Privacy Policy

FirmPulse is a practice management platform for UK accountancy firms. A Firm uses it to manage its clients, from quotes and proposals through client take-on, identity and anti-money-laundering checks, engagement letters and electronic signatures, to a client portal, invoices, payments and deadlines. We also provide the Verify module, which supports Companies House identity verification.

If you have any questions about this Privacy Policy, please contact us at hello@firmpulse.co.uk.

1. Who we are

FirmPulse Ltd is a company registered in England and Wales (Company No. 17206272).

We are registered with the Information Commissioner's Office (ICO registration: ZC184115).

Our VAT registration number is GB 520 3362 36.

Our registered office is:

C/O 3DOM.UK Accountants Ltd
Second Floor
61 Hamilton Square
Birkenhead
Merseyside
CH41 5AT

Websites: https://firmpulse.co.uk and https://firpul.com

Email: hello@firmpulse.co.uk

2. Our role

FirmPulse acts in different roles depending on the information being processed.

Where FirmPulse is the data processor

When an accountancy firm uses FirmPulse to manage its clients, including through the Verify module, the Firm is the data controller and FirmPulse processes personal data on the Firm's behalf. Our Data Processing Agreement at https://firmpulse.co.uk/dpa sets out how we do that.

The Firm is responsible for:

• deciding why and how personal data is processed;
• providing privacy information to its own clients; and
• complying with UK GDPR and the Data Protection Act 2018.

If you are a client of an accountancy firm that uses FirmPulse, or you completed an identity check, signed a document, used a client portal or made a payment to a Firm through FirmPulse, the Firm is responsible for your personal data. You should contact that Firm if you wish to exercise your privacy rights. We will assist the Firm where required.

Where FirmPulse is the data controller

FirmPulse is the data controller for personal data relating to:

• account holders and authorised users;
• enquiries and prospective customers, including people who register interest on our website;
• website visitors;
• marketing communications;
• billing the Firms that use FirmPulse; and
• our own business operations.

This Privacy Policy applies to that processing. For transparency, it also describes the personal data we process on behalf of Firms and the providers involved.

3. What personal data we collect

Depending on how you interact with us, we may collect:

Account information

• Name
• Work email address
• Telephone number
• Job title
• Login credentials, stored only in a scrambled (hashed) form
• Two-factor authentication settings
• User activity and audit logs
• The address and name of any Microsoft 365 mailbox a user connects, so that FirmPulse can send email from it. FirmPulse is given permission to send email from that mailbox, not to read it.

Client information processed on behalf of Firms

Where a Firm uses FirmPulse, we may process, on the Firm's instructions:

• Names, email addresses, telephone numbers and home addresses
• Dates of birth and nationality
• Tax and company identifiers, such as National Insurance numbers, Unique Taxpayer References and VAT numbers
• Company, officer and shareholder information, including information from the Companies House register
• Identity documents, proof of address, and a photograph of the person used to match them to their document
• Identity verification results, verification status and verification timestamps
• Anti-money-laundering screening results, including sanctions, politically exposed person and adverse media checks, and the Firm's risk assessment
• Proposals, engagement letters, invoices, and documents and files shared with the Firm, including through the client portal
• Electronic signature records, including when a document was viewed and signed, and the IP address and browser used
• Emails and text messages sent on the Firm's behalf, and whether an email or proposal was opened or a link in an email was clicked
• Payment information, including Direct Debit mandate status and payment status

Some of this information is special category data or relates to criminal offences. The photograph used to match a person to their identity document is biometric data, and screening results can include information about criminal offences. The Firm decides when this information is collected and is responsible for having a lawful basis for it, including any explicit consent the biometric match needs.

Payment information

Card payments are processed by Stripe. This includes card payments a Firm makes to FirmPulse for its subscription or prepaid Pulses, and card payments for identity check fees that a Firm takes on its own Stripe account. Stripe also uses payment information to help prevent fraud. Stripe's privacy policy is at https://stripe.com/gb/privacy

Direct Debit and pay by bank payments that a Firm collects from its own clients are processed by GoCardless, through the Firm's own GoCardless account, which the Firm connects to FirmPulse through FirmPulse's GoCardless integration. Client money never passes through FirmPulse. GoCardless and the Firm each act as a controller of the payer's information. GoCardless's privacy notice for payers is at https://gocardless.com/privacy/payers/

FirmPulse does not store full payment card details or the bank account details of a Firm's clients.

We may retain transaction references, payment amounts, payment dates and payment status.

Advertising and analytics information

Where a Firm connects its Google Ads or Microsoft Advertising account, or adds its own analytics or advertising tags to its Verify pages, we may process on the Firm's behalf:

• Google Click Identifier (gclid)
• wbraid and gbraid identifiers
• Microsoft Click ID (msclkid) and LinkedIn click identifiers
• UTM campaign parameters
• Offline conversion information
• Hashed email addresses, for Google Ads only, where required to improve conversion matching

Website information

When you visit our website or use the Service, our hosting provider records technical information such as your IP address, browser and device information and the pages you request. We use it to deliver the pages and to keep the Service secure.

