Privacy Notice
At BrightWorkpapers, we are committed to protecting your privacy and this Privacy Notice sets out how we process your personal data, and applies to all Services offered by us.
Version 1.0: This notice was last updated June 2026.
1. Who We Are
BrightWorkpapers is part of the Bright Software Group of companies. For the purposes of this notice, BrightWorkpapers (“we”, “us”, “our”) means:
• MyWorkpapers Ltd (Reg. in England and Wales: 08631892)
• MyWorkpapers Group Limited (Reg. in England and Wales: 12062592)
• MyWorkpapers Australia Pty Ltd (Reg. in Australia: 136 582 888)
BrightWorkpapers provides cloud-based workpaper and practice management software (“Services“) to accounting firms, practices, and their clients across the United Kingdom and Australia.
For broader information about the Bright Software Group and its group-level privacy practices, please see the Bright Group Privacy Notice.
2. Understanding Our Privacy Notice
In full compliance with our obligations under the UK General Data Protection Regulation (“UK GDPR“) and the Data Protection Act 2018, the purpose of this notice is to provide you with full transparency about how BrightWorkpapers collects and processes your personal data when you browse our website and use our Services, or otherwise provide personal data to us. This also includes detailing your rights under the UK GDPR.
This notice applies where you have, directly or indirectly, provided us with your personal data through any of the methods of collection listed below, and explains how and why we process that data according to the required legal bases.
Where we also process the personal data of individuals in the European Economic Area (“EEA“), EU GDPR may additionally apply. Our primary supervisory authority is the Information Commissioner’s Office (“ICO“). Australian users may also have rights under the Privacy Act 1988 (Cth).
It is important that you read and understand this Privacy Notice so that you are fully aware of how and why we are using your data.
3. Data Controller / Data Processor
BrightWorkpapers clients and client users
BrightWorkpapers shall be the Data Controller of information provided to us about a client purchasing our Services, for the purposes of maintaining any contract of engagement and subsequent billing.
BrightWorkpapers shall be the Data Processor of client accounting, workpaper and practice management data, and the personal data of your employees that you provide to us through our Services. You shall remain the Data Controller with responsibility for that data. BrightWorkpapers will process this personal data in accordance with the terms of this Privacy Notice and the Terms & Conditions currently applicable to the Service or Services we supply.
If you are using BrightWorkpapers Services as an employee or end user
Your employer or the contracting firm shall remain the Data Controller of the personal information you have provided to them. They will have their own associated Privacy Notice and will have appointed BrightWorkpapers as a subprocessor.
BrightWorkpapers‘s Privacy Notice sets out how we process your data on behalf of your employer or firm and the rights that you have in relation to that information.
4. Personal Data We Collect
In the following situations, we will collect the listed personal data:
• When you purchase or register to use our Services. This may include your name, business name, address, email address, telephone number, billing and payment information, business registered number and/or IP address.
• When you contact us with a support query, either through phone, or email. This will primarily include your name and contact details, and/or IP address.
• When you request or download a demo or trial of our Services, attend a webinar, sign up to our mailing list, submit an online query, complete any surveys, provide a testimonial, or enter any competition. Details may include your name, business name, address, email address, telephone number and/or IP address.
• When you interact with us using social media. This may include name, social media handle, email address and/or business name.
• When you apply for a job posting. This may include your curriculum vitae, details of qualifications and experience, and any other application detail you have provided.
• When you or your organisation provide services to us. In this context, we may collect basic personal data about you (mainly professional contact details).
• When third parties provide us with personal data about you. This may happen where we work with a business partner that has an existing relationship with you, or where personal details are provided to us by marketing companies.
• When you contact us by telephone or other verbal communication platform — voice recordings may be made for training and quality purposes. Call recordings are kept for up to three (3) months unless specifically stated otherwise.[HM1.1][GS1.2]
Where applicable, BrightWorkpapers may also collect banking details (account name, sort code, account number) from Sole Traders and Limited Liability Partnerships solely for the purposes of invoicing and payment processing. This data is processed on the basis of contract performance and legal obligation.
