What we hold, why we hold it, and how to get it back.

Who is responsible

Aratun is operated by Taxten Bilişim Teknolojileri A.Ş. The UK entity, its registered number and its registered address are being confirmed and will be named here before launch. For any question in this notice, write to hello@aratun.com.

What we collect

Account details. Your name, work email, telephone number, company name and the password hash for your login.

Your ledger. The financial records you enter or we read from your documents: invoices, receipts, bank lines, contacts, filings and the images of the documents themselves. This is your data. We hold it to run the service for you.

Enquiries. If you fill in a form on this site we keep your name, email, company, country and message so that we can reply.

Technical data. IP address, browser and device type, and the pages you opened. We use this to keep the service running and secure.

Why we are allowed to hold it

• To perform our contract with you: your account, your ledger, and support.
• Our legitimate interests: keeping the service secure, preventing fraud, and answering an enquiry you sent us.
• A legal obligation: tax and accounting records we or you must keep, and information a tax authority requires.
• Your consent: optional analytics, and marketing email. You can withdraw it at any time.

Who else sees it

• The tax authority you file to, and only the data that filing requires. In the United Kingdom, HMRC through the Making Tax Digital API.
• Your trading partners, where you send them a document through an e-invoicing network.
• Our processors: hosting, error monitoring, email delivery and payment processing. Each is under a written contract that allows them to act only on our instructions.
• Nobody else. We do not sell your data and we do not use your ledger to train a model for anyone else.

Where it is held

Data is hosted in the United Kingdom or the European Economic Area. Where a processor is outside that area, the transfer is covered by the UK International Data Transfer Agreement or the equivalent safeguard.

How long we keep it

• Your ledger: for as long as you have an account, and then for the statutory record-keeping period — six years in the United Kingdom, ten years in Germany — unless you ask us to delete it sooner and no law requires us to keep it.
• Enquiries: two years from your last contact with us.
• Technical logs: ninety days.

Your rights

You can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or stop a particular use, and ask for it in a portable format. Write to hello@aratun.com and we will answer inside one month.

If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first.

Security

Data is encrypted in transit and at rest. Access inside our team is limited to the people who need it, and every access to a customer ledger is logged. If a breach is likely to put you at risk we will tell you and the ICO within the statutory deadline.

Changes

If we change this notice we will change the date at the top and, where the change matters, tell you by email before it takes effect.