Privacy Notice

Who we are

RegNexus Books is operated by RegNexus Limited, a company registered in England and Wales with company number 17280006 and registered office at 19 Lewis Crescent, Wellington, Telford, England, TF1 2FQ. In this notice, “RegNexus”, “we”, “us” and “our” mean RegNexus Limited. For privacy enquiries, requests or complaints, contact hello@reg-nexus.com and put “Privacy” in the subject line.

When RegNexus is a controller and when it is a processor

Our role depends on the particular processing activity. Where we act as processor When a business customer uses RegNexus Books to store or process information in its books - for example ledger records, invoices, supplier/customer information, bank transactions, payroll or tax information - the customer normally decides why that information is processed. The customer is the controller and RegNexus acts as its processor. That processing is governed by our Data Processing Agreement (“DPA”) with the customer. If you are an employee, worker, customer, supplier or other contact of a RegNexus Books customer and your information appears in that customer's account, you should normally contact that customer first. We will assist the customer with your request where required. Where we act as controller We act as an independent controller where we determine the purposes and essential means of processing, including for:

• account and user administration;
• authentication and account security;
• our own subscription billing and payment administration;
• customer support and service communications;
• service security, fraud/abuse prevention and incident investigation;
• compliance with legal obligations and the establishment, exercise or defence of legal claims;
• management of our business relationship with customers and authorised users;
• product/service analytics where carried out for our own lawful purposes.

A single service relationship can therefore involve both roles.

Personal data we process as controller

Depending on how you interact with us, we may process: Category Examples Identity and business-contact data name, work email, telephone number, job title, company/organisation details Account and authentication data user identifier, password hash, MFA settings, role, SSO/identity-provider identifiers Subscription and billing data plan, billing contact, invoices, payment status and transaction references Support and communications support requests, correspondence, feedback, complaint records Technical and security data IP address, device/browser information, login/session records, security events, audit lo Usage data feature interactions and service telemetry used to operate, protect and improve the se Marketing preferences communication preferences and engagement with lawful marketing We do not intentionally ask account users to provide special-category data for ordinary account administration. Customer Data processed on a customer's behalf may, however, contain highly personal or special-category information, including payroll information. That processing is governed by the customer and our DPA.

Why we use personal data and our lawful bases

Purpose Lawful basis Set up and administer an account for an individual who is personally contracting with us necessary for a contract or steps Provide and administer the service for users of a corporate customer our legitimate interests in perfor Authenticate users and manage access contract where applicable; other Process our subscription charges and maintain billing records contract where applicable; legitim Provide support and service communications contract where applicable; other Protect the service, prevent fraud/abuse and investigate security incidents legitimate interests in protecting Comply with law, regulatory requests and court orders legal obligation Establish, exercise or defend legal claims legitimate interests and other leg Analyse and improve service operation legitimate interests, subject to ap Send direct marketing legitimate interests or consent a Where we rely on legitimate interests, we consider the purpose, necessity and impact on individuals. You have the right to object to processing based on legitimate interests in circumstances provided by law. You can always object to direct marketing.

Customer Data and payroll information

RegNexus Books can process personal data about individuals who are not parties to the customer contract, such as employees, workers, customers and suppliers. Where we process this information on a customer's behalf:

• the customer is responsible for identifying an appropriate lawful basis and, where relevant, an

Article 9 condition for special-category data;

• RegNexus processes the information only on documented instructions, except where UK law re-

quires otherwise;

• RegNexus applies the security and processor obligations set out in the DPA.

A National Insurance number is an important identifier but is not, by itself, “special category” data under Article 9 UK GDPR. Payroll records can nevertheless contain special-category information, for example health or trade-union information.

AI-assisted features

Some RegNexus Books features may use third-party AI services, currently including the OpenAI API, to assist with functions such as financial narrative drafting, transaction categorisation, natural-language assistance and information extraction. For Customer Data:

• RegNexus remains subject to the customer's documented instructions and the DPA;
• authoritative accounting outcomes remain governed by RegNexus's deterministic accounting con-

trols; AI assistance does not by itself change the authoritative ledger;

• only data reasonably necessary for the enabled AI function should be sent to the AI provider;
• OpenAI states that business/API inputs and outputs are not used to train its models by default

unless the customer expressly opts in;

• API retention depends on the endpoint and configuration. Standard API inputs/outputs may be

retained for up to 30 days for service and abuse-monitoring purposes; eligible Zero Data Retention controls may be available for qualifying configurations. RegNexus will not describe an AI feature as “zero retention” unless that control has been verified for the particular production feature. Where an AI feature is optional, we aim to provide customer controls appropriate to the feature and data-minimisation purpose. The availability of an opt-out will be stated in-product where implemented.

Who we share personal data with

We may disclose personal data to:

• service providers and sub-processors that host, secure, communicate or otherwise support Reg-

Nexus Books;

• payment providers involved in RegNexus's own subscription billing;
• professional advisers, auditors and insurers where necessary;
• public authorities, courts, regulators or law-enforcement bodies where required or permitted by

law;

• a purchaser, investor or successor in connection with a genuine corporate transaction, subject to

appropriate confidentiality and data-protection safeguards;

• third parties you or the relevant customer instruct us to connect to.

Our current Customer Data sub-processors are listed separately in the RegNexus Books Subprocessor List. HMRC and Companies House Where a customer instructs RegNexus Books to transmit a filing, RegNexus processes the relevant Customer Data for that transmission on the customer's behalf. HM Revenue & Customs and Companies House determine their own statutory purposes for the information they receive and ordinarily act as separate controllers for that subsequent processing. Payment providers Payment providers can have different legal roles depending on the service. For RegNexus's own subscription billing, the applicable provider processes billing/payment information under its own contractual and privacy terms and may act as our processor and/or as an independent controller for activities such as payment-network, fraud, legal and regulatory compliance. Customer-initiated payment integrations are described according to the actual provider/service used.

