Last updated: 5 November 2026
1. Who we are
When we say “LuciBook”, “we”, “our” or “us”, we mean LuciBook Ltd, a company registered in England and Wales (company number 15848436) with its registered office at Suite 7, Innovation House, Molly Millars Close, Wokingham, Berkshire, RG41 2RX. We are the controller of the personal data described in this notice.
We provide LuciBook, a cloud practice-management platform for accounting and bookkeeping firms and their teams.
2. What this notice covers
This notice explains how we process personal data. “Personal data” means information that relates to you and from which you can be identified, such as your name, email address, phone number, billing details, support queries and, in some cases, information about your device such as your IP address.
It applies to personal data we collect through our websites (including lucibook.co.uk and core.lucibook.co.uk), our applications, customer support, surveys, events, training and any other services we provide. In this notice we call all of these our “services”.
3. What this notice doesn’t cover
This notice does not apply to personal data that our subscribers (the firms that create and pay for a LuciBook subscription) or their invited users enter into our services about their own clients, suppliers, staff or other third parties. The subscriber controls that data and we process it only as a processor on the subscriber’s behalf, under our Data Processing Agreement. If you are a client of a firm that uses LuciBook and have questions about your data, please contact that firm directly.
If you give us personal data about other people, you must make sure you are allowed to do so.
4. Personal data we collect and how we get it
What we collect depends on how you interact with us. We collect personal data:
- Directly from you — when you sign up for a trial or subscription, use our services, contact support, join a webinar or training, or otherwise communicate with us. You don’t have to give us personal data, but without it you may not be able to use parts of our services.
- Automatically — when you visit our websites or use our applications, for example the pages you view, the features you use and the device you use.
- From third parties — occasionally from service providers that help us run our business (such as payment, email, analytics and identity-verification providers) or from public sources such as Companies House.
The categories we collect are:
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | Name, email address, phone number, job title, firm name and address | You; third parties |
| Account data | Login details, profile information, subscription and plan details, user roles | You |
| Payment data | Billing address, VAT number, truncated card details, payment history (full card numbers are held by our payment provider, not by us) | You; payment provider |
| Communications data | Support tickets, emails, chat messages, feedback and survey responses | You |
| Marketing data | Communication preferences, interests shown through your use of our services | You; automatically |
| Device data | IP address, browser type, operating system, device identifiers, approximate location derived from IP | Automatically |
| Service usage data | Pages visited, features used, actions taken, login history, integrations connected, performance and error logs | Automatically |
| Google sign-in data | Name, email address and Google account identifier, received from Google only if you choose “Continue with Google” (we never receive your Google password and do not store Google access tokens or your profile picture) | |
| Uploaded content | Personal data contained in files, images or documents you upload to our services about yourself or your firm | You |
“Continue with Google” is an optional sign-in method available to all users. If you use it, Google LLC provides that sign-in service. If an account already exists for the same verified email address, we link your Google sign-in to it. Lucibook multi-factor authentication is required for Google sign-ins by default, and always for staff; a platform-wide setting may waive it for non-staff Google sign-ins.
We do not ask for special-category data (such as health or trade-union information) to run our services. If you choose to give it to us, we will handle it with extra care.
5. How we use your personal data
We use personal data to operate our services and manage our relationship with you. The purposes are:
- To deliver our services — setting up and managing your account, trial or subscription; providing, maintaining, hosting, monitoring, troubleshooting and testing the services. Categories: identity and contact, account, payment, communications, device, service usage.
- To communicate with you about our services — invoices, service announcements, technical and security notices, support replies and responses to your enquiries, by email, phone or in-product messages. Categories: identity and contact, account, payment, communications, service usage.
- For quality, training and record-keeping — reviewing support interactions to improve how we help you. Categories: identity and contact, account, communications.
- For security management — detecting and preventing fraud, abuse and unauthorised access, and protecting our systems and users. Categories: identity and contact, account, device, service usage.
- To improve and develop our services — analysing how the services are used to fix problems, prioritise features and build new products. Where practical we use aggregated or de-identified data for this. Categories: account, device, service usage, communications.
- For marketing — telling you about LuciBook features, offers, events and content we think will interest you. You can opt out at any time using the unsubscribe link or by contacting us. Categories: identity and contact, account, marketing, service usage.
