LedgerCapture

Privacy Notice

Version 2026-09-02-3 · Last updated: 2026-09-02-3

This Privacy Notice explains how STERLING ORIGIN LIMITED handles personal data when you use LedgerCapture on a business-to-business basis. Where a signed customer agreement or data processing addendum sets stricter controls, that signed document takes priority.

By acknowledging this notice, you confirm that you have read it. It is not a consent mechanism for ordinary service processing, which is based on contract performance, legitimate interests, and legal obligation where applicable.

1. Who we are

Sterling Origin Limited has appointed a privacy contact to oversee data protection matters. While we are not currently required to appoint a Data Protection Officer under UK GDPR, privacy enquiries can be directed to ledgersupport@sterlingorigin.com.

2. Controller and processor roles

For account, billing, security, and platform operation data, Sterling Origin Limited acts as controller. For project evidence, signatures, and other content your organisation submits about its personnel, contractors, and signers, we generally act as processor on your organisation's instructions. Your organisation remains responsible for providing any required notices to its personnel and signers.

3. Data we collect

  • Identity and account data, such as name, work email, organisation, role, and invitation status.
  • Operational evidence data, such as records, photos, timestamps, signatures, GPS capture metadata, and project context.
  • Billing contact and payment-provider reference data needed to manage package purchases.
  • Device and security data, such as IP address, browser or app build, session metadata, and authentication events.
  • Service diagnostics, such as application performance data, crash reports, and error diagnostics needed for support and reliability.
  • Legal acceptance records, including document version, acceptance type, surface, and timestamp.

4. Why we process data

  • Authenticate users and enforce role-based access boundaries.
  • Create, review, store, export, and audit project records and related evidence.
  • Support invitations, organisation membership, and project assignment.
  • Manage package checkout, recurring billing, receipts, invoices, and payment recovery.
  • Operate the platform securely, investigate incidents, and prevent misuse.
  • Meet contractual, legal, and regulatory obligations where they apply.

5. Legal bases

The summary below describes the main legal bases we rely on for processing personal data as controller. Where we act as processor for your organisation's project data, your organisation determines the lawful basis for that processing.

  • User accounts and workspace access: Contract
  • Billing, receipts, and payment recovery: Contract / Legal obligation
  • Security logging and incident investigation: Legitimate interests
  • Fraud prevention and misuse detection: Legitimate interests
  • Tax, accounting, and audit records: Legal obligation
  • Legal acceptance records: Contract / Legal obligation

6. How data is shared

  • With authorised users inside the same customer organisation according to role permissions.
  • With infrastructure and delivery service providers used to operate the service, including Microsoft Azure, Auth0, SendGrid, Stripe, and Sentry.
  • A current list of sub-processors is available on request from ledgersupport@sterlingorigin.com.
  • With integration partners only when a customer enables that integration.
  • With authorities where disclosure is required by law or valid legal process.

7. International transfers

LedgerCapture is operated on UK-hosted Azure infrastructure for current service environments. Some service providers may handle limited identity, delivery, billing, or diagnostic data outside the UK. Where that happens, we use contractual and operational safeguards appropriate to UK GDPR requirements, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses where appropriate, or transfers to countries benefiting from UK adequacy regulations.

8. Retention and deletion

  • Workspace records are retained for the active subscription and any agreed exit period.
  • Project export ZIP files in cloud storage are automatically deleted after ninety days.
  • Export download links expire after fifteen minutes unless otherwise stated in-product.
  • Legal acceptance evidence is retained to demonstrate contractual acceptance, compliance obligations, and the document version acknowledged.
  • Billing and audit records may be retained longer where required for tax, accounting, or dispute purposes.

Where deletion is requested and legally permitted, we remove or anonymise data in line with active retention, legal-hold, and contractual constraints.

9. Your rights

Subject to applicable law, you may request:

  • Access to your personal data.
  • Correction of inaccurate data.
  • Deletion or restriction in permitted circumstances.
  • Data portability where applicable.
  • Objection to processing based on legitimate interests.

Submit requests to ledgersupport@sterlingorigin.com with the subject line Privacy request. We aim to respond within one calendar month, extendable by up to two further months where requests are complex or numerous, and we will tell you if an extension is needed.

If you are raising a request about data your employer or customer organisation controls, we may need to refer the request to that organisation as controller.

10. Security

We use layered controls such as encryption in transit, managed access controls, tenant isolation, and audit logging. We continually review and improve our security, privacy, and resilience controls as the platform evolves.

11. Cookies and telemetry

LedgerCapture uses essential session cookies and application performance data, crash reports, and error diagnostics needed to keep the service running. If optional analytics or non-essential cookies are introduced, we will update this notice and provide clear controls.

12. Children

LedgerCapture is a business service and is not directed at children. We do not knowingly collect personal data from children.

13. Policy updates

We may update this notice as the service evolves. Material changes will be published on this page with a revised version and last-updated date. Continued use after a material change may require renewed acknowledgement through in-product flows.

Related commercial terms are set out in our Business Terms & Conditions.

14. Complaints

If you have a concern, contact us first at ledgersupport@sterlingorigin.com. You can also raise a complaint with the UK Information Commissioner's Office (ICO) through its complaints page.