The Process Partners Group Ltd — Last updated: 23 June 2026
The Process Partners Group Ltd (“we”, “our”, “us”) is a company registered in England and Wales. We provide business process and AI consultancy services, and we operate Pablo, an AI-assisted finance tool for UK small and medium businesses.
For questions about this policy or how we handle your data, contact us at: privacy@theprocesspartners.com
If you use Pablo, we process the following data to provide the service:
Financial and accounting data — invoices, transactions, expenses, bank balances, and other financial records from your connected accounting software (currently Xero) and bank accounts (via open banking). Lawful basis: contract (we need this data to provide the service you signed up for).
HMRC credentials and submissions — OAuth tokens for your HMRC account, VAT return drafts, and submission records. Used solely to prepare and submit your Making Tax Digital returns with your authorisation and your accountant’s sign-off. Lawful basis: contract.
Company information — company name, VAT registration number, accounting year end, and other configuration you provide at setup. Lawful basis: contract.
User account data — name, email address, and role (owner, admin, accountant). Used to manage access to your account. Lawful basis: contract.
Accountant information — name, email address, and firm of your nominated accountant, used to send sign-off requests for HMRC submissions. Lawful basis: contract.
Usage and audit data — a log of every action Pablo takes on your behalf (syncs, alerts, submissions, chat sessions). Retained as a tamper-evident audit trail. UK HMRC requires 6-year retention for VAT records. Lawful basis: legal obligation and contract.
Contact and enquiry data — if you fill in a form or email us, we collect your name, email address, and the content of your message. Used to respond to your enquiry. Lawful basis: legitimate interests.
Technical data — IP address, browser type, and device information collected automatically when you visit our site. Used to keep the site secure and functioning. Lawful basis: legitimate interests. We do not currently use analytics or tracking cookies beyond what is strictly necessary.
We do not sell your data. We share it only with the sub-processors needed to operate our services. All sub-processors below process data in the UK.
| Sub-processor | Role | Location |
|---|---|---|
| Amazon Web Services (AWS Bedrock) | AI processing (Claude models hosted on AWS) | UK (London region) |
| Supabase Inc | Database hosting and authentication | UK (London region) |
| Vercel Inc | Application hosting | UK (London region) |
| Resend Inc | Transactional email delivery | UK (London region) |
| HMRC | VAT return submission (on your instruction) | UK |
| Your accounting platform (e.g. Xero) | Data retrieval via API with your authorisation | Subject to their own privacy policy |
| Your bank (via open banking) | Balance and transaction retrieval with your authorisation | Subject to their own privacy policy |
Your nominated accountant receives HMRC submission drafts for sign-off. This is part of the service and requires your accountant’s email address.
We will disclose data to law enforcement or regulatory bodies where we are legally required to do so.
| Data type | Retention period |
|---|---|
| Pablo financial and audit records | 6 years from the end of the relevant tax year (UK VAT statutory requirement) |
| HMRC tokens | Until you disconnect your HMRC account or close your Pablo account |
| Accounting and bank tokens | Until you disconnect the integration or close your account |
| User account data | Until you close your account, plus 30 days grace period |
| Website enquiry data | 2 years from the date of contact |
When you close your Pablo account you can request a full export of your data before deletion. We will delete your data within 30 days of your request, except where we are required by law to retain it (e.g. 6-year VAT records).
We use the following measures to protect your data:
No method of data transmission over the internet is entirely secure. We will notify you and the ICO within 72 hours if we become aware of a data breach affecting your personal data.
You have the right to:
To exercise any of these rights, email privacy@theprocesspartners.com. We will respond within one calendar month.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Pablo uses Claude models hosted on Amazon Web Services (AWS Bedrock, London region) to analyse your financial data and generate commentary, summaries, and recommendations. Financial figures are computed deterministically by our own engine — the AI model is used for language and explanation only, never for calculating tax or financial amounts.
Your financial data is processed within the UK. It is not transferred outside the UK for AI processing purposes.
Our website uses only essential cookies required for the site to function (such as session management). We do not use advertising, tracking, or analytics cookies. You can control cookie settings through your browser.
We will post any changes to this page and update the “Last updated” date. Where changes are material, we will notify Pablo customers by email before they take effect.
The Process Partners Group Ltd
Email: privacy@theprocesspartners.com
For data breach notifications to HMRC: we log a ticket at the HMRC Developer Hub within 72 hours of becoming aware of a breach involving customer data.