Privacy Policy

Kontua is an accounting and client relationship platform for small and medium accounting practices. When we say "Kontua", "we", or "us" in this policy, we mean the operator of the kontua.com website and the Kontua application.

For the data your firm uploads about its own clients, your firm is the data controller and Kontua acts as the data processor. For data about you as a Kontua account holder (your name, email, usage), Kontua is the data controller.

Account data: your name, work email, firm name, and password (stored only as a secure hash).

Workspace data: the clients, documents, services, deadlines, and messages your firm adds to Kontua. This belongs to your firm.

Usage data: basic technical logs such as IP address, browser type, and pages visited, used to keep the service secure and reliable.

We do not collect special-category data, and we do not run advertising trackers on the application.

To provide the service: running your workspace, sending invitations and deadline reminders, and processing documents you upload.

To communicate with you: onboarding emails, support replies, and essential service notices. We do not send marketing email without your consent.

To keep the platform secure: audit logs, two-factor authentication, and abuse prevention.

We never sell your data, and we never use your firm’s or your clients’ data to train models for other customers.

Your data is hosted on cloud infrastructure with encryption in transit (TLS) and at rest. Every firm’s data is logically isolated from other firms.

Where a sub-processor processes data outside the UK/EEA, we rely on appropriate safeguards such as standard contractual clauses.

We use a small number of processors to run Kontua: cloud hosting, transactional email (for invitations and reminders), and AI document processing. Each is bound by a data processing agreement and may only handle data on our instructions.

Companies House data is retrieved from the public register and used only to populate and keep your client records current.

Workspace data is kept for as long as your account is active. When you delete a record it is soft-deleted first, then permanently removed after a retention window.

When you close your account, we delete or anonymise your data within 90 days, except where we must keep it for legal or accounting obligations.

Under UK GDPR you have the right to access, correct, export, or erase your personal data, and to object to or restrict processing.

To exercise any of these rights, email support@kontua.com. We respond within 30 days. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Kontua uses only strictly necessary cookies — for sign-in sessions and security. We do not use advertising or cross-site tracking cookies, so no cookie consent banner is required.

If we make material changes to this policy we will notify account holders by email before the change takes effect. The "last updated" date above always shows the current version.

Questions about privacy? Email support@kontua.com and a real person will answer.