At BrightWorkpapers, we do not process any special categories of personal data as defined under the UK GDPR unless specifically required to do so (for example, health data provided in the context of reasonable adjustments for job applicants). In such cases, we will notify you separately and rely on an appropriate legal basis. Additionally, we do not knowingly collect any personal data from anyone under the age of 16. If we learn that we have collected personal data from a person under the age of 16 without verification of parental consent, we will endeavour to delete that information as quickly as possible.
Providing us with information about others
Should you give us personal data about someone else, you are responsible for ensuring that you comply with all applicable data protection laws. In advance of submitting any information to us, you should have notified them that their data is shared with BrightWorkpapers and drawn their attention to this Privacy Notice.
5. How We Use Your Data
We undertake to design our Services in such a way as to minimise the use of personal data. For any processing, we must have a valid lawful basis that is specific and necessary. We will not use your information for any other purpose. Please be aware that, should you refuse to provide us with certain mandatory information, it may not be possible for us to provide that Service to you.
Contractual Necessity
We will process data where it is necessary to enter into a contract with you for provision of a BrightWorkpapers Service and to perform our obligations under that contract. Examples include:
• Processing and reviewing applications for your use of the requested Service;
• Providing the information and Service that you have requested from us;
• Managing and maintaining our relationship with you and for ongoing client service;
• Providing software support for our Service and managing our relationship with you, whether by telephone, email, or other online support mechanisms;
• Managing software usage and ensuring compliance with the terms of your contract with us;
• Processing your payments to us and/or managing payments you make through our Service;
• Sending essential communications to you about the Service.
Legal Obligation
When you use a BrightWorkpapers Service, we are required by law to collect and process certain personal information about you. Examples include:
• Confirming your identity and helping to protect against abuse and fraud;
• Performing checks on our Services and monitoring transactions for the purpose of preventing and detecting crime, and to comply with the laws relating to money laundering, fraud, terrorist financing, bribery, and corruption;
• Sharing information with police, law enforcement, tax authorities or other government and fraud prevention agencies where we have a legal requirement to do so, including reporting suspicious activity and complying with production and court orders (including to the National Crime Agency where required under anti-money laundering legislation);
• Delivering essential communications to Service users, including revised disclosures and/or terms and conditions;
• Investigating and resolving complaints or actions, where we may need to exercise or defend our legal rights or uphold your rights under law;
• Maintaining financial records in compliance with our obligations under the Finance Act 2008 and associated tax legislation.
Legitimate Interest
We will process your personal data where it is in our legitimate interests to do so, and without prejudicing your interests or fundamental rights and freedoms. We have conducted Legitimate Interests Assessments in relation to such processing. Examples include:
• Providing you with updates about BrightWorkpapers Services and functionality, including product developments, new features, essential maintenance, upgrades, and releases;
• Assisting in our sales cycle for the onboarding of new clients;
• Analysing your data so that we can administer, support, improve and develop our business, client service and features of the Service;
• Improving your use and experience of BrightWorkpapers, including gathering feedback, tracking interactions with our Service, and performing research and trend analysis;
• Recording and monitoring calls to our telephone and online help facilities;
• Using your personal information in an anonymised and aggregated form to create content such as industry reports, blog posts, and webinars;
• Conducting our internal recruitment processes;
• Where you are an existing client of BrightWorkpapers or any member of the Bright Software Group, we may send direct marketing messages to you from BrightWorkpapers or any of its Group companies, as set out in the Emails from Us section below.
Consent
Where we have your explicit consent, we may use your information for the following purposes. You will always have the option to opt out. Examples include:
• Receiving requested email communications from us;
• Marketing new products, features, or Services;
• Inviting you to provide answers to a questionnaire, research, or survey, or to enter any competition;
• Delivering invitations to events including webinars, seminars, or videos.
We do not employ any solely automated decision-making processes in relation to your personal data.
6. Data Location
BrightWorkpapers stores your data within the European Union (EU) in secure data centre facilities meeting the strictest security standards and in compliance with the UK GDPR. Australian client data is stored within Australia.