If you join the waiting list on our website, we collect your firm's name, your name, your phone number and your work email address, and your answers to four questions about your firm: how it is set up, how many staff it has, how many clients it has and the software it uses now. We keep your IP address and browser details with them, to prevent abuse of the form, and the FirmPulse team is told by email when you join. We use your details to contact you about FirmPulse's private beta and its launch, which you asked us to do; keeping the IP address and browser details is in our legitimate interests in preventing abuse. We keep them until twelve months after FirmPulse opens to all firms, or until you ask us to remove them, if that is sooner.

If you ask us on firpul.com to be told when Firpul launches, we collect your email address. We keep your IP address and browser details with it, to prevent abuse of the form, and the FirmPulse team is told by email when you ask. We use your email address only to tell you when Firpul launches, which you asked us to do; keeping the IP address and browser details is in our legitimate interests in preventing abuse. We keep them until twelve months after Firpul launches, or until you ask us to remove them, if that is sooner.

Prospective investors and shareholders

If you are a prospective investor or a shareholder in FirmPulse Ltd, we hold your name and contact details and, where you have signed one, your investor statement: a statement that you are a high net worth or a sophisticated investor, which records your income or your net assets in bands. We keep the statement as evidence that the law's requirements were met before information was shared with you; our basis is our legal obligations and our legitimate interests in showing that we met them. We keep a signed investor statement for six years after our last communication with you or after you stop being a shareholder, whichever is later, and your other details for as long as you are a shareholder and as company law requires.

4. How we use personal data

We use personal data to:

• provide and operate the Service, including the features a Firm chooses to use;
• manage customer accounts;
• process payments and bill the Firms that use FirmPulse;
• send emails and text messages, including on a Firm's behalf;
• provide customer support;
• improve the Service;
• protect against fraud and misuse;
• comply with legal and regulatory obligations;
• measure advertising performance where enabled by our customers; and
• operate our website.

5. Our legal basis

Where FirmPulse acts as a data controller, we rely on one or more of the following legal bases under UK GDPR:

Performance of a contract

To provide the Service, manage accounts and process payments.

Legitimate interests

To improve our platform, maintain security, prevent fraud, analyse usage and measure advertising performance.

Consent

Where required for marketing communications or non-essential cookies.

Legal obligation

Where we are required to retain information or comply with legal or regulatory requirements.

Where FirmPulse acts as a data processor, we process personal data only on the documented instructions of the relevant Firm.

6. Identity verification and anti-money-laundering checks

The Verify module supports Companies House identity verification under the Economic Crime and Corporate Transparency Act 2023. A Firm can also use FirmPulse for the identity checks and screening it carries out under the Money Laundering Regulations 2017 when it takes on a client.

These checks run on the Firm's own account with ComplyCube Ltd, our identity verification provider. A check can include a photograph of an identity document, a selfie compared with that document, a proof of address check, and screening against sanctions, politically exposed person and adverse media lists.

The accountancy Firm remains the data controller. For Companies House identity verification it is also the Authorised Corporate Service Provider (ACSP). The Firm is responsible for telling each person how their data will be used and for obtaining their explicit consent to the biometric comparison.

FirmPulse processes identity verification information solely to provide these checks on behalf of the Firm. Copies of the documents checked and the evidence of each check are kept in secure storage in London.

7. Who we share information with

We only share personal data where necessary to provide the Service or where required by law.

Our service providers

We use these providers to run the Service:

• Vercel, for application and website hosting and content delivery. Our application's servers are in London.
• Neon, for our database, hosted in London.
• Amazon Web Services, for secure document storage, in London.
• Postmark, for sending email, including the emails a Firm sends to its clients through FirmPulse.
• Twilio, for sending the text messages a Firm chooses to send.
• Microsoft 365, for our own business email and productivity services.
• Sentry, for monitoring errors in the Service.
• Cloudflare, for bot protection on our public forms.
• Ideal Postcodes, for the address finder on a Firm's Verify pages. It receives the postcode or partial address a person types into the finder and a reference for the address they choose, never their name. Where that lookup is unavailable, a postcode can go instead to postcodes.io, the free postcode service Ideal Postcodes runs, which receives the postcode alone.
• Stripe, for card payments made to FirmPulse.
• Xero, for FirmPulse's own accounting records of what we invoice to Firms.
• Anthropic, to suggest wording when a Firm's user asks for help with the Firm's own proposal text. Only the Firm's name and its own wording are sent, never client information. Anthropic does not use it to train its models.

