Word original: Download Privacy Policy (Word)

Finnovator Ltd

For Finnovator.co.uk and the Finnovator SaaS CFO platform

Last updated: 1 September 2026

This Privacy Policy explains how Finnovator Ltd (“Finnovator”, “we”, “us” or “our”) collects, uses, stores and protects personal data when you visit Finnovator.co.uk, use our software-as-a-service platform, connect accounting software, upload financial information (including through Excel or similar files), communicate with us, or receive our technology-enabled CFO services.

Finnovator provides a SaaS platform designed to support CFO, finance and business performance services. The platform may ingest, organise, analyse and present accounting, financial, operational and business information supplied by customers or retrieved from customer-authorised accounting software integrations.

This policy is based on the structure of the privacy notice supplied to us, but has been adapted for Finnovator’s SaaS and CFO-service model. It should be read together with any customer agreement, data processing terms, cookie notice and other supplemental privacy notices that apply to a particular service.

1. Who we are and how to contact us

Finnovator Ltd is responsible for the personal data it processes as a controller where we determine the purposes and means of processing, for example in relation to website visitors, prospective customers, customer contacts, account administration and our own business operations.

Where Finnovator processes personal data contained in a customer’s accounting records, uploaded files or connected systems solely on that customer’s instructions, the customer will generally be the controller and Finnovator will act as a processor. The applicable customer agreement and/or data processing agreement will govern that processing.

Privacy contact: Prashant@finnovator.co.uk

Website: Finnovator.co.uk

Registered office: 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE. Company number 16630713. ICO registration number CSN4881939. VAT GB 522215730.

2. Personal data and business data we may process

“Personal data” means information relating to an identified or identifiable individual. The Finnovator platform also processes business and financial information that may not itself be personal data. Where business or financial records contain information about identifiable individuals, that information is treated as personal data.

Identity and contact data, such as name, job title, company, business email address and telephone number.
Account and authentication data, such as user IDs, login information, access permissions and security-related records.
Customer relationship data, including enquiries, contracts, support requests, service history and communications.
Accounting and financial data imported from customer-authorised accounting software, which may include ledger entries, invoices, bills, payments, bank-account information, payroll-related entries, customer or supplier names and other transaction-level information.
Data uploaded manually by users, including Excel, CSV or similar files containing financial, operational, KPI, budget, forecast or other business information.
Integration data, including identifiers and connection metadata required to connect to third-party accounting or business systems. Where authentication tokens or credentials are used, we seek to handle them using appropriate technical safeguards and do not use them for purposes unrelated to providing the authorised integration.
Platform usage and technical data, such as IP address, browser or device information, log data, timestamps, audit trails, feature usage and diagnostic information.
Analytics and derived data, including KPIs, ratios, forecasts, trends, dashboards, classifications and other outputs generated from customer-provided or integrated data.
Marketing and preference data, including communication preferences and interactions with our website or marketing communications.

3. How we collect information

Directly from you when you register, subscribe, contact us, request a demonstration, enter into a contract, use support services or otherwise communicate with us.
From your organisation, for example where an administrator creates an account for you or provides your business contact details.
From accounting software or other third-party systems that you or your organisation expressly authorise Finnovator to connect to.
From files you or authorised users upload to the platform, including Excel, CSV and other supported formats.
Automatically through the platform, website, server logs, security tooling, cookies and similar technologies.
From service providers and public sources where lawful and relevant to our business operations.

4. How and why we use personal data

Data / activity	Purpose	Typical lawful basis
Business contact and account data	Set up and administer customer and user accounts; provide demonstrations, onboarding, support and contracted services.	Contract; legitimate interests
Accounting, financial and uploaded data	Provide the SaaS CFO platform, dashboards, KPI analysis, reporting, forecasting, data transformation and related CFO services requested by the customer.	Contract where we are controller; customer instructions where we act as processor
Integration and connection data	Establish, maintain, troubleshoot and secure customer-authorised integrations with accounting or other software.	Contract; legitimate interests; processor instructions
Usage, logs and security data	Operate, monitor, secure, troubleshoot and improve the platform; prevent misuse, fraud, unauthorised access and security incidents.	Legitimate interests; legal obligations where applicable
Communications and support data	Respond to enquiries, provide customer support, manage service issues and maintain business records.	Contract; legitimate interests
Billing and commercial data	Manage subscriptions, invoices, payments, renewals, contracts and financial records.	Contract; legal obligations; legitimate interests
Marketing data	Send relevant information about Finnovator products and services and measure engagement, subject to applicable direct-marketing rules.	Consent where required; legitimate interests where permitted
Legal and compliance data	Establish, exercise or defend legal rights; comply with law, regulatory requests, tax, accounting and corporate obligations.	Legal obligations; legitimate interests

5. Accounting software integrations and manual uploads

Finnovator is designed to work with customer-authorised accounting software integrations and with information provided directly by customers. When you connect an accounting system, you instruct Finnovator to retrieve and process the data made available through that integration for the purpose of delivering the Finnovator service.

Where data cannot be obtained through an integration, or where a customer chooses to supplement integrated data, authorised users may upload Excel, CSV or other supported files. Customers are responsible for ensuring that they have the right to provide or connect the data and for configuring appropriate access permissions within their source systems.