Where we use third-party service providers, some of these may be located outside the EU or Australia. [Please see our list of Subprocessors detailing who we use, what purpose we use them for, where they store the data we share with them, and the adequacy mechanism(s) we rely on to ensure compliance with data protection requirements.] International [HM2.1][GS2.2]transfers from the UK are protected by appropriate safeguards including UK International Data Transfer Agreements (“IDTAs”) or equivalent Standard Contractual Clauses approved by the ICO, or by transferring only to countries assessed by the ICO as providing adequate protection.
7. Data Retention
We will retain your personal data for as long as we have a relationship with you and for a period of time afterwards where we have an ongoing business need to retain it, in accordance with our data retention policies and practices.
We will maintain a record of our Service customers to meet our legal and regulatory business requirements, including for the purpose of fraud prevention, for up to six (6) years following discontinuation of the Service.
Your data that we use for marketing purposes will be kept until you notify us that you no longer wish to receive such information. The option to opt-out of marketing messages is available on all related correspondence from us.
To ensure continuity and transparency in our recruitment campaigns, all applicant details will be kept after the end of the recruitment process for at most six (6) months.
8. Emails from Us
We will contact you regarding purchases (such as invoices and renewal notifications) as well as emails relating to essential software maintenance, including upgrades and releases, where applicable. We may contact you for this purpose by SMS, WhatsApp or email. These “servicing messages” will be delivered under the legal basis of Legitimate Interests and you cannot unsubscribe from them unless disengaging with our Service(s).
We may contact clients and prospective clients with additional “marketing messages”, such as free webinars, special offers and newsletters, where you have explicitly opted in to receive this information or where we have a legitimate interest to do so. You will always have the ability to unsubscribe from these communications at any time by clicking the “unsubscribe” link in those messages or by contacting us at privacy@brightsg.com.
9. Disclosure and Sharing of Your Data
In the following circumstances, we may send your personal data to other parties:
• Where we have obtained your express consent to share that information;
• Where we need to share information within the BrightWorkpapers group of companies or the wider Bright Software Group to provide a Service to you, whether paid or unpaid, or for marketing purposes where it is in our legitimate interests to do so;
• Where we need to send the information to others who work on behalf of BrightWorkpapers to provide a Service to you;
• Where your actions violate the terms of our Service Terms & Conditions;
• Where BrightWorkpapers is subject to a takeover or merger, in which case the information will be disclosed to the new owners on the understanding that they will protect the information and use it only in the same way as previously disclosed. We will notify affected individuals and ensure such transfers comply with UK GDPR;
• Where we must respond to court orders and any other legitimate request made by relevant authorities, including the National Crime Agency, police, tax authorities, and fraud prevention agencies.
We will not sell, trade, or rent any personal data to any other third party not connected with BrightWorkpapers or the Bright Software Group, or not part of the normal operation of the Service we provide to you. We limit access to personal information only to those employees who need access to that data as part of our providing our Services to you.
10. Measuring Our Visitors
We measure visitors to our website using Google Analytics. This records how you arrived at our site, what pages you view, and some basic information about your computer. The information we record is anonymous — we do not know who you are, only that you have visited our site — and we use this to help make our website better. You can learn more about Google Analytics, or opt out if you wish.
11. Use of Cookies
Cookies are small text files that are placed on your computer by websites that you visit. Cookies help make a website work and can provide information to us about how our users interact with our online Services, to help us improve the Service.
For full details of the cookies we use and what they do, please view our Cookie Policy.
12. Payments
We never store your credit or debit card details on our systems. Where such information is provided, it is passed directly to our payment service provider solely for the purpose of processing the payments you make via our Service.
13. Data Files
BrightWorkpapers has no control over the authority, quality or safety of the data you input into our Service. You are responsible for the accuracy and completeness of your records.
Where applicable, you are responsible for keeping your user details and any passwords confidential. Our staff have no access to passwords, which are stored encrypted on our Service. We will never ask you for your password.
You acknowledge that, apart from data format validation checks, we do not monitor, edit, or review whether the data you enter into the Service is accurate.
