1. Information We Collect

We collect information that identifies, relates to, or could reasonably be linked with you or your business ("Personal Data"):

• Contact & Account Information: Full name, corporate email address, phone number, company name, registered business address, billing address, and credentials provided during subscription signup, consultation scheduling, or portal access.
• Financial & Transactional Data: Bank account feeds, credit card feeds, invoices, expense records, payment metadata, tax filings, and ledger entries submitted or synchronized with our bookkeeping platform.
• Technical & Usage Data: IP address, browser type and version, device identifiers, operating system, referral URLs, navigation paths, and interaction timestamps collected automatically via secure server logs and functional cookies.

2. How We Use Your Information

We utilize collected information solely for legitimate operational, professional, and regulatory purposes, including:

• Delivering and managing our cloud bookkeeping, bank feed reconciliation, and advisory packages (Ledger, Balance, Advisory, CFO Suite).
• Processing subscription payments and recurring billing securely via certified payment gateways (e.g. Stripe).
• Generating monthly Profit & Loss (P&L) statements, Balance Sheets, Cash Flow statements, and quarterly tax preparation files.
• Responding to consultation requests, technical inquiries, and dedicated CPA advisory communications.
• Ensuring infrastructure integrity, verifying client identities, and preventing unauthorized access or fraud.
• Complying with applicable UK, EU, and international tax reporting and corporate accounting statutory requirements.

3. Data Protection and Security Safeguards

We implement enterprise-grade administrative, technical, and physical security measures designed to safeguard sensitive client records:

• Encryption in Transit & at Rest: All data transmitted between your browser and our servers is secured using Transport Layer Security (TLS 1.3). Data stored within our databases is protected with AES-256 bit encryption.
• Strict Access Control: Access to production systems and client books is restricted to vetted personnel under strict role-based controls and mandatory Multi-Factor Authentication (MFA).
• Routine Vulnerability Audits: Our infrastructure undergoes scheduled security scanning and continuous monitoring against modern cybersecurity threats.

4. Sharing and Disclosure of Information

Vestra Advisory never sells, rents, or monetizes your corporate or personal data. Information is only disclosed in the following necessary contexts:

• Authorized Service Providers: Trusted cloud hosting partners, encrypted database providers, and payment processors (such as Stripe) that operate under strict non-disclosure and GDPR-compliant data processing agreements.
• Legal & Regulatory Mandates: Where required by valid legal process, judicial order, or regulatory authority (e.g., HMRC or authorized financial regulatory bodies).
• Corporate Restructuring: In the event of a merger, acquisition, or sale of company assets, subject to the same privacy commitments established herein.

5. Cookies and Tracking Technologies

We utilize necessary session cookies and privacy-friendly performance cookies to maintain your login session, prevent CSRF attacks, and ensure our web application functions properly. For full details on our cookie classification, refer to our dedicated Cookie Policy.

6. Your Statutory Rights

Under applicable data privacy regulations (including UK GDPR, EU GDPR, and CCPA where applicable), you are entitled to exercise the following rights:

• Right of Access: Request a comprehensive copy of your personal and accounting records held by us.
• Right to Rectification: Request correction of inaccurate, outdated, or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request the permanent deletion of your data, subject to mandatory statutory tax and accounting retention requirements.
• Data Portability: Obtain your financial ledger data in a standard, machine-readable format.

7. Data Retention Policy

We retain client accounting ledgers and transactional records for the duration of your active service subscription, plus the minimum statutory retention period required by corporate accounting and taxation statutes (typically six years under UK and EU law). Once this period expires, all data is securely expunged or irreversibly anonymized.

8. Contact Our Data Protection Team

For questions regarding this policy, data subject access requests, or privacy concerns, please contact our Data Protection Officer:

• Company: Vestra Advisory Ltd.
• Address: International House, 10 Churchill Way, Cardiff, CF10 2HE, United Kingdom
• Email: privacy@vestra-advisory.com
• General Support: support@vestra-advisory.com