Privacy Policy

Information we collect

To provide and improve our Service, we may collect the following types of personal information:

Log and diagnostic data (see below)

Name

Email address

Phone number

Authentication and account details if you create an account

Usage data and interaction data the App

Device information (e.g. operating system, device type)

Third-party accounting and finance integrations

Our service allows you to connect with third-party accounting and financial management platform to enable data synchronisation and related features. When you authorise these integrations:

We store authentication credentials securely to maintain your connection.

We access financial data (e.g. invoices, contacts, transactions, account settings) as authorised by you.

We use this data only to provide the services to you (e.g. timesheet management, invoicing, reporting).

We do not sell or share your financial data with third parties for marketing purposes.

You may revoke these integrations at any time through your account settings. When you disconnect an integration, we stop accessing new data from that service, though we may retain historical data where required for record-keeping and contractual obligations.

We use this information to:

Maintain security, prevent fraud, and troubleshoot issues

Provide access to the service

Communicate with you

Improve functionality and user experience

Provide customer support

Lawful Basis for Processing (GDPR / UK GDPR)

We process personal information under the following lawful bases:

Contractual necessity – to provide access to and operate the App and service

Legitimate interests – to improve the service, maintain security, and provide support

Consent – where you choose to opt-in to communications or optional features

Legal obligation – where we are required to retain information for regulatory or tax purposes

Where processing is based on consent, you may withdraw your consent at any time.

Log Data

When you use our App or website, we may collect log data including:

Error reports

Diagnostic information

Performance data

We do not log identifiable personal data within error logs.

Cookies and Tracking

Technologies

Our website uses cookies to enable essential functionality and improve user experience. Cookies may store anonymous identifiers.

For more information, please see our Cookie Policy: INSERT LINK

The App may use similar technologies (e.g. local storage) for authentication and performance purposes.

Third-Party Service Providers

We may employ third-party companies and individuals to:

Facilitate the service

Provide the service on our behalf

Perform service-related functions

Analyse how the service is used

These third parties may have access to personal information only to perform tasks on our behalf and are required not to disclose or use it for any purpose.

Examples include:

Customer support tools

Hosting providers

Analytics services

Data Retention

We retain personal information only for as long as necessary to:

Provide the service

Meet legal, accounting, or reporting requirements

Resolve disputes

Enforce agreements

Typical retention periods include:

Account information – retained while the account remains active

Support enquiries – up to 12 months

Technical logs – up to 90 days

Financial records – up to 7 years (legal requirement)

When information is no longer required, it will be securely deleted or anonymised.

International Data Transfers

Your personal information may be processed and stored outside the United Kingdom. Where this occurs, we will ensure safeguards are in place, such as:

Encryption and secure transfer protocols

UK GDPR standard contractual clauses

Adequacy decisions

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or significant effects on users. If this changes, we will update this Privacy Policy and notify users where required.

Security

We implement industry-standard security measures to protect your data, including:

Encryption of data in transit

Encryption of sensitive data at rest (where applicable)

Secure authentication and access controls (including OAuth 2.0 for supported integrations)

Regular security audits and updates

Access controls limiting employee access to personal data on a need-to-know basis

However, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security. In the event of a data breach that affects your personal data, we will notify you and relevant authoriries within 72 hours where required by law.

We collect and store authentication credentials securely to maintain your connection.

We access financial data including invoices, contacts, transactions, and account settings as authorised by you.

We use this data solely to provide our services to you, such as timesheet management, invoicing, and reporting.

We do not sell or share your financial data with any third parties for marketing purposes.

You may revoke these integrations at any time through your account settings. When you disconnect an integration, we will cease accessing your data from that service, though we may retain historical data necessary for record-keeping and contractual obligations.

Data Retention and Deletion

We retain your personal and financial data for as long as your account is active or as needed to provide you services. Specifically:

Financial records may be retained for up to 7 years to comply with accounting and tax regulations

Active account data is retained while your account remains active

Your Data Rights

Under data protection laws including GDPR, you have the following rights regarding your personal data:

Right to Access: You can request a copy of all personal data we hold about you

Right to Erasure: You can request deletion of your personal data (subject to legal obligations)

Right to Data Portability: You can request your data in a structured, machine-readable format

Right to Withdraw Consent: You can withdraw consent for data processing at any time

Right to Object: You can object to certain types of data processing

To exercise any of these rights, please contact us at info@helloedun.co.uk. We will respond to your request.

Data Security

We implement industry-standard security measures to protect your data, including:

Encryption of data in transit

Encryption of sensitive data at rest

Secure authentication using OAuth 2.0 protocols for third-party integrations

Regular security audits and updates

Access controls limiting employee access to personal data on a need-to-know basis

In the event of a data breach that affects your personal data, we will notify you and relevant authorities within 72 hours as required by applicable law.

