Version 2026-11-09 · Terms · Data processing agreement
Privacy notice
This notice explains how [Company name - add COMPANY_NAME in Render] (ICO registration [ICO registration number]) uses personal data in Nexa Practice.
Two kinds of data
- Payroll data (the employees of your clients: names, NI numbers, dates of birth, addresses, pay, tax, pensions, bank details, and sickness or family leave). The accountancy firm or employer is the controller. We only process it on their instructions, under our Data Processing Agreement. If you are an employee, please contact your employer or their accountant first.
- Account data (the people who log in: name, email, firm, login times, security settings, and records of agreeing to these terms). For this, we are the controller.
How we use account data
- To provide the service and keep it secure (contract and legitimate interests).
- To send service emails, such as security alerts and deadline reminders (contract).
- To keep records of who agreed to our terms, and of activity, for legal and security reasons (legal obligation and legitimate interests).
We do not sell personal data, and we do not use payroll data for marketing or to train AI models.
Who we share it with
| Who | Why | Where |
|---|---|---|
| Render Services, Inc. | Hosting the app and database | Frankfurt, Germany (EU) |
| HM Revenue & Customs | Receiving RTI submissions you choose to send | United Kingdom |
| Email provider set up by us (if email is switched on) | Sending payslips, reports and reminders | UK / EU |
| Anthropic PBC (only if AI document reading is switched on) | Reading payslips and documents you upload | United States (UK IDTA / adequacy safeguards) |
| TrueLayer Limited (only if a bank is connected) | Open Banking: reading bank transactions and balances with your client's consent | United Kingdom |
| Companies House (only when you file accounts) | Receiving accounts you choose to file | United Kingdom |
Keeping it safe
Sensitive details are encrypted in the database, all traffic is encrypted, logins can use two-step codes, and every action is logged.
How long we keep it
Account data is kept while the account is open and for 6 years after, for legal claims. Payroll data is kept as the firm chooses, by default 6 years after the end of the tax year (HMRC requires at least 3), then deleted.
Your rights
You can ask to see, correct or delete your data, object to some uses, or ask us to limit them. Contact [support email]. You can also complain to the Information Commissioner's Office at ico.org.uk.