The Grafene Accounting Connector reads and writes accounting records in QuickBooks Online for clients who have asked us to do their bookkeeping. Those records contain some personal data, mostly names and contact details of people at supplier and customer businesses. We use it only to do the accounting work we have been engaged to do. We do not sell it, we do not use it for advertising, and we do not share it with anyone beyond the service providers listed below.
1.Who we are
Grafene Accounting Limited is a firm of accountants registered in England and Wales under company number 15091798, with its registered office at 8 Water Street, Liverpool, England, L2 8TD.
This policy covers the Grafene Accounting Connector (the “Connector”), a private integration we use to work with client accounting records held in Intuit QuickBooks Online. It sits alongside, and does not replace, the engagement letter we hold with each client.
ICO registration number: ZB800411
2.Our role under data protection law
Where the Connector processes personal data contained in a client’s accounting records, the client company is the controller of that data and Grafene acts as a processor on its instructions, under the terms of the engagement we hold with them. Where we process personal data about our own clients and their staff in order to run our firm, we act as a controller.
The Connector is used only for client company files where the client has authorised our access through Intuit’s own authorisation process.
3.What the Connector accesses
The Connector reads from, and where instructed writes to, the accounting records in an authorised QuickBooks Online company file. In practice that means:
- Financial reports: balance sheet, profit and loss, trial balance, general ledger, aged debtors and creditors, transaction lists.
- Transactions: purchase invoices, sales invoices, expenses, payments, credit notes and journal entries, including their line detail, VAT treatment and any Construction Industry Scheme deductions.
- Ledger records: supplier and customer records, the chart of accounts, tax codes and rates, and company settings.
- Attachment metadata: the fact that a document is attached to a transaction, and its name.
Those records may contain personal data, typically the names, business addresses, email addresses and telephone numbers of contacts at supplier and customer businesses, the names of subcontractors and their Construction Industry Scheme details, and bank account details recorded against payment transactions.
The Connector does not access payroll records, and does not request or use the Intuit identity scopes that would give it access to a QuickBooks user’s own name, email address or profile.
4.Why we process it
We process this data solely to deliver the services our client has engaged us for, which may include bookkeeping, VAT return preparation and submission, Construction Industry Scheme compliance, management accounts, and answering questions about the client’s own records.
Where we act as a processor, we act only on the client’s documented instructions. Where we act as a controller, our lawful bases are the performance of our contract with the client, compliance with our legal and regulatory obligations as an accountancy firm, and our legitimate interests in operating and securing the firm.
We do not use client accounting data for marketing, for advertising, for profiling, or to train any general purpose artificial intelligence model. We do not sell it and we do not disclose it to data brokers.
5.Where the data goes
Data retrieved by the Connector passes through the following service providers, each engaged under a written contract that restricts them to processing it on our instructions.
| Provider | What it does | Where it is processed |
|---|---|---|
| Intuit Inc. | Holds the QuickBooks Online company file and provides the API the Connector calls | Per Intuit’s own terms |
| Hostinger International Ltd | Hosts the automation server that executes the Connector’s requests | European Union |
| Supabase Inc. | Hosts the firm’s client records platform, where working notes and document references are stored | United Kingdom (London region) |
Beyond these providers, we disclose data only where we are required to do so by law or regulation, where a client instructs us to, or where it is necessary to establish or defend a legal claim. We may disclose data to HM Revenue and Customs where we are filing on a client’s behalf under their instruction.
6.How long we keep it
Accounting records retrieved through the Connector are retained for as long as we act for the client, and afterwards for the period required by our professional and statutory obligations, ordinarily seven years from the end of the accounting period to which they relate. Working notes and technical logs are kept for no longer than is necessary and are routinely deleted.
Access tokens held by the Connector expire automatically and are deleted when a client withdraws authorisation or when our engagement ends.
7.Security
- Access to the Connector is restricted to named authorised personnel of Grafene and is protected by per-person keys.
- Authorisation credentials for QuickBooks Online are held encrypted by our automation platform and are never written into documents, code or messages.
- All data in transit is encrypted using TLS.
- Every request the Connector makes is logged with the person or process that made it, so activity on a client file can be traced.
- Any operation that would change a client’s ledger requires explicit approval from a director of Grafene before it is carried out.
8.Your rights
If you are an individual whose personal data appears in records we process, you have rights under the UK General Data Protection Regulation, including the right of access, and rights to rectification, erasure, restriction of processing, data portability and objection.
Where we hold your data as a processor on behalf of one of our clients, we will pass your request to that client and act on their instructions. Where we hold it as a controller, we will respond to you directly within one month.
You may contact us at kieran@grafeneaccounting.com. If you are not satisfied with our response, you may complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
9.Withdrawing access
A client can disconnect the Connector at any time from within QuickBooks Online, under Settings, then Apps, without contacting us first. Once disconnected, the Connector can no longer read or write anything in that company file. Records we have already lawfully retained continue to be held under section 6 above.
10.Changes to this policy
We may update this policy. The current version is always published at this address with its version number and date. Where a change materially affects how client data is handled, we will tell affected clients directly.
11.Contact
Grafene Accounting Limited
8 Water Street, Liverpool, England, L2 8TD
Email: kieran@grafeneaccounting.com
This policy covers the Grafene Accounting Connector only. Personal data collected through the grafeneaccounting.com website is covered by our website Privacy Policy. Use of the Connector by Grafene personnel is governed by the End User Licence Agreement.