Privacy policy

This policy explains how KLARVEX PARTNERS LIMITED ("Klarvex", "we", "us") handles personal data. We are a company registered in England and Wales with company number 16570332. Our registered office is 14 Fogarty Park Road, Kingswood, Bristol, England, BS15 8FR.

We are registered with the Information Commissioner's Office (ICO). Registration number: ZC255035.

Questions about this policy or your data: email alex@klarvex.com or call +44 7312 273285.

We handle personal data in two different capacities:

• As a controller for data about people who visit this website or contact us about our services. We decide how that data is used.
• As a processor for accountancy practices that use our WhatsApp messaging service. The practice is the controller of its clients' data. We only use that data on the practice's documented instructions and under a written data processing agreement, as required by Article 28 of the UK GDPR.

What we collect. If you email or phone us, we keep your name, contact details, the name of your practice and what you tell us. When you visit the site, our hosting provider automatically records basic technical data such as your IP address, browser type and the pages requested, for security and to keep the site running.

Cookies. This website does not use analytics, advertising or tracking cookies.

Why and on what basis. We use enquiry data to reply to you and, if you become a client, to provide our services. Our lawful basis is legitimate interests (responding to people who contact us) or, where we agree to work together, taking steps to enter into and perform a contract.

We do not sell your data and we do not use it for marketing unless you have asked us to.

Our service lets an accountancy practice manage conversations with its own clients on WhatsApp. When a practice uses it, we process the following on the practice's behalf:

• WhatsApp phone numbers and profile names of the practice's clients
• The content of messages, including text, documents, images and voice notes sent to or by the practice
• Message details such as time sent, delivery and read status
• Client and job details from the practice's practice-management system, such as client names, contact details and the status of work
• Names and log-in details of practice staff who use the service

WhatsApp Business Platform. Messages are sent and received through Meta's WhatsApp Business Platform (Cloud API). Meta processes this data as described in its own terms and the WhatsApp Business Data Processing Terms.

AI-assisted draft replies. We send the relevant message content and context to Anthropic's API so that its AI models can prepare a suggested reply or summary. These are drafts for the practice's staff to review, edit and approve. Anthropic's commercial terms state that it does not train its models on data sent through its API. No decisions with legal or similarly significant effects are made about anyone by automated means alone.

Practice-management integration. With the practice's permission, we connect to its practice-management system so that messages can be matched to the right client and relevant job details can be shown to staff. We only access the data needed for this.

If you are a client of an accountancy practice and have questions about your messages, please contact your accountant first, as they control your data. If you contact us, we will pass your request to them promptly.

We use these providers to run our website and services:

We tell the practices we work for before adding or replacing a sub-processor, so they can object.

Some of these providers process data outside the UK, including in the USA. Where they do, we rely on the safeguards allowed under UK law, such as the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") where the provider is certified, or the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

• Enquiries that do not lead to work: up to 2 years from our last contact.
• Client business records: 6 years after the end of the financial year they relate to, to meet UK tax and company law.
• Data we process for practices: for as long as the practice uses our service, or shorter if the practice tells us to. When the contract ends we delete it, or return it if the practice asks, within 30 days, unless the law requires us to keep it.
• Hosting logs: kept by our hosting provider for a short period in line with its own retention settings.

We use encryption in transit, access controls limited to people who need them, and reputable providers with strong security records. Our staff are bound by confidentiality. If a personal data breach affects data we process for a practice, we will tell that practice without undue delay.

Under UK data protection law you have the right to:

• ask for a copy of your personal data
• ask us to correct data that is wrong or incomplete
• ask us to delete your data
• ask us to restrict or stop using your data, or object to how we use it
• ask for your data in a portable format
• withdraw consent at any time, where we rely on consent

To use any of these rights, including to request deletion of your data, email alex@klarvex.com. We will reply within one month. We will not charge a fee in most cases. For data we process on behalf of an accountancy practice, we will work with that practice to respond.

Please tell us first if you are unhappy, so we can try to put things right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

We may update this policy from time to time. The date at the top shows when it last changed.