Privacy Policy

1. Who we are

WeekOne Software Limited is the data controller for personal data collected through our platform and marketing website. We are registered in England and Wales.

Registered address: WeekOne Software Limited, 123 Finsbury Square, London, EC2A 1AB, United Kingdom.

ICO registration number: ZB123456 (placeholder — to be confirmed on registration).

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect

We collect personal data in the following categories:

• Account data: Your name, email address, and password hash when you create an account or join an organisation.
• Organisation data: Company name, registered address, VAT number, and other business information you provide during onboarding.
• Usage data: Actions you take within the platform (records created, modules used, timestamps), browser type, IP address, and device identifiers, collected to keep the service secure and to improve it.
• Payment data: Billing name, address, and the last four digits of your card. Full card details are processed by Stripe and never stored on our servers.
• Communications: Messages you send to our support team and the content of any feedback you submit.
• Customer records you enter: Contact details, notes, invoices, and other business records you store in WeekOne about your own customers. You are the controller of this data; we process it on your behalf as a processor.

3. How we use your data

We use personal data to:

• Provide, operate, and maintain the WeekOne platform.
• Create and manage your account and organisation.
• Process subscription payments and send invoices.
• Send transactional emails (password resets, invoice notifications, team invitations).
• Respond to support requests and resolve technical issues.
• Monitor and improve platform security and performance.
• Comply with legal obligations, including HMRC requirements.
• Send product updates and feature announcements (you may opt out at any time).

4. Legal basis for processing

Under UK GDPR, we rely on the following lawful bases for processing your personal data:

5. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account and organisation data: retained for the life of your account, plus 90 days after deletion to allow for recovery.
• Financial records (invoices, payment history): retained for 7 years in accordance with HMRC requirements.
• Support communications: retained for 3 years from the date of the last message.
• Usage and security logs: retained for 12 months.
• Backup data: retained for up to 30 days before being permanently deleted.

When you close your account, we will delete or anonymise your personal data within 90 days, except where retention is required by law.

6. Your rights under UK GDPR

As a data subject, you have the following rights. You can exercise them at any time by contacting us using the details in section 9.

We will respond to all requests within one calendar month. Complex or multiple requests may take up to three months; we will notify you if this is the case.

7. Cookies

We use cookies and similar technologies on our website and platform. Our Cookie Policy explains in full which cookies we use, why we use them, and how to manage your preferences.

8. Third-party processors

We share data with the following trusted sub-processors to operate the platform. All are bound by data processing agreements that require them to process data only on our instructions.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

9. Contact and data protection enquiries

For all data protection enquiries, requests to exercise your rights, or to raise a concern, please contact:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email to account holders at least 14 days before they take effect. The current version is always available at weekone.io/privacy.