1. Who we are and our role
COMPLYCLOCK LIMITED, incorporated in England and Wales with company number 17474503. Our registered office is 255-259 2nd Floor West Wing Commercial Road, London, United Kingdom, E1 2BT. Contact us at hello@complyclock.uk.
We are a controller for account administration, security, billing, enquiries, support and our own legal records. We also act as controller when providing an individual’s personal Self Assessment workspace, using necessary information to provide that individual’s requested service. For business workspace data that we process on a Customer’s instructions, we are a processor under the DPA; an accounting practice may itself be a processor for clients, making us its sub-processor. The roles depend on the purposes and circumstances of the processing, rather than a signup label. Personal users are not required to assume business controller obligations.
2. Information we handle
Account information includes name, email, credentials stored as password hashes, authentication and security records, memberships, roles, preferences, and the individual or organisation details and declarations recorded with legal agreements. We receive subscription, invoice and payment-status information from Stripe; payment-card details are handled by Stripe rather than stored in our application.
Customer workspaces may contain personal Self Assessment, business and Companies House records, tax identifiers and registrations, deadline and filing information, financial amounts, contacts, assignments, comments, requests, uploaded documents, audit/reminder histories, exports and AI results. A client upload link gives its recipient access to the specified request and documents; the requesting business controls that request. Limit uploaded data to what is needed.
Enquiries and support include your name, email, business, message, attachments and correspondence. Routine technical records can include IP addresses, request timings, user-agent details, error reports and internal workspace/user identifiers. We filter sensitive parameters and credentials from monitoring; avoid including unnecessary sensitive information in free text.
3. Where information comes from
We obtain information from you, workspace managers and authorised users, clients submitting requested documents, integrations and Companies House public registry records. Public availability does not remove data-protection rights. We may receive billing and security information from our suppliers.
Before accepting a password, our server sends only the first five characters of its SHA-1 hash to Pwned Passwords using a padded range request. The service sees that partial hash and our server connection information. It does not receive your password, full password hash, email or account identity from this check. We compare the returned hash suffixes on our server.
4. Purposes and lawful bases
For an individual who contracts with us, including a personal Self Assessment user or sole trader, necessary account setup, the requested personal workspace service, service administration and billing use the contractual necessity basis. For employees, invited users and business contacts who are not themselves parties to the contract, we rely on legitimate interests in administering and supporting the customer relationship. We use the minimum information needed and consider the individual’s interests.
Security, abuse prevention, access control, password checks, operational reliability and proportionate fraud/dispute evidence rely on our legitimate interests in protecting the Service, customers and users. Responding to ordinary enquiries and support relies on legitimate interests in providing requested help and managing the relationship. Keeping required tax/accounting records and complying with binding legal requests rely on legal obligation; retaining other necessary contractual or dispute evidence relies on legitimate interests.
Business Customer-directed workspace processing within the DPA’s scope does not rely on our own consent or contractual basis as controller: the Customer identifies the appropriate lawful basis and gives instructions under the DPA. For personal Self Assessment workspaces, we use our controller bases described above and handle rights requests directly. Optional Google Analytics requires your consent. Declining analytics has no effect on the Service. We do not send promotional marketing merely because you created an account or submitted a support form.
5. AI and human review
When an authorised user requests an AI feature, selected records and relevant context are sent to OpenAI: for example company profile facts for setup suggestions, deadline facts for explanations, audit history for summaries, risk information for an entity summary, or the request and task context for a client-message draft. We send the feature’s necessary context rather than giving OpenAI unrestricted access to the workspace. Names and financial information may appear if included in those records.
We use OpenAI’s standard international API service, without an agreed EU region or zero-data-retention arrangement. API data is not used for training unless the API customer opts in; we do not opt in. Requests set store: false to reduce stored response state. This does not provide zero data retention: standard abuse-monitoring logs may retain content for up to 30 days, with longer retention where law or specific safety exceptions require it.
Users must review outputs and verify facts before use. AI outputs, usage records and accepted drafts remain in the workspace until removed or the workspace is deleted. Finished generation request payloads are cleared after seven days by scheduled cleanup; that does not delete retained outputs or provider logs. We do not use AI to make solely automated decisions with legal or similarly significant effects about individuals.
6. Who receives information
AWS supplies application hosting, MySQL database, S3 document storage and SES email delivery in Ireland. OpenAI supplies AI processing. Honeybadger supplies error monitoring. Heart Internet hosts our hello@complyclock.uk mailbox. Stripe provides subscription billing and payments; it is a processor for some billing services and an independent controller for payment processing, fraud prevention and its regulatory obligations. Google Analytics receives a pseudonymous identifier and sanitised public page views from our server only when enabled and you consent; we do not forward your browser IP address, user-agent, private referrer, account identity or form contents.
The Sub-processors page describes these roles, locations and supplier terms. Companies House and Pwned Passwords are independent public/security sources, rather than our contracted workspace sub-processors. Hatchbox is used for infrastructure setup only under our current operating arrangement and is not given customer-data processing access; that assumption must be reviewed if its use changes.
Access within a workspace follows its owner’s roles and sharing instructions. Limited authorised staff and suppliers may access information for support, security and administration. We may disclose necessary information where law requires, to professional advisers under confidentiality, or in a business transfer with appropriate safeguards and notice. We do not sell personal data.
