Privacy Policy

Effective date: 3 September 2026

This Privacy Policy explains how AKSA Corp OÜ, operating the IQounting platform ("IQounting", "we", "us" or "our"), collects, uses, stores and otherwise processes personal data.

AKSA Corp OÜ is an Estonian private limited company registered in the Estonian Commercial Register under registry code 12610057, with its registered address at:

Juhkentali tn 8
10132 Tallinn
Estonia

Email: support@iqounting.com

This Privacy Policy applies to the IQounting website, platform, applications and related services (collectively, the "Service").

IQounting is a business-to-business service intended for companies, entrepreneurs, accounting professionals and other professional users.

1. Our Roles Under Data Protection Law

Depending on the circumstances, AKSA Corp OÜ may process personal data either as a controller or as a processor under Regulation (EU) 2016/679 ("GDPR").

1.1 IQounting as Controller

IQounting generally acts as a controller where we determine the purposes and means of processing, including in relation to:

  • account registration;
  • user authentication;
  • subscription and billing administration;
  • customer relationship management;
  • website operation;
  • Service security;
  • fraud and abuse prevention;
  • customer support;
  • Service administration;
  • legal compliance; and
  • product and Service improvement.

1.2 IQounting as Processor

Where a business Customer uploads, imports, creates or otherwise provides personal data through the Service for accounting, invoicing, document processing or related business purposes, the Customer generally acts as the controller and IQounting acts as a processor on behalf of that Customer.

Such processing is additionally governed by the IQounting Data Processing Agreement ("DPA").

Customer-controlled information may include personal data contained in:

  • outgoing invoices;
  • incoming bills;
  • receipts;
  • supplier records;
  • customer records;
  • payment information;
  • transaction descriptions;
  • accounting records;
  • uploaded documents; and
  • related business records.

The Customer is responsible for determining the lawful basis and purposes for processing Customer-controlled personal data.

2. Personal Data We Process

Depending on how IQounting is used, we may process the following categories of personal data.

2.1 Account and Identity Data

This may include:

  • name;
  • business email address;
  • company;
  • role or job title;
  • account identifier;
  • authentication information;
  • language;
  • account preferences;
  • workspace membership; and
  • user permissions.

2.2 Company and Workspace Information

This may include:

  • company name;
  • company registration information;
  • VAT number;
  • business address;
  • contact details;
  • workspace settings;
  • user roles;
  • authorised users; and
  • related company administration information.

Information relating solely to a legal entity is generally not personal data under the GDPR. However, company records may contain information identifying natural persons.

2.3 Customer and Supplier Data

The Service may contain information about Customers' customers, suppliers and other business contacts, including:

  • names;
  • business email addresses;
  • telephone numbers;
  • addresses;
  • company affiliations;
  • VAT or registration information;
  • invoice information;
  • payment information; and
  • transaction information.

Such information is normally processed by IQounting on behalf of the relevant Customer.

2.4 Invoice and Accounting Data

IQounting may process information contained in invoices, bills and other accounting records, including:

  • invoice numbers;
  • invoice dates;
  • customer information;
  • supplier information;
  • goods or service descriptions;
  • amounts;
  • VAT information;
  • payment information;
  • bank account information;
  • payment references;
  • due dates;
  • payment status; and
  • other accounting information.

2.5 Uploaded Documents

Users may upload bills, invoices, receipts and other business documents.

Uploaded documents may contain personal data concerning:

  • customers;
  • suppliers;
  • sole traders;
  • employees;
  • contractors;
  • company representatives;
  • business contacts; and
  • other natural persons.

The Customer determines which documents are submitted to IQounting and is responsible for ensuring that such processing is lawful.

2.6 AI and OCR Processing Data

IQounting may use artificial intelligence, machine learning, optical character recognition ("OCR") and related automated technologies to process documents and accounting information.

Information submitted to these features may include document contents and data required to:

  • recognise documents;
  • extract information;
  • classify information;
  • structure accounting records;
  • identify potential duplicates or inconsistencies; and
  • assist the user with accounting workflows.

Further information is available in our AI Processing Disclosure.

2.7 Billing Information

Where paid services are used, we may process:

  • company billing information;
  • billing contact details;
  • VAT information;
  • subscription information;
  • payment status;
  • transaction references; and
  • related financial administration information.

Payment credentials may be processed directly by a third-party payment provider rather than stored by IQounting.

2.8 Usage and Technical Information

When users access IQounting, we may automatically process information such as:

  • IP address;
  • device information;
  • browser type;
  • operating system;
  • timestamps;
  • authentication events;
  • pages or features accessed;
  • application events;
  • security events;
  • session information;
  • technical diagnostics; and
  • error information.

