Edward Jenkins, trading as no~bull consulting (“we”, “us”), is the data controller for personal data processed through nBooks, our accounting software for UK sole traders.
This policy explains what personal data we process, why, and what your rights are under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are the data controller for account and subscription data (name, email, billing). For the financial records you create and store in nBooks, we act as your data processor — the software runs on our own UK-based infrastructure, and access is restricted to what is required to operate and support the service.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address | Account creation, authentication, support | Contract (Art. 6(1)(b)) |
| Firm name | Workspace identification, correspondence | Contract (Art. 6(1)(b)) |
| Subscription status, payment history | Licence management and billing | Contract (Art. 6(1)(b)) |
| Login timestamps, session tokens | Security, fraud prevention | Legitimate interests (Art. 6(1)(f)) |
As required by HMRC’s MTD API rules, we collect and transmit fraud prevention headers with all MTD API calls. This includes device identifiers, browser metadata, and IP address. This is a legal obligation (Art. 6(1)(c)).
nBooks workspace data (invoices, transactions, financial records) is stored in a PostgreSQL database on UK-based servers operated by no~bull consulting, isolated per tenant. nBooks is built on open-source software; access requires authentication via our own login system.
We maintain audit logs of significant actions within each workspace, stored within our own database alongside workspace data.
We implement appropriate technical measures including: session expiry, rate limiting, and per-tenant data isolation.
| Data type | Retention period |
|---|---|
| Active workspace data | Held for the duration of the subscription plus a 44-day grace period |
| Account and subscription records | 7 years from end of subscription (statutory accounting obligation) |
| Session tokens | 30 days or until revoked |
| HMRC fraud prevention data | As required by HMRC — currently 7 years |
| Audit logs | Retained within the workspace for as long as the workspace exists |
Workspace data on our own infrastructure is retained according to the periods above and removed in line with our data retention and deletion procedures upon request or after the stated grace period.
nBooks workspace data is hosted on our own UK-based infrastructure. We use a small number of sub-processors for supporting services: Cloudflare (network routing and security), and Postmark (transactional email delivery). These providers process only what is strictly necessary for their function and are bound by their own data processing agreements.
We do not sell personal data. We do not share it with any other third party except where required by law.
nBooks is currently offered exclusively to UK-based businesses and processes data within the scope of UK GDPR only. If we expand to EU/EEA markets in the future, this policy will be updated accordingly before any such expansion.
Our marketing website (nobull.consulting) does not use tracking cookies or analytics scripts. nBooks uses browser localStorage to store session tokens. These are functional and strictly necessary; no consent is required.
You have the following rights in relation to your personal data:
To exercise any of these rights, email edward@nobull.consulting. We will respond within one calendar month.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO): ico.org.uk · 0303 123 1113.
We will update this policy when our practices change materially. The version number and effective date at the top of this page will reflect any changes. We will notify active subscribers by email of significant changes.
Edward Jenkins t/a no~bull consulting
edward@nobull.consulting
nobull.consulting