Privacy Policy

1. Overview

LedgerPro™ is a cloud-based legal accounts software platform. This policy explains how we collect, process, and protect personal data in connection with the operation of our service.

2. Roles Under Data Protection Law

Party	Role	Responsibility
Law Firms (Customers)	Data Controller	Determine the purposes and means of processing
LedgerPro™	Data Processor	Process data on the Customer's instructions

3. Data We Process

• Account data — names, email addresses, professional roles, login credentials (stored as hashed values)
• Financial records — ledger transactions, client account data, bank statements, invoices
• User credentials — MFA settings, session tokens
• Audit logs — timestamped records of all system activity
• Technical data — IP addresses, browser information, system logs

4. Legal Basis for Processing

Purpose	Legal Basis
Providing the LedgerPro™ service	Contractual necessity
SRA Accounts Rules compliance	Legal obligation
Security monitoring and fraud prevention	Legitimate interests
Service communications	Contractual necessity

5. Subprocessors

We use the following subprocessors, all of whom operate under appropriate data protection safeguards:

Subprocessor	Purpose	Location
Stripe	Payment processing	EU
DigitalOcean	Cloud infrastructure and managed database	UK/EU
Cloudinary	Media and document storage	EU
Resend	Transactional email delivery	EU

6. International Transfers

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place including:

• Standard Contractual Clauses (SCCs) approved by the ICO
• Adequacy decisions where applicable
• Transfer Impact Assessments where required

7. Security Measures

We implement the following technical and organisational measures:

• AES-256 encryption at rest and TLS 1.3 in transit
• Role-based access controls and least-privilege enforcement
• Immutable audit logging of all data access and changes
• Multi-factor authentication for all administrative access
• Regular independent security scanning (OWASP ZAP)
• Daily encrypted backups

8. Data Retention

Data Type	Retention Period
Financial records and ledger data	During subscription and up to 7 years where required by SRA Accounts Rules
Audit logs	7 years
User account data	Duration of subscription + 30 days post-termination
Security and system logs	12 months

9. Data Subject Rights

Individuals have the following rights under UK GDPR:

• Right of access to personal data held
• Right to rectification of inaccurate data
• Right to erasure (where applicable and subject to legal retention obligations)
• Right to data portability
• Right to object to processing

As LedgerPro™ acts as a data processor, requests from individuals should in the first instance be directed to the Customer (the data controller — your law firm). LedgerPro™ will assist Customers in responding to such requests as required under our DPA.

10. Contact

For data protection enquiries: support@lawledgerpro.com

You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.