1. Introduction
Welcome to V-Tickd, an operational accounting workflow automation platform operated by Veloce Technologies Limited (trading as Veloce Technology Ltd, "Veloce", "we", "us", or "our").
V-Tickd provides recurring bookkeeping operations, client document requests, missing-record chasing, reconciliation attention signals, and review readiness workflows for UK accounting practices and their business clients. V-Tickd is accessible via our web application and the V-Tickd Client Portal application for web browsers and Apple iOS devices.
We are committed to processing all personal data securely, transparently, and in strict accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations (PECR). This Privacy Policy explains our data processing practices, your rights, and how we protect your information.
2. Who We Are
Veloce Technologies Limited is a software company incorporated in the United Kingdom, delivering specialized cloud software products for professional teams and accounting firms.
Entity Name: Veloce Technologies Limited (also trading as Veloce Technology Ltd)
Primary Contact & Privacy Office: contact@veloce-tech.com
Website: https://veloce-tech.com
Service URL: https://veloce-tech.com/products/v-tickd
Official statutory company registration and registered office address details are maintained in our corporate records and are available upon request for formal compliance and procurement review.
3. Scope of This Privacy Policy
This Privacy Policy applies to personal data processed across all components of the V-Tickd service ecosystem, including:
- The V-Tickd Practice Web Application used by accounting and bookkeeping practitioners;
- The V-Tickd Client Portal web application used by clients of accounting practices to submit financial records and respond to document requests;
- The V-Tickd Client Portal iOS Application downloaded from the Apple App Store;
- Backend Application Programming Interfaces (APIs), secure cloud storage buckets, and automated processing pipelines powering V-Tickd;
- Direct communications, waiting list applications, customer support requests, and account administration between Veloce and our users.
This policy does not govern the independent data protection practices of third-party accounting platforms (such as Xero) or external websites linked from our platform, each of which maintains its own privacy documentation.
4. Our Roles as Data Controller and Data Processor
Data protection law distinguishes between a Data Controller (the party determining why and how personal data is processed) and a Data Processor (the party processing data strictly on documented instructions from the controller). In operating V-Tickd, roles are distributed as follows:
A. Accounting Practice as Data Controller / Veloce as Data Processor
When an accounting practice uses V-Tickd to manage client bookkeeping, invite clients to the Client Portal, request missing paperwork, and upload or review client financial records, the accounting practice is the Data Controller.
In this relationship, Veloce acts strictly as a Data Processor under Article 28 of the UK GDPR. We store, transmit, extract, and organise those records solely pursuant to our B2B SaaS agreement and Data Processing Addendum (DPA) with the practice. If you are an individual client uploading documents through the Client Portal, your accounting firm is your primary Data Controller.
B. Veloce as Data Controller
Veloce acts as an independent Data Controller for specific, limited categories of data that we manage directly for our own business operations:
- Managing accounting practice subscriber accounts, billing, contracts, and primary administrator contacts;
- Operating system-level authentication, credential security, access control, and audit logs;
- Receiving waiting list and early-access applications, website enquiries, and customer support tickets;
- Maintaining our own statutory accounting, tax, and legal records under UK company law.
5. Personal Information We Process
We collect and process only the personal data strictly necessary to deliver V-Tickd's workflow automation services:
A. Account & Identity Data
- Name: Full name of practitioners and portal client contacts.
- Email Address: Used for secure login authentication, document request notifications, and account administration.
- User Identifier (User ID): Internally generated system GUID used to associate authenticated sessions and secure database records.
- Organisation Association: Practice name, business legal entity, and role/permission level.
- Authentication Records: Cryptographic password hashes (passwords are never stored in plain text), multi-factor authentication metadata, and active session tokens.
B. Financial Information & Accounting Records (Controlled by Practice)
- Bank & Payment Records: Bank statements, transaction summaries, dates, payees, transaction amounts, and reference details.
- Invoices & Receipts: Supplier names, billing addresses, invoice numbers, purchase items, net/VAT/gross amounts, and payment status.
- Bookkeeping Context: Missing record queries, client query responses, reconciliation notes, and categorization tags.
- Ledger Synchronization Data: Where Xero connectivity is enabled by the practice, ledger transaction metadata and chart-of-accounts codes.
