Aconta Online Privacy Notice

Key points

• We are the controller of the data of the people who use an account and of the visitors to this website. For the personal data contained in the books, the Customer is the controller and we process them on its behalf.
• We process only the data the Service needs. We do not sell personal data and do not use them for advertising or profiling; the website carries no advertising.
• This website uses only strictly necessary cookies.
• You may access, rectify and erase your data, among other rights, as explained in section 9.

This summary is provided for convenience only. The full text below is what governs.

1. Controller

Capitalised terms have the meaning given to them in the Terms of Service.

We are the controller of the personal data of the Customers and Authorised Users who use an account in the Service and of the visitors to this website.

The Customer is the controller of the personal data contained in the Customer Data, such as the names of customers, suppliers or employees written in an entry; we process those data as processor, on the Customer’s behalf and in accordance with section 14 of the Terms of Service. Requests about those data should be addressed to the Customer; we may forward to it any such request we receive.

2. Data we process

Account data: the e-mail address, name and password of each person who uses an account, the password being stored only in hashed form; the second-factor enrolment and the recovery codes, if two-step verification is enabled, the recovery codes being kept only in hashed form; the details of the account and, for a business, of the organisation (name, legal name, tax identification number, country, fiscal address and billing e-mail address); and, if provided at sign-up, a telephone number, a website and notes.

Customer Data: the companies, charts of accounts, entries, periods and other records that the Customer enters, with the personal data they may contain, and the record of who posted each entry and when.

Billing data: the plan, the orders, the amounts and the identifiers that PayPal returns for each payment or subscription; for payments in Monero, the address generated for the order, the amounts and the identifiers of the transactions received. Card and bank details are entered with PayPal, not with us.

Technical data: the information that every browser sends with each request, such as the IP address, the type of browser and the address requested. The Service uses it to deliver pages, to limit the rate of requests and to protect itself against abuse.

3. Purposes and legal bases

(a) To provide the Service, that is, to create and manage accounts and Offices, to record the Customer Data, to calculate the Reports and to send the notices the Service generates, on the basis of the performance of the contract with the Customer and, for the Customer Data, of the Customer’s instructions.

(b) To invoice and collect fees and to keep accounting and tax records, on the basis of the contract and of our legal obligations.

(c) To keep the Service secure and to prevent fraud and misuse, on the basis of our legitimate interest and that of our Customers.

(d) To comply with legal obligations and with requests from competent authorities.

We do not sell personal data, do not use them for advertising and do not take decisions based solely on automated processing that produce legal effects concerning you.

4. Cookies

This website uses only cookies that are strictly necessary for it to work: to keep a session signed in, to protect forms against cross-site request forgery, to remember the language and appearance chosen and to remember the choice made about cookies.

5. Who receives the data

The Authorised Users of each Office access its data according to their role; each Office’s data are logically separated from those of other Offices.

Service providers that act on our behalf, such as hosting, e-mail delivery and payment (PayPal) providers, only to the extent necessary for the service they provide. Payments in Monero are made over the Monero network, which we do not operate.

Competent authorities, where the law so requires.

6. International transfers

Our providers may process data in countries other than the one where you live, which may not offer the same level of protection. Where the applicable law so requires, we apply the safeguards it provides for.

7. Retention periods

Account data and Customer Data are kept while the account remains active. To preserve the integrity of the books, posted entries are not deleted while the Office exists. Once the account is closed, we delete or anonymise the data, except for the data we must keep to meet legal, accounting or tax obligations or to establish, exercise or defend claims, for the periods those purposes require. Deleted data may remain in backup copies, kept for security purposes, until those copies are deleted in their ordinary rotation.

One-time links, such as those used for invitations or password resets, expire and are purged automatically. Technical data are kept only for as long as the purposes described in section 3 require.

8. Security

We apply technical and organisational measures appropriate to the risk, such as encrypted connections, hashed passwords, optional two-step verification and the logical separation of each Office’s data. No system is completely secure; if a breach affecting your data occurs, we will notify it as the law requires.

9. Your rights

Depending on the law that applies to you, you may request access to your personal data, their rectification or erasure, the restriction of their processing or their portability, and you may object to their processing. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of the processing carried out before.

To exercise these rights, write to security@aconta.online. We will reply within the period set by the applicable law and may ask you to prove your identity. If your request concerns data controlled by a Customer, we may forward it to that Customer. You may also lodge a complaint with the data protection authority of your country.

10. Minors

The Service is intended for people of legal age and for organisations. We do not knowingly collect data from minors through accounts.

11. Changes to this Notice

We may update this Notice to reflect changes in the Service or in the law. The version in force is always the one published on this page, with its effective date; we will notify Customers of material changes by e-mail or through the Service.

12. Contact

For any question about this Notice or about the processing of your data, write to security@aconta.online.