Client Data Storage Policy

Last updated: 19 August 2026

At Nefe Ledger, protecting client information is an important part of the way we provide our bookkeeping and finance administration services.

This Client Data & Information Storage Policy explains how we collect, access, use, store, protect and share the business and personal information entrusted to us.

It should be read alongside our Privacy Policy, Terms of Business and any service proposal or engagement confirmation agreed with you.

1. About Nefe Ledger

Nefe Ledger is the trading name of Nefe Oguntoye.

Business address:
5th Floor
167–169 Great Portland Street
London
W1W 5PF
United Kingdom

Email: info@nefeledger.com
Website: nefeledger.com

Nefe Ledger provides online bookkeeping and finance administration services to small businesses, freelancers and other owner-managed businesses across the UK.

If you have a question about how we handle client information, please contact us using the details above.

2. What Information We May Handle

The information we need depends on the bookkeeping or finance administration services you have asked us to provide.

Business and client information

This may include:

your business or trading name;
contact information;
business and registered-office addresses;
company, partnership or sole-trader information;
accounting periods;
bookkeeping preferences;
supplier and customer information;
financial reports and ledgers; and
instructions and communications relating to our work.

Bookkeeping and financial records

We may also handle:

bank statements and transaction records;
sales invoices and credit notes;
purchase invoices;
receipts and expense information;
sales and purchase ledgers;
accounts receivable records;
accounts payable records;
VAT bookkeeping records;
payroll records;
payment information;
trial-balance information; and
other records needed to provide the agreed service.

Personal information within your records

Business records may contain personal information relating to:

business owners and directors;
employees and workers;
customers;
suppliers;
contractors;
payroll recipients; and
authorised representatives.

This may include names, contact information, bank or payment details, payroll information and other information contained within the records you provide to us.

Please only provide information that is reasonably necessary for the services we are carrying out.

Where particularly sensitive information needs to be shared, please use the secure method agreed with us rather than ordinary email wherever possible.

3. How We Receive Information

Client information may be provided to us:

during an enquiry or discovery call;
when you engage Nefe Ledger;
through bookkeeping or accounting software;
through payroll systems;
using a secure client portal;
through document-upload or file-sharing systems;
by email where appropriate;
through invoices, receipts and bank records;
directly by you or an authorised member of your team; or
by another professional adviser where you have authorised the disclosure.

You are responsible for ensuring that information you provide is accurate, complete and lawful for you to share with us.

4. How We Use Client Information

We use client information where reasonably necessary to provide and administer our services.

This may include using information to:

maintain bookkeeping records;
record and categorise transactions;
reconcile bank and other accounts;
maintain sales and purchase ledgers;
record expenses;
organise invoices and receipts;
maintain bookkeeping records through to trial balance;
support VAT record keeping;
support payroll record administration;
assist with customer invoicing;
process supplier invoices;
administer accounts payable;
administer accounts receivable;
respond to bookkeeping queries;
identify errors or discrepancies;
communicate with you and your authorised representatives;
manage our client relationship;
issue our own invoices and receive payment;
protect our systems and information;
comply with applicable legal and regulatory obligations; and
establish, exercise or defend legal claims.

We will not use client information for unrelated purposes unless we have a lawful reason to do so.

5. Our Data Protection Role

Our role under UK data protection law can vary depending on what information we are handling and why.

When we process information for you

For personal information contained within your bookkeeping, payroll, invoicing or other business records, you will generally determine why that information is being processed.

In those circumstances:

you will generally act as the data controller; and
Nefe Ledger will generally act as your data processor.

Where we act as a processor, we will process personal data in accordance with your documented instructions and the applicable Data Processing Terms.

When Nefe Ledger is the controller

Nefe Ledger may act as an independent data controller when we process information for our own legitimate business or legal purposes.

