Software Privacy Policy

Last updated: 2 October 2026.

JPW Accountancy & Advisory Ltd operates Management Reports and the JPW Practice Assistant for internal use in providing accounting, tax and practice-management services. They are not sold or licensed to clients. With appropriate authority, accounting connections use QuickBooks Online, Xero or FreeAgent. The HMRC integration is limited to read-only VAT obligations and requires the relevant HMRC access and client authority before use.

This software notice supplements our Practice Privacy Policy. That notice explains our wider professional-services processing, client-record retention and data-protection rights.

Who is responsible

JPW Accountancy & Advisory Ltd, company number 16998757, Collingwood Buildings, 38 Collingwood Street, Newcastle upon Tyne NE1 1JF, is the controller where it determines the purposes and means of processing. Our Data Protection Officer is Jonathan Williamson, jonathan@jpwaccountancy.co.uk, telephone 0191 213 5540. Our ICO registration number is ZC113878. Where we act as a processor for a client, the relevant engagement and data-processing agreement also apply.

Information we use

Accounting connections retain the provider, company or organisation identifier, company name, internal client reference and OAuth tokens needed to maintain the connection. The reporting tool processes accounting records, transactions, balances and reports, which may include personal information about business contacts. Financial report responses are not permanently stored by this public connection service; generated reports and supporting records may be retained in our private client records.

The HMRC integration may process a VAT registration number, internal client reference, OAuth tokens, authority and audit records, and a read-only snapshot of VAT obligations, including period identifiers, dates, due dates, filing status and HMRC's received date. It does not collect or store HMRC sign-in credentials, submit VAT returns or change HMRC tax records.

The wider Practice Assistant also processes authorised client correspondence, attachments, documents and practice-management information for analysis, retrieval and drafting. These records may contain personal information, including sensitive information where relevant to the engagement. The purposes, lawful bases and any additional conditions for special-category or criminal-offence information are explained in our main practice notice.

Information comes from clients and authorised users, connected accounting providers, HMRC and the correspondence and practice systems we are authorised to use. Connection and security information is collected from the software and the device used to access it. If information needed for an authorised connection is not provided, we may be unable to operate that connection or provide the related service.

Fraud-prevention information

Where required for HMRC APIs, the software sends the fraud-prevention information specified by HMRC for the actual connection method. This may include a persistent device identifier, IP addresses and collection timestamps, network-device identifiers, browser or operating-system details, screen and window dimensions, timezone, application user identifiers, product/version information and hashed installation licence identifiers. Applicable authentication and intermediary-server information depends on the connection method. This information is sent to HMRC for security and fraud prevention.

The information collected depends on whether the software is used through the private browser application or the installed macOS application. Fields that cannot be collected for a particular connection are handled under HMRC's missing-data procedure.

Why we process this information

We rely on performance of a contract where processing is necessary to provide agreed services to an individual client. Where we process information about people connected with a business client, we may rely on our legitimate interests in providing those services, subject to their rights. We rely on legal obligation for processing required by tax, anti-money-laundering and applicable fraud-prevention law. We rely on legitimate interests for proportionate connection security, audit, system maintenance and professional accountability. Consent is used only where appropriate, such as optional marketing, rather than as the default basis for core tax services. Authorising a connection is permission to access that service and does not itself determine our UK GDPR lawful basis.

AI assistance

In our documented private installation, AI analysis, search and drafting use Ollama models running on our own device or authorised private network. Relevant correspondence, document extracts and bounded client context may be processed to prepare provisional outputs for accountant review. Accounting-report commentary uses selected evidence. Integration OAuth tokens and fraud-prevention headers are not supplied to language models. The configured AI service is separate from public cloud AI services. AI outputs do not make final decisions about clients or submit tax returns.

Recipients and processing locations

Information is exchanged with the relevant accounting provider or HMRC to operate the authorised connection. Our hosting, software, infrastructure and security providers may process information on our behalf. The public accounting connection service is hosted separately from our private Practice Assistant and reporting installation; it does not hold HMRC tokens, VAT identifiers or obligation snapshots.

Some technology or support providers may store or access information outside the UK. Before making a restricted transfer, we use a lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another permitted safeguard. We also consider appropriate supplementary technical and organisational measures. Contact us for information about the relevant safeguard for a particular transfer.

Storage and security

Accounting-provider tokens are encrypted in the hosted connection service. In the Synology installation, HMRC tokens, VAT registration numbers and obligation snapshots use an encrypted secret vault with a separately mounted master key. The macOS recovery installation uses macOS Keychain for these records. Internal references, authority status and audit metadata are stored separately from the secret values. Provider and HMRC API connections use HTTPS; access to the private application is restricted to authorised users.

Cookies and device storage

The public connection service uses a secure session cookie to complete and protect accounting authorisation. The private application stores a persistent browser device identifier for HMRC fraud prevention. This application code does not include advertising cookies or visitor analytics. The main practice website has its own cookie information.

Retention and disconnection

Accounting connection tokens are held while the connection is needed and removed from the active connection store when it is disconnected. Disconnecting HMRC locally removes the stored access and refresh tokens and stops this application's use of that grant; HMRC permissions can also be withdrawn through HMRC's own authorisation arrangements. Local disconnection does not automatically withdraw permissions held at HMRC.

A new successful VAT retrieval replaces the previous current snapshot in the active secret store. Disconnection does not automatically delete retained VAT identifiers, snapshots, client mappings or audit records. We review those records for continued need and retain necessary professional records under the periods and criteria in our Practice Privacy Policy. Client engagement files, working papers and correspondence are normally retained for seven years after the relevant engagement or client relationship ends; accounting and tax records are normally retained for seven years after the relevant accounting period or tax year. Longer retention may apply for legal, regulatory, professional, insurance or dispute requirements. Other records follow the applicable periods and criteria in our practice notice. Secure backups may retain residual copies for a limited period after deletion from live systems; they remain protected and are not routinely accessed. Data requests are handled against the records and backups concerned, subject to legal retention requirements. We do not sell connection or client data.

Your choices and contact

You may ask us to disconnect a connection and exercise your applicable rights of access, correction, erasure, restriction, objection and portability. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Rights apply subject to the relevant legal conditions, including any requirement to retain professional records. You may make a request verbally or in writing; we may ask for proportionate information to verify identity where needed. Contact jonathan@jpwaccountancy.co.uk with privacy questions, data requests or security concerns.

You may complain to us or to the Information Commissioner's Office.