International transfers

Some suppliers process personal data outside the United Kingdom. Where the recipient is in a country covered by UK adequacy regulations, we may rely on that adequacy route. This includes transfers within the scope of applicable UK adequacy regulations for EEA countries. Where a restricted transfer is not covered by adequacy, we use a lawful transfer mechanism as applicable, such as:

• the UK International Data Transfer Agreement (“IDTA”);
• the European Commission Standard Contractual Clauses together with the UK International Data

Transfer Addendum; or

• another transfer mechanism recognised under UK law.

Where required for a safeguard-based restricted transfer, we carry out and document the applicable UK data-protection-test/transfer risk assessment and any supplementary measures needed. The Sub-processor List gives further information about the principal locations and transfer arrangements for Customer Data. You may contact us for information about the safeguards relevant to a particular transfer.

How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it is processed, including applicable legal, accounting, security and claims requirements. Data for which RegNexus is controller We use a record-class retention schedule rather than one blanket period. In general:

• account/profile information is kept while the account/business relationship is active and then

deleted or anonymised when no longer needed, subject to justified legal/claims retention;

• billing and accounting records are retained for the period required by applicable tax/accounting

law;

• support, complaint, security and audit records are retained for periods determined by their pur-

pose, sensitivity, security and applicable limitation/legal requirements;

• backup copies are removed in accordance with our backup lifecycle and are protected from ordi-

nary use while awaiting deletion. Customer Data for which RegNexus is processor Customer Data is retained for the customer relationship and then returned or deleted in accordance with the DPA and the customer's instructions, unless UK law requires RegNexus to retain particular data. Data remaining temporarily in protected backups is put beyond ordinary use and deleted through the normal secure backup-expiry cycle. Pseudonymisation is a security/minimisation measure; pseudonymised information may still be personal data. We do not treat pseudonymisation alone as equivalent to deletion.

Security

We use technical and organisational measures designed to protect personal data appropriate to the risk. These include controls such as encryption in transit, password hashing, protected MFA secrets, role-based access controls, tenant-level access controls, audit logging, security headers, CSRF protections, rate limiting, backup/restore procedures and incident-response processes. No online service can guarantee absolute security. We review and improve our controls as the service and risks evolve.

Personal Data Breaches

Where RegNexus acts as a processor for Customer Data, we notify the affected customer-controller without undue delay after becoming aware of a Personal Data Breach and provide the assistance and information required by our DPA. Where RegNexus acts as controller, we assess the breach under UK data-protection law and notify the Information Commissioner's Office without undue delay and, where the statutory threshold is met, no later than 72 hours after becoming aware. Where the law requires notification to affected individuals, we will also make that notification without undue delay.

Your rights

Depending on the processing and lawful basis, UK data-protection law may give you rights to:

• obtain information about and access your personal data;
• correct inaccurate personal data;
• request erasure;
• restrict processing;
• object to processing, including an absolute right to object to direct marketing;
• receive certain personal data in a portable format;
• withdraw consent at any time where processing is based on consent;
• obtain safeguards in relation to qualifying automated decision-making.

These rights are not absolute and exemptions may apply. If RegNexus is controller, contact hello@reg-nexus.com and put “Privacy” in the subject line. We will verify the request as appropriate and respond within the applicable legal period. If RegNexus holds the information only as a processor for one of our customers, we will normally refer the request to that customer and assist it as required.

Automated decision-making

RegNexus does not currently use the controller-data described in this notice to make a solely automated decision about an individual that has legal or similarly significant effects without the safeguards required by UK law. RegNexus Books may provide automated calculations, classifications, forecasts or assistance to business customers. The customer remains responsible for any decision it makes about its employees, customers, suppliers or other individuals using those outputs, unless a particular feature expressly states otherwise. If our use of significant automated decision-making changes, we will update our transparency information and provide the safeguards required by law.

Cookies and similar technologies

We use cookies and similar technologies needed to authenticate users, protect sessions and operate the service. We may also use optional analytics or functionality technologies where permitted by UK privacy/electronic-communications law. Where consent is legally required, the relevant technology will not be used until consent has been obtained. See our Cookie Notice and preference controls for details.

Data-protection complaints

If you are unhappy with how RegNexus uses your personal data as controller, you can make a dataprotection complaint by emailing hello@reg-nexus.com with “Data Protection Complaint” in the subject line, or by writing to our registered office. We will:

• provide an accessible way to raise the complaint;
• acknowledge receipt within 30 days;
• take appropriate steps to investigate it;
• keep you appropriately informed; and
• respond without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO). You do not have to contact us first, although we would welcome the opportunity to resolve the concern.

Children

RegNexus Books is a business accounting service and is not directed to children. Customer Data may include information relating to younger workers or other individuals where a customer lawfully needs to process it. In those circumstances, the customer is responsible for the purpose and lawful basis and RegNexus acts on the customer's instructions.

Changes to this notice

We may update this notice to reflect legal, technical or service changes. We will show the effective date and, where a change is material, use an appropriate method to bring it to the attention of affected users or customers. Changes to Customer Data sub-processors are handled under the DPA and the separate Subprocessor List.

Contact

RegNexus Limited

19 Lewis Crescent Wellington Telford England TF1 2FQ Privacy: hello@reg-nexus.com (subject: “Privacy”)