7. International processing and safeguards
AWS application, database, document storage, email delivery and the confirmed backups are in eu-west-1, Ireland. There are no additional AWS backup copies outside Ireland under the current arrangement. Supplier support, security operations, AI, monitoring, payments, mailbox services and analytics can involve international processing, including the United States; we do not describe all processing as Ireland-only.
Transfers to the EEA use applicable UK adequacy arrangements. For non-adequate destinations we use the relevant supplier DPA and applicable contractual safeguards, including standard contractual clauses with the UK Addendum or UK International Data Transfer Agreement, and assess the transfer and supplementary protections. An adequacy framework is used only where the recipient’s certification covers the transfer. Ask hello@complyclock.uk for information about relevant safeguards or a copy, with confidential details redacted where necessary.
8. Retention and deletion
Billing cancellation retains the workspace. Owners should export before permanent deletion. Live workspace records and documents are removed when the workspace is permanently deleted; file purging and background cleanup may be asynchronous. Customer-directed audit and reminder history is retained while the workspace exists. Exports are available for seven days and expired archives are cleaned up hourly.
RDS automated backups are retained for 30 days. Noncurrent S3 document versions, including versions left after live deletion, are eligible for expiry after 35 days; lifecycle deletion runs asynchronously and is not an exact-time guarantee. Backups are access restricted and used for recovery, rather than ordinary access. After restoration we reapply valid deletions and expiry decisions before returning recovered data to ordinary use. There is no promise of recovery after permanent deletion.
Ordinary enquiries and support are retained for 12 months after closure. Routine operational logs and error reports are retained for up to 90 days. Necessary billing, contract and substantive dispute or incident evidence may be retained for six years after the relevant contractual event, closure or incident; active contractual acceptance evidence remains available while it governs an active workspace. We retain only evidence justified for that purpose, with access limited to authorised people.
A documented legal hold may postpone deletion of relevant evidence for a claim, investigation or binding duty; we review its need and remove the hold when it ends. Mailbox copies and supplier records follow managed retention procedures and their applicable legal obligations. Cookie choices and their notice versions are retained for six months. Google Analytics is configured for two-month event/user retention without activity-based resets before activation; aggregate reporting may outlast individual event/user records.
9. Cookies and analytics
Essential cookies support secure sessions, authentication and the optional remembered second factor. Session duration follows the session/security controls; a remembered second-factor grant lasts seven days. These necessary cookies are not used for advertising. We store a signed cookie-preference receipt for six months so we can honour your choice and demonstrate which notice you saw.
Google Analytics is off by default and requires both an operational enablement setting and a valid measurement ID. When enabled, our basic consent implementation makes no Google requests until you accept. Rejecting, withdrawing, an expired choice or an invalid receipt turns analytics off. You can change your choice at Cookie preferences in the footer at any time, as easily as accepting.
With acceptance, our server uses a pseudonymous identifier derived from your cookie-preference receipt to send only allowlisted public marketing page views through Google Analytics’ Measurement Protocol. No Google browser tag or automatic engagement collection is loaded, and no Google Analytics browser cookies are set. We send only the public canonical URL and title, a blank referrer and the pseudonymous identifier, without query strings, fragments, customer information or an account user ID. Authentication, workspace, legal-version, cookie-preference and token pages do not send analytics. Advertising features, Google Signals and enhanced measurement are disabled. This minimal setup does not provide full visitor attribution or browser/device reporting.
10. Security and restricted data
We use access controls, tenant-scoped permissions, encrypted web connections, password hashing, multi-factor authentication, private document storage with server-side encryption, short-lived download links, backups and filtered monitoring. We review privileged access and supplier arrangements. No internet service is absolutely secure; our DPA describes contractual security commitments without guaranteeing a particular uptime or recovery time.
Do not submit health or other special-category data, criminal-offence information, or children’s personal data unless we expressly agree suitable safeguards in writing first. The Service is intended for authorised users aged 18 or over.
11. Your rights and how to request them
Depending on the circumstances, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw analytics consent at any time without affecting earlier lawful processing. These rights have conditions and exceptions, including required records and others’ rights.
For our controller processing, email hello@complyclock.uk. We may request proportionate information to verify your identity and understand the request. We respond within the applicable statutory period, normally one month, with any lawful extension or clarification explained. We do not routinely charge for rights requests.
For your personal Self Assessment workspace, contact hello@complyclock.uk directly about your rights. For data that we process on a business Customer’s instructions, contact the business responsible for that processing first; we assist it under the DPA and refer requests received directly to it unless law requires us to respond ourselves. Workspace owners can export and delete their workspace; users can manage their profile and security or request account deletion subject to ownership-transfer requirements.
12. Complaints
Send privacy complaints to hello@complyclock.uk or our registered office. We acknowledge privacy complaints within 30 days, investigate without undue delay, keep you informed and communicate the outcome and any action taken. We retain proportionate complaint evidence under the retention rules above.
You can complain to the Information Commissioner’s Office at ico.org.uk or by calling 0303 123 1113. You do not need our permission to do so. Our ICO fee registration or exemption assessment is pending; we do not claim a registration number.
13. Changes and contact
We keep dated notice versions and update this notice when our processing changes. We highlight material changes and give contractual notices where required by the Terms or DPA. A privacy notice update does not by itself authorise a new purpose or substitute for analytics consent. Contact hello@complyclock.uk for privacy matters or accessible copies.