Who we are
Yeardesk is run by [Operator’s legal name], [sole trader, or company registered in England and Wales with its number], of [Postal address] (“we”, “us”). We’re registered with the Information Commissioner’s Office (ICO) under number [ICO registration number].
For questions about this notice or your data, email [privacy contact email] or write to us at the address above.
Two kinds of data, two roles
Yeardesk helps accountancy practices keep track of their clients’ tax returns and deadlines. That means it holds two kinds of personal data:
- Your account, and how you use Yeardesk. We decide how this is used, so we’re its controller. This notice is about that data.
- What a practice puts into its workspace: its clients’ names, contact details, notes and deadlines, and its team’s roles, job titles and working hours. The practice decides what goes in and why, so the practice is the controller and we’re its processor. We only use that data to run Yeardesk for the practice, under our data processing addendum. If you’re one of a practice’s clients, the practice’s own privacy notice explains how it uses your information, and the practice is who to ask about it.
What we collect, and why
Your account
Your name and email address, a scrambled (hashed) version of your password, your two-factor settings and backup codes (encrypted), the workspaces you belong to and your role in each. If you sign in with Microsoft, we also get your name, email address and a Microsoft account identifier from Microsoft. We use these to create your account, sign you in and give you the right access.
Lawful basis: if you signed up yourself, this is necessary for our contract with you. If a practice invited you, it’s in our legitimate interests (and the practice’s) to give you the access the practice asked for.
Keeping accounts secure
The IP address and browser of each signed-in session, sign-in attempts, two-factor and password changes, and changes to roles. We use these to keep accounts safe, spot and stop misuse, limit repeated attempts and show owners their workspace’s security activity. When you sign up or sign in, Cloudflare checks that your browser isn’t a bot. When you choose a password, we check it against lists of passwords exposed in other breaches, in a way that never sends your password, or anything that could reveal it, outside Yeardesk.
Lawful basis: our legitimate interest in keeping Yeardesk and the data in it secure.
Emails we send you
Messages you need in order to use Yeardesk: confirming your email address, resetting your password, sign-in codes, invitations, security alerts, and notices about the service, such as changes to these documents or to our sub-processors. We keep a record of each one (who it went to, the subject, its type and whether it was delivered), but not the links inside, because those let people sign in. We don’t send marketing emails.
Lawful basis: our contract with you, or our legitimate interest in running the service you or your practice signed up for.
Visiting the website
Like any website, ours receives your IP address and basic details of your browser with every request. Cloudflare uses them to deliver pages and block attacks, and our servers log them briefly so we can find faults. We don’t use analytics, advertising or tracking tools.
Lawful basis: our legitimate interest in running a website that works and is safe.
When you contact us
Whatever you put in your email, so we can answer it. Lawful basis: our legitimate interest in helping you.
When the law requires it
We may keep or share information where the law requires us to, for example to respond to a valid request from a court or regulator. Lawful basis: legal obligation.
Yeardesk doesn’t make decisions about people by automated means that have legal or similarly significant effects. Its suggested order of work is a planning aid for the practice.
Where your data is
The database is in London. Yeardesk runs on Cloudflare’s worldwide network, so each request is handled at the Cloudflare data centre nearest to you, which may be outside the UK. Some of the services we use are run by companies based in the United States, and emails are sent from Ireland and error reports stored in Germany. The sub-processors page lists each one and where it works.
When personal data leaves the UK, we make sure it’s protected as the law requires: by sending it only to countries the UK recognises as adequate (including the EU), to US companies certified under the UK extension to the EU–US Data Privacy Framework, or under the ICO’s international data transfer agreement or addendum.
How long we keep it
| Data | Kept for |
|---|---|
| Your account (name, email address, sign-in and two-factor settings) | Until you delete your account. |
| Signed-in sessions, with the IP address and browser they came from | Until they expire: 7 days after you were last active. Expired sessions are removed daily. |
| Email confirmation and password reset links, and emailed sign-in codes | Until they expire (5 minutes to 24 hours). Removed daily after that. |
| Records of the emails we send (recipient, subject, type and whether it was delivered — never the links inside) | 90 days. |
| Security activity (sign-ins, two-factor and role changes) | 90 days. |
| Error reports | Up to 90 days. |
| Server logs | Up to 7 days. |
| Backups of the database | Point-in-time history for 7 days, and encrypted nightly copies for 30 days. |
| A practice’s workspace: clients, returns, tickets, comments, checklists and activity | Until the practice deletes them. A deleted workspace can be restored for 30 days, then it is permanently deleted, and it ages out of backups within a further 30 days. |
| Emails you send us | As long as we need to answer them, and no more than two years. |
You can delete your account at any time from Settings → Your account, unless you’re the last owner of a workspace: appoint another owner or delete the workspace first. Comments you wrote and changes you made in a workspace stay part of the practice’s records, shown as “Former member”.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal data;
- correct it if it’s wrong (you can change your name in Settings at any time);
- delete it;
- limit how we use it, or object to us using it where we rely on legitimate interests;
- give you the data you provided in a format you can take elsewhere.
Email [privacy contact email]. We’ll reply within one month, and won’t charge you. We may need to check it’s really you first.
If your request is about information a practice holds about you, such as a client record, we’ll pass it to that practice, which decides, and help it to respond.
Complaints
If you’re unhappy with how we’ve handled your data, please tell us first at [privacy contact email]. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.
Children
Yeardesk is a tool for businesses and isn’t meant for anyone under 18.
Changes to this notice
When we change this notice, we’ll update the date at the top. If the change matters, such as a new kind of data or a new use for it, we’ll email account holders before it takes effect.