Finnovator will not intentionally use customer financial data for unrelated purposes. Access to customer data should be limited to personnel and service providers who require it to operate, support, secure or improve the contracted service, subject to appropriate confidentiality and data-protection obligations.

6. Analytics, automation and AI-enabled functionality

The platform may use rules, calculations, statistical techniques, automation and AI-enabled functionality to organise information, calculate KPIs, identify trends, generate summaries, support forecasts or present insights. These outputs are intended to support finance and CFO decision-making and should be reviewed by appropriately qualified users.

Unless expressly agreed otherwise, Finnovator does not intend automated platform outputs to constitute a decision producing legal or similarly significant effects on an individual without meaningful human involvement. Where customer data is used with third-party AI or model providers, the applicable contractual, security and data-processing arrangements should be documented in Finnovator’s subprocessor information and customer terms.

7. Hosting, security and Google Cloud Platform

Finnovator uses Google Cloud Platform (GCP) infrastructure to host and operate relevant parts of the service. Google Cloud maintains independent security and compliance programmes, including SOC reporting for relevant cloud services. Finnovator’s use of GCP does not, by itself, mean that Finnovator Ltd is independently SOC 2 certified.

We use technical and organisational measures designed to protect information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Depending on the service configuration, these measures may include access controls, authentication, least-privilege permissions, encryption in transit and/or at rest, logging, monitoring, backups, environment segregation, vulnerability management and incident-response procedures.

No internet or cloud service can be guaranteed to be completely secure. Customers should also protect their credentials, manage user access appropriately and promptly notify Finnovator of suspected unauthorised access.

8. Sharing personal data and subprocessors

We may share personal data only where reasonably necessary to provide, operate, secure and support the service, comply with law, protect legal rights or manage our business. Recipients may include:

Cloud hosting and infrastructure providers, including Google Cloud Platform.
Software, security, monitoring, communications, customer-support and professional service providers.
Providers supporting authorised accounting software integrations or related API connectivity.
Payment, billing and subscription service providers where applicable.
Professional advisers such as accountants, auditors, insurers and lawyers.
Regulators, courts, law-enforcement bodies or public authorities where disclosure is required or permitted by law.
A purchaser, investor or successor organisation in connection with a genuine corporate transaction, subject to appropriate safeguards.

Finnovator should maintain a current list of material subprocessors used for customer data and make that information available to customers through its contractual documentation or website. Exact vendor details beyond GCP should be confirmed before publication.

9. International transfers

Some service providers may process information outside the United Kingdom. Where UK personal data is transferred internationally, we will use an appropriate lawful transfer mechanism where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another valid safeguard.

10. Data retention and deletion

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing the service, maintaining appropriate business and security records, resolving disputes and meeting legal, tax, accounting or regulatory obligations.

Customer platform data will be retained in accordance with the applicable customer agreement, service configuration and documented retention or deletion procedures. Following termination, Finnovator will delete or return customer personal data as required by the applicable agreement and data-protection law, subject to legitimate backup cycles and any legal retention requirement.

Where information is irreversibly anonymised so that individuals can no longer be identified, it is no longer personal data and may be retained for analytical, security, service-improvement or statistical purposes.

11. Cookies and website analytics

Finnovator.co.uk may use cookies and similar technologies for essential website functionality, security, preferences and analytics. Where required by law, non-essential cookies will be used only after appropriate consent. A separate cookie notice or consent tool should identify the cookies and analytics technologies actually deployed on the website.

12. Your data protection rights

Depending on the circumstances and applicable law, you may have the right to:

request access to personal data held about you;
request correction of inaccurate or incomplete personal data;
request erasure of personal data;
request restriction of processing;
object to certain processing, including certain direct marketing;
request portability of personal data in applicable circumstances;
withdraw consent where processing is based on consent; and
raise a complaint with the UK Information Commissioner’s Office (ICO).

To exercise a right in relation to data for which Finnovator is the controller, contact Prashant@finnovator.co.uk. Where Finnovator processes data on behalf of a customer, we may need to refer your request to, or assist, the relevant customer as controller.

We may request information reasonably necessary to verify identity and protect personal data from unauthorised disclosure. Data protection rights are subject to statutory conditions and exemptions.

13. Marketing communications

You can opt out of Finnovator marketing communications at any time by using the unsubscribe mechanism provided in the communication or by contacting Prashant@finnovator.co.uk. Service, security, billing and other transactional communications are not marketing and may still be sent where necessary to operate your account or provide the service.

14. Customer responsibilities

Customers are responsible for determining what information they connect to or upload into Finnovator, ensuring they have a lawful basis to do so, providing required privacy information to relevant individuals, and managing their authorised users and permissions. Customers should avoid uploading information that is unnecessary for the intended CFO or finance use case.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Finnovator platform, integrations, legal requirements, security practices or service providers. The current version will be made available on Finnovator.co.uk. Where changes are material, we may provide additional notice to affected customers or users.

16. Further information and complaints

Questions about this Privacy Policy or Finnovator’s handling of personal data should be sent to Prashant@finnovator.co.uk. You also have the right to complain to the Information Commissioner’s Office. We would welcome the opportunity to address your concerns first.