2.9 Communications and Support

If you contact IQounting, we may process:

  • name;
  • email address;
  • company information;
  • correspondence;
  • support messages;
  • attachments; and
  • information reasonably necessary to resolve the request.

3. Why We Process Personal Data

Where IQounting acts as a controller, personal data may be processed for the following purposes.

3.1 Providing the Service

We process information necessary to:

  • create accounts;
  • authenticate users;
  • provide company workspaces;
  • deliver features;
  • maintain user settings; and
  • provide the Service.

The applicable legal basis may include Article 6(1)(b) GDPR where processing is necessary for performance of a contract.

Where an individual acts as an employee, representative or authorised user of a Customer rather than as the contracting party, processing may be based on our legitimate interest in providing and administering the Service for that Customer.

3.2 Account and Workspace Administration

We process information to:

  • maintain user accounts;
  • administer companies and workspaces;
  • maintain roles and permissions;
  • authenticate users;
  • manage access rights; and
  • operate account settings.

The applicable legal basis is contractual necessity and/or our legitimate interest in operating the Service.

3.3 Billing and Financial Administration

We process billing information to:

  • administer subscriptions;
  • receive payments;
  • issue invoices;
  • maintain accounting records; and
  • meet tax and financial reporting obligations.

The applicable legal bases include contractual necessity and compliance with legal obligations.

3.4 Security and Abuse Prevention

We may process account, authentication and technical information to:

  • prevent unauthorised access;
  • protect accounts;
  • investigate suspicious activity;
  • identify abuse;
  • protect data;
  • protect the Service; and
  • maintain cybersecurity.

The applicable legal basis is generally our legitimate interest in maintaining a secure Service and, where applicable, compliance with legal obligations.

3.5 Customer Support

We process information needed to respond to:

  • support requests;
  • account issues;
  • technical questions;
  • privacy requests; and
  • Service enquiries.

The applicable legal basis is contractual necessity and/or legitimate interests.

3.6 Service Improvement

We may process technical and usage information to:

  • diagnose errors;
  • improve performance;
  • improve usability;
  • understand feature usage;
  • improve security;
  • develop new functionality; and
  • maintain Service quality.

Where appropriate, we use aggregated, anonymised or minimised information.

Where consent is legally required for a particular technology, processing will be based on consent.

4. Customer-Controlled Processing

Where IQounting acts as a processor, Customer Personal Data is processed only:

  • to provide the Service;
  • according to documented Customer instructions;
  • as provided in the applicable agreement and DPA; or
  • where processing is required by applicable law.

IQounting does not independently determine the Customer's underlying purposes for processing invoices, accounting documents, customer records or supplier records.

A person seeking to exercise rights concerning Customer-controlled data should normally contact the relevant Customer.

5. Artificial Intelligence and Automated Processing

IQounting uses automated technologies to assist with accounting workflows.

Depending on available functionality, AI-assisted processing may include:

  • document recognition;
  • OCR;
  • invoice field extraction;
  • supplier identification;
  • customer identification;
  • date extraction;
  • amount extraction;
  • VAT information extraction;
  • payment information extraction;
  • document classification;
  • suggested categorisation;
  • duplicate detection;
  • inconsistency detection;
  • transformation of documents into structured records; and
  • other accounting workflow assistance.

AI-generated or automatically extracted information may contain errors.

IQounting is designed to support human review. AI-generated accounting information should not be treated as automatically authoritative.

Users are responsible for reviewing relevant information before approving, exporting, transmitting or relying on it for accounting, payment, tax, VAT, legal or other material purposes.

IQounting is not designed to make decisions concerning natural persons that produce legal effects or similarly significant effects without appropriate legal basis and safeguards.

More information is available in our AI Processing Disclosure.

6. How We Share Personal Data

IQounting may use service providers where reasonably necessary to provide and operate the Service.

These providers may include:

  • cloud infrastructure providers;
  • hosting providers;
  • database providers;
  • storage providers;
  • authentication providers;
  • email delivery providers;
  • payment providers;
  • AI and OCR providers;
  • security providers;
  • monitoring providers;
  • analytics providers; and
  • integration providers.

Where a provider processes Customer Personal Data on behalf of IQounting, it is treated as a Subprocessor where required under Data Protection Law.

The categories of Subprocessors we may engage are described in our Subprocessors section, and information about relevant Subprocessors is available on request.

We may also disclose personal data:

  • where required by applicable law;
  • in response to a lawful request from a competent authority;
  • to establish, exercise or defend legal claims;
  • where necessary to protect the Service or its users; or
  • in connection with a corporate transaction such as a merger, restructuring, acquisition or sale of assets, subject to applicable safeguards.

