policy or your information: email enquiries@alloca.co.uk.
2. Information we collect
When you visit our website
Our website does not use cookies, analytics, advertising or tracking tools. Like most websites, our hosting provider automatically records basic technical information when pages are requested, such as your IP address, browser type and the time of the visit, to keep the site running securely.
Our website loads its fonts from Google Fonts. To deliver the fonts, your browser connects to Google's servers, which will receive your IP address. You can read Google's privacy policy for more information.
When you make an enquiry
Our enquiry form does not send anything to us directly. It opens your own email app with your answers filled in, and nothing is sent until you press send. If you email us, we receive your name, business name, email address, your accounting software, your approximate number of receipts each month, and anything else you choose to include.
When you become a client
We hold contact details for the people we deal with at your business, along with the contract, invoices, payments and correspondence between us.
When you supply services to us
We hold contact and payment details for our suppliers and their staff.
3. How we use it and our lawful basis
| What we do | Lawful basis under UK GDPR |
|---|---|
| Keep the website secure and working | Legitimate interests (running a secure website) |
| Reply to enquiries and carry out the free health check | Steps you ask us to take before entering a contract, or legitimate interests (responding to business enquiries) |
| Provide our services, invoice and collect payment | Performance of our contract with your business |
| Keep accounting and tax records | Legal obligation |
| Send occasional updates about our services to existing clients | Legitimate interests (direct marketing). You can opt out at any time. |
| Deal with complaints, disputes or legal claims | Legitimate interests (protecting our business) or legal obligation |
We do not use your information for automated decision-making that has legal or similarly significant effects on you.
4. Who we share it with
We share personal information only where needed, with:
- our email and document storage provider, IONOS;
- our website hosting provider, IONOS;
- our password manager provider, Google or Microsoft (the password manager built into Chrome or Windows);
- our accountant, bank and professional advisers;
- HMRC, regulators, courts or the police, where the law requires it.
Each provider is bound by contract to protect your information and use it only on our instructions. We never sell personal information.
5. Information we process for our clients
To match payments to invoices, we work inside our clients' QuickBooks Online or Xero files. That gives us access to information about our clients' own customers, such as names, contact details, invoices, payments and, where a client uses our Direct Debit add-on, bank details. If a client uses our payment chasing service, we may also email their customers on their behalf.
For this information, our client is the controller and Alloca is a processor. We only use it on the client's written instructions, under a data processing agreement that meets Article 28 of the UK GDPR. We never ask for or use a client's login details. Each client invites us as an accountant user in QuickBooks or an adviser user in Xero.
If you are a customer of one of our clients and have questions about your information, please contact that business first. If you contact us, we will pass your request on to them promptly.
6. International transfers
Some of our providers may store or access information outside the UK. Where they do, we make sure the transfer is protected by UK adequacy regulations or by appropriate safeguards, such as the ICO's International Data Transfer Agreement or the UK Extension to the EU-US Data Privacy Framework.
7. How long we keep it
| Information | How long |
|---|---|
| Enquiries that do not lead to work | 12 months after our last contact |
| Client contracts, invoices and correspondence | 6 years after the end of the tax year in which our contract ends |
| Working files about a client's customers | Returned or deleted within 30 days of the service ending, as set out in our data processing agreement |
| Website server logs | As set by our hosting provider, IONOS |
8. How we keep it safe
We use multi-factor authentication on every account, an encrypted password manager, encrypted devices and encrypted connections. Access is limited to the people who need it, and we give each client file the least access our work requires. If a data breach affects you and is likely to cause a high risk to you, we will tell you without undue delay.
9. Your rights
Under data protection law you have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to us using your information, including for direct marketing, which we will always stop;
- ask us to transfer information you gave us to another organisation, where this applies.
To use any of these rights, email enquiries@alloca.co.uk. There is no charge. We will reply within one month, and may need to confirm your identity or ask what you are looking for first. Some rights have limits, and we will explain if one applies.
10. Complaints
If you are unhappy with how we have handled your information, please tell us first by emailing enquiries@alloca.co.uk. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
11. Changes to this policy
We will update this policy when our services or the law change. The date at the top shows when it was last revised. If we make a significant change that affects our clients, we will let them know directly.