Legal Basis for Processing

We process your personal data under the following legal bases:

Legal Obligations: Processing is required to comply with legal and regulatory requirements

Contractual Necessity: Processing is necessary to provide the services you’ve requested

Consent: You have given explicit consent for specific processing activities (e.g., connecting third-party integrations)

Legitimate Interests: Processing is necessary for our legitimate business interests, such as improving our services and preventing fraud

International Data Transfers

Your data may be transferred to and processed in countries outside of your country of residence. We ensure that such transfers comply with applicable data protection laws and that appropriate safeguards are in place to protect your data.

Automated Decision Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Links to Other Sites

The Service may contain links to external websites. We are not responsible for the content or privacy practices of third-party sites and recommend reviewing their privacy policies.

Children’s Privacy

Our service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided personal information, we will delete it immediately. If you believe this may have occured, please contact us.

User Rights (UK GDPR / GDPR)

Depending on your location, you have the following rights relating to your personal information:

The right to access the personal data we hold about you

The right to request correction of inaccurate data

The right to request deletion (“right to be forgotten”)

The right to restrict processing

The right to object to processing based on legitimate interests

The right to data portability

The right to withdraw consent

The right to lodge a complaint with the Information Commissioner’s Office (ICO)

To exercise any of these rights, please contact: info@helloedun.co.uk

App Store / Google Play Requirements

To comply with app store policies:

The App may request access to device storage to save authentication data

The App may request internet access to operate the Service

We do not access:

Photos

Contacts

Precise location

Microphone

Camera

Unless explicitly stated and permission is requested within the App.

Your Choices

You may:

Uninstall the App at any time

Disable cookies in your browser

Request deletion of your account data

If you request account deletion, we will remove personal information unless we are legally required to retain certain records.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page and become effective immediately upon posting.

Contact Us

If you have any questions or concerns regarding this Privacy Policy, please contact:

Email: info@helloedun.co.uk

Service Level Agreement

The Agreement is made between the Supplier & the Customer. The SLA outlines service levels relating to:

Customer support enquiries

Technical support enquiries

Bespoke developments

Bespoke developments and/or Additional services are delivered within agreed milestones but do not correlate to the service level agreement for Existing Services.

Definitions

Customer: the person, firm or company who purchases services from the Supplier.

Services: the services to be provided by the Supplier under the Contract.

Supplier: EDUN LTD with registered company number 13689679.

Business hours: Hours occurring within a normal business day, 08:00 – 18:00 GMT.

Bespoke Developments: Services that are not currently available within the Edun product offering which require specific development for the Customer.

Additional Services: Services that are expressly requested by the Customer to the Supplier that are not currently available from Edun.

Existing Services: Services that currently exist within Edun that are available for Customers to use.

Service Level Agreement

The Supplier shall aim to resolve all support problems for existing services in line with the following conditions.

Tier 1 – Critical Issues:

Critical issues cause complete or partial service outage and affect the customer’s ability to conduct business-critical operations.

Supplier Response Time: 1 business hour from the time of reporting the issue to a representative of the Supplier.

Resolution Time: 4 business hours from the time of acknowledging the issue by the Supplier.

Please note that ‘bespoke developments’ are quoted on independent milestones and do not formulate this SLA. Please refer to your contract for the definition of ‘bespoke development’

Tier 2 – Major Issues:

Major Issues cause significant impairment of service but do not cause a complete service outage.

Response Time: 3 business hours from the time of reporting the issue to a representative of the Supplier.

Resolution Time: 8 business hours from the time of acknowledging the issue by the Supplier.

Please note that ‘bespoke developments’ are quoted on independent milestones and do not formulate this SLA. You will refer to your contract for the definition of ‘bespoke development’

Tier 3 – Minor Issues:

Minor issues do not significantly affect the service but cause minor inconvenience to the customer.

Response Time: 24 business hours from the time of reporting the issue to the Supplier.

Resolution Time: Varying and agreed with the customer independently from the time of acknowledging the issue by our support team.

Please note that ‘bespoke developments’ are quoted on independent milestones and do not formulate this SLA. You will refer to your contract for the definition of ‘bespoke development ‘

The Customer acknowledges that the resolution times refer to the time taken by the Supplier to provide a solution or workaround for the reported issue. These times are subject to change depending on the complexity of the issue, the availability of resources, and any other factors that may affect the resolution time. Where a workaround is available the supplier makes no guarantees additional solutions can be sought but will make reasonable efforts to accommodate this.

The customer acknowledges that data migration complications do not fall within the remit of this service level agreement.

The customer acknowledges that any complications that arise which require input from a third party will affect resolution times from the supplier & our support team will make reasonable effort to communicate this.

Bespoke Developments

The Supplier may (at its sole discretion) offer Bespoke Developments and/or Additional Services to Customers which can be expressly requested by the Customer. The Supplier does not guarantee that all requests will be possible but where they are, these Additional Services will be charged on a pro-rata basis and quoted on individual milestones.

The Customer acknowledges and accepts that when Bespoke Developments and/or Additional Services are created, technical issues may delay the quoted milestones and could also affect the estimated costs.