Services a Firm connects with its own account

A Firm can connect FirmPulse to accounts it holds with other providers. When it does, we send personal data to that provider on the Firm's instructions, and the Firm's own agreement with that provider applies:

• ComplyCube, for identity checks and anti-money-laundering screening.
• GoCardless, for Direct Debit and pay by bank payments from the Firm's clients.
• Stripe, for card payments for identity check fees, taken on the Firm's own Stripe account.
• Microsoft 365, to send email from the Firm's own mailbox or a user's own mailbox.
• Xero, to record the Firm's invoices in its own accounts.
• Google Ads and Microsoft Advertising, to report which adverts led to a paid identity check.

Public bodies

• Companies House, to read company and officer information from the public register.
• HMRC, where a Firm uses a feature that checks information with HMRC, for example to confirm that a VAT number is registered as part of the Firm's due diligence.

We require our service providers to protect personal data appropriately.

Our public forms are protected against automated abuse by Cloudflare Turnstile. Turnstile checks that a submission comes from a person rather than a bot. It does not use cookies for tracking and does not build a profile of you. Cloudflare's handling of that information is described in its Turnstile Privacy Addendum, available at https://www.cloudflare.com/turnstile-privacy-policy/

We do not sell personal data.

We may disclose information where required by law or where necessary to establish, exercise or defend legal claims.

8. International transfers

Our database, our document storage and our application's servers are in the United Kingdom.

Some of our service providers process personal data outside the United Kingdom. Postmark, Twilio, Stripe, Cloudflare, Anthropic, Xero, Google, Microsoft and Vercel's content delivery network process it mainly in the United States, and Sentry holds error events in the European Union.

Where this happens, we ensure appropriate safeguards are in place in accordance with UK GDPR, such as adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

9. Data retention

We retain personal data only for as long as necessary.

In general:

• account information is retained while your account remains active and for a reasonable period afterwards;
• payment records are retained for as long as required by law;
• copies of the documents checked and the evidence of Companies House identity verification checks are retained for seven years from the check, as the Companies House identity verification standard requires;
• anti-money-laundering customer due diligence records are retained for five years after the Firm's business relationship with its client ends, as the Money Laundering Regulations 2017 require, unless the law requires them to be kept longer;
• waiting list and firpul.com sign-ups are retained until twelve months after the launch they asked about, or until the person asks us to remove them, if that is sooner;
• signed investor statements are retained for six years after our last communication with the person or after they stop being a shareholder, whichever is later; and
• technical information is retained only for as long as necessary for the purposes described in this Privacy Policy.

10. Your rights

Where FirmPulse acts as the data controller, you have rights under UK GDPR, including the right to:

• access your personal data;
• correct inaccurate information;
• request deletion of your personal data;
• restrict processing;
• object to processing;
• request data portability; and
• withdraw consent where processing is based on consent.

To exercise these rights, please contact:

hello@firmpulse.co.uk

If FirmPulse processes your personal data on behalf of an accountancy Firm, you should contact that Firm directly. We will assist them where required.

You also have the right to complain to the Information Commissioner's Office (ICO).

Website: https://ico.org.uk

11. Security

We use appropriate technical and organisational measures to protect personal data.

These include:

• encrypted communications;
• encryption of stored credentials and access tokens;
• access controls based on each user's role;
• two-factor authentication for staff sign-in;
• tenant data separation enforced in the database;
• monitoring and audit logging; and
• the use of reputable third-party service providers.

No system can be completely secure, but we continually work to protect the information entrusted to us.

If you believe you have found a security weakness in FirmPulse, or that personal data has been put at risk, please tell us at security@firmpulse.co.uk.

12. Cookies

Our website does not use analytics or advertising cookies.

We count visits to our website with Vercel Web Analytics. It sets no cookies. It records the page viewed, the site that referred you, your approximate location, and your browser, operating system and device type. Visitors are counted by a code that changes every day, so a visit cannot be followed from one day to the next or to another website, and we cannot identify you from it.

FirmPulse uses cookies that are strictly necessary for the Service to work: to keep you signed in, to let our website recognise that you are already signed in, and to protect the connection while you link another account, such as GoCardless, Xero, HMRC or Microsoft 365. These cookies are not used to track you.

A Firm's Verify pages are provided on the Firm's behalf. They remember the advert or link a visitor arrived from for up to 90 days, and a Firm can add its own analytics and advertising tags, which follow the visitor's choice in the consent banner. The Firm's own privacy notice on those pages explains this.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Where appropriate, we will publish the updated version on our website with a revised "Last updated" date.

14. Contact

FirmPulse Ltd

Email: hello@firmpulse.co.uk

Registered Office:

C/O 3DOM.UK Accountants Ltd
Second Floor
61 Hamilton Square
Birkenhead
Merseyside
CH41 5AT