C. User-Provided Content & Media
- Uploaded Documents: PDF files, scanned image files (JPEG, PNG, HEIC), CSV spreadsheets, and financial attachments.
- Mobile Camera & Photo Library Captures: Photos of paper receipts and paper invoices taken by users via the V-Tickd Client Portal iOS application.
- Communication Notes: Written clarification notes and messages exchanged regarding specific accounting transactions.
D. Technical & Device Information
- Network Telemetry: IP addresses, browser type, operating system version, and API endpoint request timestamps recorded in server access and security logs.
- iOS Mobile Device Telemetry: Device model, iOS version, application version, and Apple Push Notification service (APNs) device tokens (collected only when push notifications are explicitly enabled).
- Audit & Operational Logs: Records of document uploads, view events, review readiness confirmations, and account modification timestamps to ensure operational accountability.
6. How We Collect Information
We collect personal data through the following specific mechanisms:
- Direct Provision by Users: Information entered when registering for early access, logging into a practice account, or submitting documents through web forms or the Client Portal.
- Accounting Practice Invitations: Practice administrators provide client names and email addresses to invite them into their dedicated Client Portal space.
- iOS Camera & Photo Library Access: In the iOS Client Portal app, users can grant optional permission to access their camera or photo library. Photos of receipts are processed locally on the device until confirmed and uploaded by the user to the encrypted cloud vault.
- Automated Cloud Infrastructure Logs: Our AWS-hosted servers automatically capture standard network request details (IP address, user-agent, request path) to safeguard system integrity.
- Connected Accounting Integrations: If an accounting practice connects an accounting ledger (such as Xero), ledger transaction references and reconciliation status are retrieved via secure OAuth 2.0 API calls.
7. How and Why We Use Information
We use personal data strictly for verified, legitimate business purposes:
Authentication & Access Control
Verifying identity, securing user accounts, preventing credential theft, and enforcing role-based practice permissions.
Workflow & Evidence Collection
Automating document chasing, collating client records, and matching evidence to recurring bookkeeping periods.
Document Extraction & OCR
Extracting key financial figures (dates, totals, VAT, suppliers) to prepare drafts for human review.
Alerts & Notifications
Delivering transactional emails and iOS push notifications for document requests, upload receipts, and review readiness.
Auditability & Security
Recording tamper-resistant audit trails of document submissions, account actions, and platform security events.
Legal & Regulatory Compliance
Fulfilling statutory accounting, tax, corporate reporting, and lawful disclosure mandates under UK law.
8. Lawful Bases for Processing
Where Veloce acts as a Data Controller, we rely on the following lawful bases under Article 6 of the UK GDPR:
| Processing Activity | Lawful Basis (UK GDPR) | Justification |
|---|---|---|
| Provision of V-Tickd SaaS platform, account access & billing | Article 6(1)(b) — Performance of Contract | Necessary to deliver the services agreed under the practice subscription agreement. |
| System security, fraud prevention & audit logging | Article 6(1)(f) — Legitimate Interests | Necessary to protect multi-tenant infrastructure and ensure data integrity. |
| Direct customer support & responding to enquiries | Article 6(1)(f) — Legitimate Interests | Necessary to answer user enquiries and assist with technical support. |
| Tax records, corporate filings & legal compliance | Article 6(1)(c) — Legal Obligation | Mandatory compliance with UK Companies Act, HMRC, and tax legislation. |
| Optional mobile camera and push notifications in iOS app | Article 6(1)(a) — Consent | Granted explicitly via iOS system permission dialogs and revocable at any time. |
Note: For client accounting records processed by Veloce on behalf of an accounting practice (where Veloce is processor), the accounting practice determines and maintains its own lawful basis (such as performance of its client contract, compliance with accounting/tax laws, or legitimate interests).
9. Financial Documents and AI Processing
V-Tickd incorporates AI-assisted document understanding and optical character recognition (OCR) to streamline receipt and invoice processing. We adhere to rigorous safeguards regarding automated processing:
Human-in-the-Loop Review (No Solely Automated Decisions)
AI document extraction in V-Tickd provides operational suggestions and flags (e.g. extracted supplier name, invoice total, tax breakdown, and missing invoice alerts). It does not make decisions with legal or similarly significant effects under Article 22 of the UK GDPR. Qualified accounting professionals retain sole control over reviewing, editing, approving, and reconciling all bookkeeping transactions before any ledger entry or tax calculation is finalized.
