Data protection

Last updated 30.10.2026

1. Who holds this data

The data controller is AT PARTNERS LLC. For any question about this notice, write to info@centpercent.eu.

2. What is collected

Only what the accounting work and the security of your account require. Nothing is collected for advertising and nothing is sold to third parties.

• Account — your first and last name, username, email, phone if you give one, your role and the access the office assigns you.
• Sign-ins — the date and time of every sign-in attempt, successful or not, the IP address, a description of the device and browser, and how the session ended. The password is never stored, not even when typed wrongly.
• Location — only when the office has set a sign-in zone for an account — and then only the coordinates the browser itself gives at the moment of signing in, after you have allowed it — or when you attach it yourself to an account request. There is no continuous tracking and no movement is recorded.
• Business data — the business name, business number (NUI), VAT number, invoices, returns, receipts, debts and the payroll with its contributions.
• Documents — every file uploaded to the business file, together with the text extracted from it so that search can find words inside it.
• Communication — the messages between you and the office, voice notes and call records inside the program.
• Notifications — if you allow notifications, the subscription linking your browser to your account is stored. It is removed as soon as you turn them off.
• Account request — when you request an account from the “Become a client” page: the business name, your first and last name, email, phone if you give one, the type of business and the services you need if you choose them, and your location only if you attach it yourself, together with the IP address, a description of the browser, and the language and time zone of the device. Only the office administrator sees it.
• Meeting request — when you request a meeting from your account: your name, business, phone or email, the service, when it suits you and the note you leave, together with the IP address and a description of the browser. Only the office administrator sees it.
• Your words for the public website — when you write them yourself on “My account”: the sentence, the name and the business as you wrote them, and whether you allowed us to put them on the website. They appear there only with your permission and once the office places them; without permission only the office reads them. When the account is deleted, they leave the website too.

3. Why it is kept

• To perform the service — keeping the books, preparing the filings and communicating with you are the contract itself.
• For a legal obligation — accounting and tax documents must be kept for as long as the law requires, even after the relationship ends.
• For the security of your account — the sign-in log and the audit trail exist so the question “who changed this, and when” can be answered.

4. Who sees it

Access is granted by role and checked on every page, not only in the menu. A client sees their own file and nothing else; a staff member sees what has been assigned to them; an administrator sees everything. Every view of sensitive data and every change is recorded with the name of the person who made it.

Outside the office, data goes only where the work itself requires — to the tax administration for the filings you order — or where the law requires. There is no advertising, no tracker, and no third-party analytics runs on this site.

Having a document read by an external model is a feature that is off by default. When the office turns it on, it acts on a single document and only after someone presses the button — never in bulk and never on its own.

5. Where it is kept and how it is protected

• The database sits on the office server and is encrypted on disk: a copy taken off the machine cannot be read without the password.
• The connection to the site runs only over HTTPS, and the site loads nothing from outside servers.
• Sign-in can be protected with two-step verification or a passkey; the account locks itself after a set number of failed attempts.
• The audit trail is linked into a chain that cannot be rewritten: a record removed later shows up as a gap, not as something that never existed.
• Backups are taken regularly and kept limited in number; if the office has set a second storage location, the copy goes there too.

6. How long it is kept

Business data and documents are kept for as long as the relationship lasts and then for as long as the legal retention period for accounting documents requires. Non-critical audit records are cleared by the office after a set period; deletions and anything touching money, clients or accounts remain. When an account is closed, its personal data is removed or anonymised except what must be kept by law.

An account request that is not confirmed with the code from the email expires after 15 minutes and is deleted as soon as the next request arrives. A request the office approves becomes your account; one the office turns down stays with the office as a record of the decision until the office deletes it — and even then, like every deletion, a note of it stays in the activity trail.

A meeting request is deleted on its own six months after the office closes it; the activity trail keeps only the note that it was made and how it was closed, without the name or the contact details. If the office sets a meeting, it stays on its calendar like any other meeting, with the name and contact you left.

7. Your rights

Regarding your personal data, you have the right:

• to see it and receive a copy;
• to ask for correction of anything inaccurate;
• to ask for erasure, where no legal retention obligation prevents it;
• to ask for processing to be restricted, or to object to it;
• to complain to the competent personal data protection authority.

Most of these you exercise by writing to the office; we answer within the legal deadline.

8. Cookies

This site uses only technical cookies: the one that keeps your session open and the one that remembers your display choices — language, sidebar width, table density. There are no advertising cookies and no cookie is read by a third party.

Visits to the public pages are counted as daily figures: which page was opened, in which language, from a phone or a computer, and where the visit came from — for example from Google. No IP address is stored, no cookie is set and no figure is linked to a person; the counts are kept for one year. Anyone signed in to an account is not counted at all.

We also count how many times the phone number, the email, the contact card or the WhatsApp or Viber link is tapped: from which page, and from a phone or a computer. When a visitor comes from a link or QR code the office has marked with a name (for example “card”), only that name is kept. The same limits apply: no IP address, no cookie, no figure tied to a person.

9. Changes

When this notice changes, the date above changes with it. Changes that affect how your data is processed are also announced inside the program.