Examples include:

managing our relationship with you;
administering our own invoices and payments;
handling enquiries and complaints;
maintaining our own business records;
meeting legal or regulatory requirements;
fraud prevention and security; and
dealing with legal claims.

Our Privacy Policy provides further information about how we use personal data where Nefe Ledger acts as a controller.

6. How Client Information Is Stored

Nefe Ledger primarily operates using online systems.

Depending on the service being provided, information may be held within:

cloud bookkeeping or accounting software;
payroll systems;
secure document-management systems;
client portals;
secure file-sharing systems;
business email systems;
password-protected business devices;
secure backup systems; and
paper records where there is a legitimate reason to retain them.

The particular systems we use may change as our business and technology develop.

When selecting third-party systems, we take reasonable steps to consider their security and data-protection arrangements.

7. How We Protect Client Information

We use technical and organisational measures appropriate to the information we handle.

Depending on the system and service, these measures may include:

limiting access to authorised individuals;
unique user accounts;
strong passwords;
multi-factor authentication where available and appropriate;
secure methods for transferring information;
encryption where provided by the relevant platform;
security updates and device protection;
screen locks;
anti-malware and other security tools;
appropriate backups;
access reviews;
confidentiality requirements;
secure deletion processes; and
procedures for dealing with suspected security incidents.

We regularly consider whether our security arrangements remain appropriate for the information we handle.

No electronic system or method of transmitting information can be guaranteed to be completely secure.

8. Access and Confidentiality

Access to client information is restricted to individuals who reasonably need it to:

provide the agreed services;
manage our client relationship;
maintain or support relevant systems;
comply with a legal obligation; or
protect our legitimate business interests.

People who are authorised to access confidential client information are expected to maintain appropriate confidentiality.

We will not knowingly disclose your confidential information to unauthorised people.

You are responsible for deciding which members of your own organisation are authorised to access your financial information and shared systems.

Please tell us promptly when someone's access should be removed.

9. Sharing Information With You

We may provide you or your authorised representatives with:

bookkeeping records;
reconciliations;
reports;
queries;
schedules;
invoice information; and
other work produced as part of the agreed services.

Where reasonably practicable, we will use an agreed secure method such as:

your bookkeeping or accounting platform;
a client portal;
secure document sharing; or
another agreed online system.

Email may be used for routine communication, but highly sensitive documents should be shared through a secure system where one has been provided.

10. Sharing Information With Avonlea Accounting

Where you require services outside Nefe Ledger's bookkeeping and finance administration scope, such as annual accounts, Corporation Tax or Self Assessment services, we may introduce you to Avonlea Accounting.

Avonlea Accounting is a separate and independent business.

We will not routinely transfer your bookkeeping information to Avonlea Accounting simply because an introduction has been made.

Information will only be shared where:

you have asked us to do so;
you have authorised the transfer;
the information is reasonably necessary to facilitate the service you have requested; or
disclosure is otherwise legally permitted or required.

We will only share information that is reasonably necessary for the purpose.

Once information is provided to Avonlea Accounting for its own independent professional services, Avonlea Accounting is responsible for its own handling of that information.

You should review Avonlea Accounting's own engagement terms and privacy information before engaging its services.

11. Other Service Providers

Nefe Ledger may use trusted third-party businesses to help operate and deliver our services.

These may include providers of:

bookkeeping and accounting software;
payroll software;
cloud storage;
document management;
secure file sharing;
email and communications;
IT and cyber-security support;
payment processing;
backup systems;
professional advice; and
business continuity services.

Where a third party processes personal information on our behalf, we will take reasonable steps to ensure appropriate contractual and security arrangements are in place where required.

We may also disclose information where required by law or where reasonably necessary in connection with:

a court order;
a competent authority;
HMRC;
law enforcement;
a regulator;
an insurer;
a professional adviser; or
the establishment, exercise or defence of legal rights.

12. International Data Transfers

Some software and technology providers may process or store information outside the United Kingdom.