Zero Model Training on Customer Data
We process documents using enterprise-grade, privacy-governed cloud extraction models (such as AWS Textract and dedicated enterprise cloud AI inference endpoints). Under our contractual terms, customer financial documents and personal data are strictly isolated and are NEVER used to train, retrain, or improve foundational third-party AI models.
10. Sharing Information With Accounting Practices
When a client uploads a receipt, invoice, or bank statement through the V-Tickd Client Portal (web or iOS), that information is made accessible exclusively to the specific accounting practice that manages that client workspace.
V-Tickd enforces strict organisation-scoped multi-tenancy. Practitioners within that practice can view, review, and download the documents according to the roles and client assignments configured by the practice administrator. No other practice or unrelated third party can access client workspaces or uploaded financial evidence.
11. Third-Party Service Providers (Subprocessors)
To operate our secure, scalable SaaS infrastructure, Veloce engages trusted third-party service providers ("subprocessors"). Each provider is subject to confidentiality agreements and comprehensive Data Processing Addendums:
| Provider | Purpose & Processing Scope | Primary Location |
|---|---|---|
| Amazon Web Services (AWS) EMEA SARL | Cloud computing, relational database storage, encrypted S3 object storage for document files, and AWS Simple Email Service (SES) for transactional system emails. | United Kingdom (London Region: eu-west-2) |
| Apple Inc. | Apple Push Notification service (APNs) used to deliver encrypted push notifications to users of the V-Tickd Client Portal iOS application. | United States / Global infrastructure |
| Xero Limited (Optional Integration) | Accounting ledger connectivity authorized explicitly by accounting practices via secure OAuth 2.0 API connection. | United Kingdom / Global |
We do not sell, rent, or monetize personal data or financial records under any circumstances. We do not use third-party advertising networks, data brokers, or marketing SDKs within the V-Tickd service.
12. International Data Transfers
V-Tickd's primary production infrastructure, database, and encrypted document storage are hosted in the AWS London Region (eu-west-2) within the United Kingdom.
Where limited technical data is transferred outside the UK (for example, relaying an iOS push notification through Apple's global APNs infrastructure, or communicating with global cloud monitoring infrastructure), we ensure adequate protection pursuant to Chapter V of the UK GDPR through:
- UK Adequacy Regulations: Transfers to countries recognized by the UK Government as providing an adequate level of data protection.
- Standard Contractual Clauses & UK Addendum: Inclusion of the UK International Data Transfer Addendum (IDTA) or approved Standard Contractual Clauses (SCCs), accompanied by transfer risk assessments.
13. Information Security
We employ rigorous technical, physical, and organizational safeguards designed to protect personal data from accidental loss, unauthorized disclosure, or malicious tampering:
Encryption in Transit
All web, API, and mobile communications are encrypted using modern Transport Layer Security (TLS 1.2 and TLS 1.3) with strict HTTPS enforcement.
Encryption at Rest
All uploaded financial documents, database tables, and system backups are encrypted at rest using industry-standard AES-256 encryption.
Practice Isolation
Multi-tenant data isolation strictly confines data access to authenticated users within the authorized practice boundary.
Role-Based Access
Granular permission levels ensure users only access the client workspaces and accounting data necessary for their role.
14. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:
- Accounting Practice Records (Controller Instructions): Accounting documents, receipts, and invoices uploaded to a practice workspace are retained according to the retention schedule established by the accounting practice. In the UK, accounting records are typically retained for a minimum of 6 years to comply with HMRC statutory requirements under the Taxes Management Act 1970 and Value Added Tax Act 1994.
- User Account Profiles: Practice user and portal user account profiles are retained for the duration of the active subscription or until deleted by the user or practice administrator.
- Operational & Security Logs: Server access logs and security telemetry are retained for up to 12 months for security auditing and forensic investigation, after which they are systematically overwritten.
- Encrypted Backups: System disaster recovery snapshots are rotated and permanently purged on a rolling cycle between 30 to 90 days.
15. Account and Data Deletion
We provide clear mechanisms for account deletion and data removal in accordance with UK GDPR and Apple App Store Review Guidelines:
In-App Account Deletion (V-Tickd Client Portal iOS & Web)
Users can initiate account deletion directly within the V-Tickd Client Portal by navigating to Settings > Account > Delete Account, or by emailing contact@veloce-tech.com.
