This policy explains how Munshian Ltd ("Munshian", "we", "us") collects and uses personal data when you visit munshian.com or use Munshian Ledger, our online accounting software at ledger.munshian.com. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
Munshian Ltd is the data controller for the personal data described in this policy. We are a company registered in England and Wales, company number 11786884, with our registered office at 167-169 Great Portland Street, 5th Floor, London, W1W 5PF. You can contact us about privacy at hello@munshian.com.
What we collect
When you visit our website
- Contact form: your name, email address, the topic you choose and your message.
- Technical data: our hosting provider keeps standard server logs, such as IP address, browser type and pages requested, to keep the site secure and working.
Our website doesn't use advertising or analytics cookies. See our cookie policy.
When you use Munshian Ledger
- Account details: your name, email address, password (stored securely as a hash, never in plain text) and two-step sign-in settings.
- Business details: the businesses you add, such as names, addresses, VAT and company numbers, directors and shareholders.
- Accounting records: invoices, bills, bank transactions, contacts, attachments and other records you enter or import.
- Usage and security data: sign-in times, an audit trail of changes, and device and connection details.
- HMRC connection data: when you connect to HMRC, we hold the access token HMRC gives us. We never see your HMRC password.
How we use it and why we're allowed to
| What we do | Lawful basis |
|---|---|
| Provide Munshian Ledger and your account | Contract |
| Send your VAT returns to HMRC when you ask us to, including the fraud prevention data HMRC requires | Contract and legal obligation |
| Reply to messages from our contact form | Legitimate interests |
| Keep our website and service secure, and prevent fraud | Legitimate interests |
| Send important service messages, such as security alerts or changes to these terms | Contract and legitimate interests |
| Keep records we must keep by law | Legal obligation |
We don't sell your personal data, and we don't use your accounting records for advertising.
HMRC fraud prevention data
HMRC requires software that files VAT returns to send "fraud prevention headers" with each submission. These include details such as your IP address, device identifier, browser, screen size, time zone and how you signed in. We only send them to HMRC when you connect to or file with HMRC.
Your customers' and suppliers' data
Your records in Munshian Ledger may include personal data about your own customers, suppliers or staff. For that data, you are the controller and we process it on your behalf, only to provide the service to you.
Who we share data with
- Hosting: Hostinger, which hosts our website, app and database, and sends our emails.
- HMRC: only when you connect your account or submit a return.
- People you invite: such as your accountant or staff, with the access you give them.
- Authorities: where the law requires us to.
If any of your data is processed outside the UK, we make sure appropriate safeguards are in place, as UK data protection law requires.
How long we keep it
- Contact form messages: up to 2 years after our last reply, unless they become part of an ongoing account relationship.
- Munshian Ledger data: for as long as your account is open. When you close your account we delete your data within 90 days, unless we have to keep some of it by law. Please export your records first, as you may need to keep business records for at least 6 years for HMRC.
Your rights
You have the right to:
- ask for a copy of your personal data
- ask us to correct data that's wrong
- ask us to delete your data
- object to, or ask us to limit, how we use it
- ask for your data in a portable format
To use any of these rights, email hello@munshian.com. We'll reply within one month.
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk. We'd appreciate the chance to put things right first.
Security
We use encrypted connections (HTTPS), hashed passwords, optional two-step sign-in, role-based access and audit trails to protect your data.
Changes to this policy
We may update this policy from time to time. We'll post the new version here with a new date, and tell Munshian Ledger users about any important changes.