- For legal and regulatory compliance — meeting our obligations under tax, accounting, anti-money-laundering and data protection law, and responding to lawful requests. Categories: identity and contact, account, payment, communications, service usage.
- To manage legal claims — establishing, exercising or defending our legal rights. Categories: identity and contact, account, payment, communications, service usage.
We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
6. Legal bases for processing
Under the UK General Data Protection Regulation we rely on the following legal bases:
| Legal basis | Purposes |
|---|---|
| Contractual necessity | Delivering our services; communicating with you about them |
| Legitimate interests | Quality and record-keeping; security management; improving and developing our services; marketing to existing customers; managing legal claims |
| Consent | Marketing to prospects; optional cookies; any special-category data you choose to give us |
| Legal obligation | Legal and regulatory compliance; security incidents we must report; responding to lawful requests |
Where we rely on legitimate interests, we have checked that those interests are not overridden by your rights. You can object at any time (see section 12).
7. Cookies and similar technologies
We use cookies that are strictly necessary to run our services, such as keeping you signed in, remembering your settings and protecting against security threats. These cannot be switched off. If we add analytics or marketing cookies, we will ask for your consent and explain them in a cookie notice on our websites.
8. How we share your personal data
We share personal data only with:
- Service providers and partners who help us deliver our services — for example cloud hosting, email delivery, payment processing, e-signature, open-banking, customer support and analytics providers. They act on our instructions and under contracts that protect your data. A current list of sub-processors is available from info@lucibook.co.uk.
- Google LLC, which provides the “Continue with Google” sign-in service if you choose to use it. Google receives only what the sign-in flow itself requires and handles it under its own privacy policy.
- Third-party services you connect to LuciBook (for example bank feeds, e-signature or email integrations). Those providers handle your data under their own terms and privacy notices.
- Professional advisers such as our accountants, lawyers, auditors and insurers, where necessary.
- Regulators, law enforcement, courts and other authorities where we believe it is necessary to comply with the law, to exercise or defend our legal rights, or to protect you or others. Where we can, we will tell you.
- An actual or potential buyer of all or part of our business, and their advisers, in connection with a merger, acquisition or sale of assets.
- Other people with your consent or where the law permits.
If you were invited to use LuciBook by a subscriber, we may share data about your use of the services with that subscriber.
9. Personal data retention
We keep personal data for as long as we have a relationship with you and for a period afterwards where we have an ongoing business or legal reason to do so, such as tax, accounting or limitation-period requirements. As a guide: account and billing records are kept for up to 6 years after your subscription ends; support correspondence for 3 years; and technical logs for 12 months. After that we delete or anonymise the data. Subscriber content is deleted 30 days after a subscription ends, as described in our Terms of Service.
10. Security
We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, role-based access controls, logging, regular backups and staff training. No system can be guaranteed secure. If we become aware of a personal data breach that is likely to affect your rights, we will tell you and the Information Commissioner’s Office (ICO) where the law requires it.
11. International transfers
Our services are hosted in the United Kingdom. Some of our service providers may process personal data outside the UK. When that happens, we only transfer data to countries that the UK has found to provide adequate protection, or we put safeguards in place such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Contact us for more information about these safeguards.
12. Your rights
You have the right to:
- know whether we hold personal data about you, and access a copy of it;
- ask us to correct data that is inaccurate or incomplete;
- ask us to delete your personal data, or restrict how we process it;
- object to processing based on our legitimate interests, including direct marketing;
- receive the personal data you gave us in a portable format;
- withdraw consent at any time where we rely on it; and
- not be subject to solely automated decisions with legal or similarly significant effects.
To exercise any of these rights, contact us using the details in section 14. We will respond within one month, and may ask you to verify your identity first. These rights are not absolute and we may need to keep some data to meet legal obligations.
If you are unhappy with how we handle your personal data, please contact us first so we can try to put it right. You also have the right to complain to the ICO at ico.org.uk.
13. Updates to this notice
We may update this notice from time to time. If we make a material change, we will let you know by email or by posting a notice on our websites or in our applications. The “last updated” date at the top shows when the current version took effect.
14. How to contact us
LuciBook Ltd, Suite 7, Innovation House, Molly Millars Close, Wokingham, Berkshire, RG41 2RX
Email: info@lucibook.co.uk