IQounting does not sell personal data.

7. International Data Transfers

We seek to use EEA-based processing or appropriate European data protection safeguards where reasonably possible.

Some service providers may nevertheless process information outside the European Economic Area.

Where a transfer outside the EEA requires safeguards under Chapter V GDPR, IQounting may rely on:

  • a European Commission adequacy decision;
  • Standard Contractual Clauses approved by the European Commission;
  • another lawful transfer mechanism; and
  • supplementary safeguards where appropriate.

Relevant processing locations and transfer mechanisms are described in the Subprocessors section where applicable.

8. Data Retention

Personal data is retained only for as long as reasonably necessary for the purposes for which it is processed and as required under applicable law.

Retention periods depend on the type of information and purpose of processing.

Generally:

  • account information may be retained while an account is active and for a reasonable period following termination;
  • Customer Personal Data is retained according to Customer use of the Service, contractual arrangements, deletion functionality and the DPA;
  • billing and transaction information may be retained for periods required by accounting, tax and corporate law;
  • security and technical records may be retained for a reasonable period for security, reliability and incident investigation;
  • support communications may be retained where needed for customer support and legal purposes; and
  • legal acceptance or consent records may be retained where necessary to demonstrate compliance.

When information is no longer required, we delete, anonymise or otherwise securely dispose of it, subject to applicable law and normal backup lifecycle processes.

9. Security

IQounting uses technical and organisational measures designed to protect personal data against:

  • unauthorised access;
  • unlawful disclosure;
  • accidental loss;
  • unlawful destruction;
  • alteration; and
  • other unlawful processing.

Measures may include, where appropriate:

  • encrypted network communications;
  • access controls;
  • authentication measures;
  • role-based permissions;
  • infrastructure protection;
  • logging and monitoring;
  • backup and recovery controls;
  • secure development practices;
  • vulnerability management;
  • incident response procedures; and
  • data minimisation.

Security measures may evolve as the Service develops.

No internet-connected system can guarantee absolute security.

Customers are responsible for protecting their credentials and assigning appropriate user permissions.

10. Personal Data Breaches

IQounting maintains procedures for responding to Personal Data Breaches.

Where IQounting acts as controller, notifications will be made where required by applicable Data Protection Law.

Where IQounting acts as processor, we will notify the relevant Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data, in accordance with the DPA.

11. Data Protection Rights

Subject to applicable legal conditions and limitations, individuals may have rights including:

  • access to personal data;
  • correction of inaccurate personal data;
  • deletion;
  • restriction of processing;
  • objection to certain processing;
  • data portability;
  • withdrawal of consent where processing is based on consent; and
  • rights concerning certain automated decisions.

Where IQounting acts as controller, requests may be sent to:

support@iqounting.com

We may request information reasonably necessary to verify the identity and authority of the requester.

Where IQounting acts as processor for a Customer, the request should normally be directed to that Customer.

12. Right to Object

Where processing is based on legitimate interests, an individual may have the right to object based on their particular circumstances.

We will stop the relevant processing unless there are compelling legitimate grounds for continuing or processing is necessary to establish, exercise or defend legal claims.

14. Supervisory Authority

Individuals have the right to lodge a complaint with a competent supervisory authority.

AKSA Corp OÜ is established in Estonia.

The Estonian supervisory authority is:

Andmekaitse Inspektsioon
Estonian Data Protection Inspectorate
Tatari 39
10134 Tallinn
Estonia

An individual may also have the right to contact the supervisory authority in another EU or EEA Member State where applicable.

15. Cookies and Similar Technologies

IQounting may use cookies, local storage and similar technologies.

Strictly necessary technologies may be used for purposes such as:

  • authentication;
  • security;
  • session management;
  • privacy choices; and
  • essential Service functionality.

Optional technologies will be used in accordance with applicable consent requirements.

Further information is available in our Cookie Policy and Cookie Settings.

16. Third-Party Services

IQounting may provide integrations with third-party services.

Where a Customer chooses to connect a third-party service, information may be exchanged with that service according to the Customer's instructions.

Third parties that independently determine their own processing purposes are responsible for their own privacy practices.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

  • Service changes;
  • new functionality;
  • changes to providers;
  • legal or regulatory developments;
  • security requirements; or
  • changes in processing activities.

The current version will be published with an updated effective date.

Where a change materially affects the processing of personal data, additional notice may be provided where appropriate or required.

18. Contact

AKSA Corp OÜ
Registry code: 12610057
Juhkentali tn 8
10132 Tallinn
Estonia

Email: support@iqounting.com

Privacy and data protection enquiries may be sent to the above address.