Upon confirmation, account deletion immediately invalidates active sessions, deletes login credentials and device notification tokens, and permanently disassociates the user profile from the platform.
Distinction: User Accounts vs. Practice-Controlled Financial Records
Important Notice: Deleting an individual portal user account removes personal portal credentials. However, it does not automatically delete invoices, receipts, or financial documents previously uploaded to the accounting practice. Because your accounting practice is the Data Controller and is subject to statutory UK tax record-keeping mandates (e.g. keeping records for 6 years for HMRC), requests to delete underlying accounting evidence must be addressed directly to your accounting firm.
16. Your Privacy Rights
Under the UK GDPR and the Data Protection Act 2018, you possess comprehensive rights regarding your personal data:
How to Exercise Your Rights:
• For Practice-Controlled Client Data: If you are a client of an accounting practice using the Client Portal, please contact your accounting practice directly. As the Data Controller, they are legally responsible for evaluating and responding to your request. We will assist your practice in fulfilling your request.
• For Veloce-Controlled Data: To exercise rights regarding your practice account, billing, or direct communications with Veloce, contact us at contact@veloce-tech.com. We will respond within one calendar month.
17. Children's Privacy
V-Tickd is a B2B professional accounting and bookkeeping workflow system designed exclusively for accounting practitioners, corporate enterprises, and adult business clients. We do not knowingly solicit, collect, or process personal data from individuals under the age of 18. If we become aware that personal data of a minor has been inadvertently submitted, we will take immediate steps to delete that information.
18. Cookies and Similar Technologies
Within the V-Tickd web application and Client Portal web platform, we use strictly necessary session cookies and cryptographic tokens to authenticate users, maintain secure sessions, and prevent Cross-Site Request Forgery (CSRF).
The V-Tickd Client Portal iOS Application does not use browser cookies. It utilizes secure iOS Keychain storage to store encrypted session tokens locally on your device.
We do not deploy third-party advertising cookies, marketing tracking pixels, or cross-site behavioral tracking tools within V-Tickd. For details regarding website cookies on our public marketing site, please consult our Cookies Policy.
19. Changes to This Privacy Policy
We may periodically update this Privacy Policy to reflect modifications to product functionality, technological enhancements, statutory updates, or Apple App Store Review Guidelines.
When changes are published, we will update the "Last Updated" date at the top of this document. For material modifications that substantively alter your rights or the nature of our data processing, we will provide advance notice via email or a prominent notification within the V-Tickd web platform and iOS application.
20. Contact Information and Complaints
If you have questions, comments, or requests regarding this Privacy Policy, or if you wish to exercise your rights, please contact our Privacy Team:
Entity: Veloce Technologies Limited / Veloce Technology Ltd
Email: contact@veloce-tech.com
Subject Line: "V-Tickd Privacy Enquiry" or "Data Subject Access Request"
Online Form: https://veloce-tech.com/contact
UK Supervisory Authority (ICO):
You have the right to lodge a complaint at any time with the UK supervisory authority for data protection:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/
Appendix: V-Tickd Client Portal iOS Privacy Declarations
In compliance with Apple's App Store Review Guidelines and App Privacy details requirements, the table below provides an exact disclosure of all data categories collected by the V-Tickd Client Portal iOS Application, their operational purpose, whether they are linked to the user's identity, and whether they are used for tracking:
| Data Category | Purpose | Linked to Identity? | Used for Tracking? |
|---|---|---|---|
| Name | App Functionality (User profile & practice collaboration) | Yes | No |
| Email Address | App Functionality (Authentication & document notifications) | Yes | No |
| User ID | App Functionality (Account identification & access control) | Yes | No |
| Other Financial Info | App Functionality (Bank statements, receipts, invoices, VAT details) | Yes | No |
| User Content | App Functionality (Receipt/invoice photos & PDF document uploads) | Yes | No |
| Device ID / Push Token | App Functionality (Optional Apple APNs push notifications) | Yes | No |
Definitive Tracking Statement:
The V-Tickd Client Portal iOS app DOES NOT TRACK users across third-party apps and websites owned by other companies. It contains zero third-party advertising SDKs, zero data brokers, and zero commercial analytics tracking frameworks.