Privacy Policy
Last updated: 12 June 2026
This policy explains what personal data Ledgerline collects, why we collect it, how long we keep it and what rights you have. It applies to our website and to the Ledgerline platform.
Ledgerline is the data controller for personal data about visitors to this site and about the individual users of our platform. Where we process financial data belonging to a customer organisation, we act as a data processor on that organisation's instructions, under the data processing terms in their contract with us.
The data we collect
Account data. Name, work email address, job title, workspace and role. This is provided by your organisation's administrator when your account is created.
Usage data. Sign-in events, pages viewed within the platform, reports generated and features used. We use this to operate the service, investigate support issues and understand which parts of the product are used.
Technical data. IP address, browser type and version, device type and approximate location derived from IP address. This is collected automatically and retained in access logs.
Customer financial data. Bank balances, transaction lines, ledger extracts, forecast assumptions and covenant definitions belonging to your organisation. This is business data rather than personal data, but it can contain personal data — a supplier's name on a payment line, for example. We process it only to provide the service.
Enquiry data. If you contact us through this website, the name, company, email address and message you send us.
Why we process it
| Purpose | Lawful basis | | --- | --- | | Providing and operating the platform | Performance of a contract | | Authenticating users and preventing unauthorised access | Legitimate interests | | Support, incident investigation and service communications | Performance of a contract | | Product analytics and service improvement | Legitimate interests | | Responding to sales enquiries | Legitimate interests | | Meeting accounting, tax and audit obligations | Legal obligation |
We do not sell personal data, and we do not use customer financial data to train generalised models or to build products for other customers.
Where your data is held
Platform data for customers contracting with our UK entity is processed and stored in the United Kingdom. Data for customers contracting with our Netherlands entity is processed and stored in the European Economic Area. We do not transfer platform data outside those regions except where a customer asks us to, in which case appropriate safeguards are put in place first.
How long we keep it
Account and usage records are retained for the life of the account and for twelve months after it is closed. Access logs are retained for twelve months. Customer financial data is retained for the term of the contract and deleted within 90 days of termination unless a longer period is agreed in writing. Enquiries from this website are retained for 24 months.
Sub-processors
We use a small number of sub-processors for infrastructure hosting, error monitoring, email delivery and customer support. A current list, with the processing location for each, is maintained in our trust documentation and provided to customers on request. Customers are notified before a new sub-processor is added.
Your rights
Under UK and EU data protection law you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data erased in certain circumstances, to restrict or object to processing, and to receive your data in a portable format. Where we rely on consent, you may withdraw it at any time.
If your account was created by your employer, requests about data held in the platform are usually best directed to them first, as they control that data. We will support them in responding.
You also have the right to complain to your local supervisory authority — the Information Commissioner's Office in the United Kingdom, or the Autoriteit Persoonsgegevens in the Netherlands.
Security
Access to production systems is restricted to named personnel, requires multi-factor authentication, and is logged. Data is encrypted in transit and at rest. We run background checks on staff with production access, review access quarterly, and test our incident response process annually.
Changes
We will post any changes to this policy on this page and update the date at the top. Where a change materially affects how we handle personal data, we will notify account administrators by email before it takes effect.
Contact
Questions about this policy, or about the personal data we hold, should be sent to our data protection contact using the details on our contact page.