How we collect, use, and protect your personal data. Written clearly, not in legalese.
Wenzo is a trading name of ONAF Limited, a company registered in England and Wales. We are the data controller for the personal data you provide when using the Wenzo service.
| Detail | Information |
|---|---|
| Data Controller | ONAF Limited |
| Trading As | Wenzo |
| Registered In | England & Wales |
| Privacy Contact | [email protected] |
| ICO Registration | [Registration reference number] |
If you have any questions about this privacy policy or how we handle your data, please contact us at [email protected].
We collect and process the following categories of personal data:
When you create a Wenzo account, we collect your name, email address, and a securely hashed version of your password. We never store your password in plain text.
When you connect your bank account via Open Banking, we receive read-only access to your transaction data. This includes transaction dates, descriptions, amounts, and running balances. We never have access to your bank login credentials.
You may upload invoices, receipts, tax documents, and other financial records to the service. We store these securely and use them only to provide the accounting and bookkeeping service.
We collect information about how you interact with the service, including pages viewed, features used, and actions taken. This helps us improve Wenzo and fix issues.
We collect technical information such as your browser type, operating system, screen resolution, and IP address. This is used for security monitoring and to ensure the service works correctly on your device.
If you contact us by email, through the app, or via our website, we keep a record of that correspondence so we can respond effectively and improve our support.
We use your personal data for the following purposes, each with a specific legal basis under UK GDPR:
| Purpose | Legal Basis |
|---|---|
| Providing the accounting and bookkeeping service, including pulling in bank transactions, categorising them, and generating reports | Performance of contract |
| Automatically categorising your transactions using our rules engine | Performance of contract |
| Sharing your financial data with your authorised accountant, when you grant them access | Your consent |
| Sending you important service updates, security alerts, and changes to our terms | Performance of contract |
| Improving the service through anonymised usage analysis and feature development | Legitimate interest |
| Preventing fraud, detecting security issues, and protecting our users | Legitimate interest |
| Complying with legal obligations, including tax and regulatory requirements | Legal obligation |
We will never use your data for any purpose that is incompatible with those listed above without first obtaining your explicit consent.
We retain your data only for as long as necessary to provide the service and meet our legal obligations:
| Data Type | Retention Period |
|---|---|
| Account data (name, email) | While your account is active, plus 7 years after closure (HMRC requirement for financial records) |
| Bank transaction data | Retained while your bank connection is active. If you disconnect your bank, transaction data is retained for the remainder of the current tax year plus 7 years |
| Uploaded documents | Retained until you delete them, or until account closure (whichever comes first) |
| Usage and analytics data | Anonymised after 24 months |
| Communication records | Retained for 3 years after the last interaction |
When you request deletion of your account, all your personal data will be permanently and irreversibly deleted within 30 days. This includes your account details, transaction data, uploaded documents, and all associated records. Anonymised, aggregated data that cannot identify you may be retained for service improvement purposes.
Under the UK General Data Protection Regulation (UK GDPR), you have the following rights regarding your personal data:
To exercise any of these rights, please email [email protected]. We will respond to your request within 30 days. There is no fee for exercising your rights in most circumstances.
We use a minimal number of cookies to make Wenzo work properly:
These cookies are necessary for the service to function. They handle your login session, remember your authentication state, and protect against cross-site request forgery (CSRF) attacks. You cannot opt out of essential cookies as the service would not work without them.
With your consent, we use analytics cookies to understand how people use Wenzo so we can improve it. These cookies are only set after you have given explicit consent. You can change your preference at any time through your account settings.
We do not use advertising cookies, tracking pixels, or any third-party cookies that follow you across other websites. We do not participate in any advertising networks or data exchanges.
We take the security of your data seriously and have implemented the following measures:
If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the Information Commissioner's Office (ICO) within 72 hours, as required by UK GDPR.
Wenzo is a business accounting and bookkeeping service. It is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children.
If we become aware that we have collected personal data from a person under 18, we will take steps to delete that data as soon as reasonably possible. If you believe a child has provided us with personal data, please contact us at [email protected].
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons.
When we make changes:
We encourage you to review this policy periodically to stay informed about how we protect your data.
If you are unhappy with how we have handled your personal data, we would like the opportunity to put things right. Please contact us first:
Email: [email protected]
We will investigate your complaint and respond within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection: