AccountingWorx privacy policy

1. About this policy

This policy explains how AccountingWorx collects, uses, stores and shares personal information, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It covers the AccountingWorx website and app during the pilot.

AccountingWorx is provided to businesses. When you put information about your customers, suppliers or employees into AccountingWorx, you are responsible for having the right to do so. We handle that information for you, to provide the service.

2. What we collect

Your account: your name, email address, a password (stored only as a one-way hash), and your two-step sign-in details.

Your business: its name, ABN, address, tax settings, and the people you invite and their roles.

Financial records you enter, import or connect: invoices, bills, bank statement lines, journals, contacts, products, payroll, and the attachments you upload.

Employee information if you use payroll: names, addresses, dates of birth, tax file numbers (TFNs), bank account details, super fund details, pay and leave records.

Technical and security information: your IP address, browser type, sign-in and activity history, which we keep in an audit log to protect your account.

Emails we send and whether they were delivered, so invitations, receipts and password resets reach you.

3. Tax file numbers

We collect TFNs only where you enter them for payroll or tax purposes. TFNs are stored encrypted, only the last three digits are ever shown, and they are not used to identify anyone for any other purpose. We handle them under the Privacy (Tax File Number) Rule 2015.

4. Why we use it

To provide AccountingWorx: keep your books, work out tax and payroll, send the documents you ask us to send, and show you reports.

To keep it secure and working: sign-in checks, fraud and abuse prevention, backups, fixing faults, and improving the product.

To contact you about your account, the pilot and important changes. We do not sell personal information and we do not use your financial records for advertising.

5. Where it is held, and who else handles it

Your data is hosted with Amazon Web Services in Sydney, Australia, and backed up there. It is encrypted in transit and at rest, and the most sensitive fields (such as TFNs and bank details) are encrypted again at the field level.

We use service providers to run the service: cloud hosting and storage (Amazon Web Services), email delivery, and, when you use them, payment processing (Stripe), artificial intelligence features such as reading bills and answering questions about your books, and bank data or lodgement providers. They may only use information to provide their service to us. Some of them may handle information outside Australia; we choose providers with appropriate safeguards and will list them here as they are added.

We disclose information to the Australian Taxation Office, a bank, a super fund or a clearing house only when you ask us to lodge or send something to them. We may also disclose information where the law requires it.

The people you invite to your organisation (for example your accountant) can see what their role allows. You control who has access.

6. Keeping it safe

Sign-in uses two-step verification. Every organisation's data is separated from every other's in the database. Uploaded files are scanned for viruses. Changes to your records are kept in an audit log that cannot be edited. We back up nightly.

No system is perfectly secure. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner (OAIC), as the law requires.

7. How long we keep it

We keep your records while your account is open. Tax and accounting records generally need to be kept for at least five years, so closing an organisation keeps its records for the period shown at closing, and you can export your data before then. After that period they are permanently deleted, except where the law requires us to keep them longer.

8. Your rights

You can ask to see the personal information we hold about you, and to correct it if it is wrong. You can export your organisation's data from the app. Ask us using the contact details below, and we will reply within a reasonable time (usually 30 days).

If you think we have mishandled personal information, contact us first and we will investigate and reply. If you are not satisfied, you can complain to the OAIC (oaic.gov.au).

9. Contact

Questions, access requests and complaints about privacy: use the support contact on this site or in the app, and say it is a privacy matter.

10. Changes

We will update this policy when the way we handle information changes, and show the date it was last updated at the top. This is a pilot version of the policy.