You can edit your stored data at any time by signing into your Service account and making any necessary changes. We reserve the right to delete any data that is deemed out of date or no longer required, in line with applicable data protection legislation and/or our data retention schedule, or where you cease to be a contracted user of that Service.
14. Client Snapshots / Backups
Occasionally, to resolve a client query, it may be necessary for us to request a backup of your data file or workpaper-related information. We are mindful that this information may contain sensitive personal data, and we take numerous steps to ensure and maintain the security of this data.
Data received by us is processed only for the purposes of resolving your query and is handled by suitably qualified BrightWorkpapers staff. Your backup will never be shared externally without your prior approval. Such data will be retained for the minimum amount of time necessary to resolve the support issue.
15. Security
The security of your data is of the utmost importance to us at BrightWorkpapers. We have a number of technical and organisational measures in place to protect against unauthorised access, disclosure, loss, misuse or malicious alteration of your personal information.
For further details of the security measures we have implemented, please see the Security section of the Bright Software Group website.
Whilst we undertake to maintain the highest possible levels of security practicable to protect your data, no system or storage technology can be guaranteed to be 100% secure. Any transmission of data over the internet is at your own risk.
16. Your Rights
Under the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
• Access to your personal data – You can confirm whether we are processing your personal data and obtain a copy of that data by accessing the Service for which you hold an account, or by contacting us.
• Right to change or withdraw your consent – Where you have given your consent to us to process your data, you may withdraw that consent at any time by contacting us. If you no longer wish to be contacted for marketing purposes, please contact us or click “unsubscribe” in any marketing message.
• Right to rectification – If you need to update incorrect information we hold about you, please log in to your Service account to update your personal data, or contact us.
• Right to erasure – You are free to request deletion of your data at any point, through functionality directly provided by our Service, or by contacting us, subject to any legal obligations we have to retain it.
• Right to data portability – You may request that we provide you with the personal data that we hold about you in a structured, commonly used, machine-readable format, or ask us to send such personal data to another Data Controller. Please contact us if this is the case.
• Right to object – You may object to our processing of your personal data at any time where we rely on legitimate interests or where processing is for direct marketing purposes (including profiling). Where you object to direct marketing, we will stop processing immediately. Please contact us if you wish to exercise this right.
• Right to restrict processing – You can ask us to restrict the processing of the personal data we hold about you in certain circumstances — for example, where you contest its accuracy or where you have objected to processing. Please contact us if this is the case.
• Automated decision-making – You have the right not to be subject to solely automated decision-making, including profiling, that produces legal or similarly significant effects. BrightWorkpapers does not currently employ such processes.
• Making a complaint – If you wish to raise a complaint about how we process your personal data, please contact us in the first instance and we will investigate the matter.
If you are not satisfied with our response, or believe our processing of your personal data is not in accordance with applicable law, you can raise a concern with the UK Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113. Jersey residents may contact the Jersey Office of the Information Commissioner. Guernsey residents may contact the Office of the Data Protection Authority.
We may need to request specific information from you to help us confirm your identity before we respond to your request. This is a security measure to ensure personal data is not disclosed to any person who has no right to receive it. We try to respond to all legitimate requests within one month. Occasionally, where your request is particularly complex or you have made multiple requests, it may take us longer — in such cases, we will notify you within one month and keep you updated.
17. Updates to Our Privacy Notice
BrightWorkpapers may modify or update the content of this Privacy Notice from time to time to reflect changes in our business and/or in line with continuing or improving industry best practice, or following guidance from the ICO. We will post any changes on our website, updating the version and date, so you are always aware of what information we collect, how we use it, and under what circumstances we may share or disclose it. We recommend checking this Privacy Notice on a regular basis.
18. Contacting Us
If you have any queries relating to this Privacy Notice or BrightWorkpapers’s use of your data, please contact our Privacy Officer:
MyWorkpapers Ltd
3 Shortlands, London, United Kingdom, W6 8DA
Email: privacy@brightsg.com
Tel: +44 (0)20 3519 9104
Website: myworkpapers.com/uk
Please note that telephone calls to BrightWorkpapers may be recorded for monitoring, training and security purposes.