Where UK data protection law restricts an international transfer of personal data, we will take reasonable steps to ensure that an appropriate lawful transfer mechanism or safeguard is used.

This may include an applicable adequacy arrangement, contractual safeguard or another legally recognised transfer mechanism.

Further information about international transfers may also be provided in our Privacy Policy or on request.

13. How Long We Keep Client Information

We do not intend to keep client information indefinitely.

How long information needs to be retained will depend on factors such as:

the type of information;
the services provided;
your instructions;
applicable legal requirements;
tax and accounting requirements;
insurance requirements;
dispute resolution;
fraud-prevention needs; and
establishing or defending legal claims.

Some financial and bookkeeping information may need to be retained for a number of years after the relevant period or after our engagement ends.

Because different records can be subject to different statutory retention requirements, we will apply the appropriate period according to the information concerned rather than treating every record in exactly the same way.

When information is no longer reasonably required, we will take appropriate steps to delete, destroy or anonymise it.

Information contained in backups may remain for a limited period until it is overwritten or deleted through the normal backup cycle.

14. Your Responsibilities When Sharing Information With Us

Protecting business information is a shared responsibility.

As a Nefe Ledger client, you should:

provide accurate and complete information;
provide records in sufficient time for the agreed work;
make sure you are entitled to share personal information with us;
provide appropriate privacy information to your employees, customers or suppliers where required;
use agreed secure methods for sending sensitive information;
protect passwords and login credentials;
restrict access to authorised people;
maintain appropriate security on your own devices and systems;
tell us promptly about changes in authorised users;
notify us if you suspect information has been lost or accessed without permission; and
maintain appropriate copies or backups of information you need to retain.

Please never send us your personal online-banking password, PIN or security code.

15. Individual Data Protection Rights

People have a number of rights under UK data protection law, although which rights apply will depend on the circumstances.

These can include rights relating to:

access to personal information;
correcting inaccurate information;
deletion in certain circumstances;
restricting processing in certain circumstances;
objecting to certain processing;
data portability where applicable; and
withdrawing consent where consent is being relied upon.

Where Nefe Ledger is processing personal information on behalf of one of our clients, the client will generally be responsible for dealing with requests concerning that information.

We will provide reasonable assistance where required.

If we receive a request relating to information we process on behalf of a client, we may pass the request to that client so it can be handled appropriately.

For more information about your privacy rights, please read our Privacy Policy.

16. Security Incidents and Personal Data Breaches

If we become aware of a security incident affecting client information, we will take reasonable steps to:

contain the incident;
investigate what happened;
assess the information affected;
consider the risk to affected individuals;
keep appropriate records; and
take appropriate remedial action.

Where a personal data breach involves information we process on behalf of a client, we will notify the relevant client without undue delay where required.

We will also provide reasonable information to help the client assess and manage its own legal obligations.

Where Nefe Ledger is responsible for making a regulatory or individual notification, we will do so where required by applicable law.

Please contact us promptly if you believe information shared with Nefe Ledger has been lost, disclosed or accessed without authorisation.

17. Secure Disposal of Information

When information reaches the end of its appropriate retention period, we will take reasonable steps to dispose of it securely.

Depending on the information and system, this may include:

permanent electronic deletion;
removal from devices;
removing system access;
destroying paper records;
anonymising data; or
allowing encrypted backups to expire through their normal deletion cycle.

We will not delete information where we are legally required or otherwise lawfully entitled to retain it.

18. Changes to This Policy

We may update this Client Data & Information Storage Policy from time to time.

This may be necessary because of changes to:

our services;
the systems we use;
security practices;
UK data protection law; or
other legal or regulatory requirements.

When we make a material change, the Last updated date at the top of this page will be changed.

The latest version published on our website will apply from the date stated.

19. Contact Nefe Ledger

If you have a question about this policy, the security of your information or the way we handle client records, please contact:

Nefe Oguntoye trading as Nefe Ledger