gsk OneDesk
Privacy policy
gsk OneDesk is an accounting and client portal service run by GSK Partners, a partnership registered in Sri Lanka (business registration W HH 2310), of No. 301 1/1, Galle Road, Mount Lavinia ("we", "us"). This policy explains what personal data the gsk OneDesk website and app collect, why, and the choices you have. It applies to accounting firms using the service, their staff, and the businesses and people whose books they keep.
What we collect
- Account details: your name, email address, phone number, language and time zone, and your sign-in and two-factor authentication records.
- Business records: the books, transactions, invoices, payroll, tax and other records you or your accountant enter or import, and the documents and photos you upload.
- Messages and requests exchanged between you and your accounting firm.
- Device information: if you turn on notices on a phone or computer, that device's push address; and, for security, the IP address and browser of your sign-ins.
- Usage and audit records: which actions were taken, by whom and when, kept so that the books can be audited.
- Bank alerts (only for businesses that turn on the Bank alerts service): the text of your bank's transaction messages that you paste, share, forward by email, or that the gsk OneDesk Android app reads with your permission (see below). From each message we keep the transaction's date, time, amount, shop or payee, reference, the last digits of the account and the balance the bank reports. Bill reminders that arrive the same way (from your bank, phone, electricity, water or insurance company) are kept as bills due: the biller, amount, due date and account or reference number.
We do not sell personal data, and we do not use it for advertising.
Bank SMS and the Android app
The gsk OneDesk Android app can read your bank's SMS alerts and your bill reminders so your transactions and bills reach your books without typing. It does this only after you choose Read bank SMS on this phone in the app and allow SMS access when Android asks.
- Only bank transaction messages and bills leave your phone: messages from a bank's sender name that state an amount, and messages from a phone, electricity, water or insurance company that state an amount due. One-time codes (OTPs), promotions and all your other SMS stay on your phone and are never sent to us.
- The app sends those messages only to your own books, over an encrypted connection, using a key made for that phone. Your password is not stored on the phone.
- You can stop it at any time: choose Stop for the phone on the Alerts page (from any device), or remove the app's SMS permission in Android's settings. It also stops if you lose access to the books or the business turns the service off.
- The app may also ask to use the camera (to photograph receipts and documents; on most phones this opens Google's document scanner, which works on the phone itself through Google Play services, and the pages go only to your books), to show notifications, and to unlock with your fingerprint, face or screen lock. Unlocking is handled by Android: we never receive your fingerprint or face data.
Each bank alert waits for you or your accountant to check it before anything is recorded in the books.
Connected mailboxes (Microsoft 365 and Gmail)
A member of an accounting firm can connect their own Microsoft 365 or Gmail mailbox from their signature page, so that the emails they write to a client from a job go out from their own address and name. Connecting is a choice each person makes by signing in with Microsoft or Google and granting permission; nobody else can send from a mailbox they did not connect.
- What we do with it: send the emails that person writes and sends from a job. For Gmail that is all: we ask only for permission to send, and never read, search, change or delete anything in the mailbox. For Microsoft 365, the person may separately allow reading, in which case we read only mail that answers an email sent from a job, to file the reply on that job; nothing else in the mailbox is read or kept.
- What we keep: the connected address, the name the provider shows for it, the key the provider issues for sending (stored encrypted), and a copy of each email sent from a job, as with every email the service sends. We keep nothing else from the mailbox.
- Who sees it: emails sent from a job are visible to the firm's staff working on that job and to the client they were sent to, as with any job email. Mailbox data is not shared with anyone else, not used for advertising, and not used to train AI models.
- Stopping: choose Disconnect on the signature page at any time, which deletes the stored key; or remove gsk OneDesk from your Google or Microsoft account's connected apps. The copies of emails already sent stay on their jobs.
gsk OneDesk's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Why we use it
- To provide the service: keeping books, preparing reports and returns, and letting you and your accountant work together.
- To keep accounts and records secure, detect misuse, and keep an audit trail.
- To send the notices and emails you need, such as requests from your accountant.
- To meet our legal obligations, including record-keeping duties under Sri Lankan law.
Who can see it
- Your accounting firm and the people in your own business you have given access.
- Service providers who run parts of the service for us under contract, such as cloud hosting and storage (Render, Amazon Web Services), email delivery (Microsoft, Amazon, and Google or Microsoft for a mailbox a firm member connects), malware scanning of uploaded files, push notification services (Google, Apple, Mozilla), card payments, and AI features used to suggest categories, read receipts, and read a bank alert our own reader cannot make out (Anthropic; only that alert's text is sent). They may process data outside Sri Lanka.
- Authorities, where the law requires it.
How long we keep it
Business records are kept for as long as the business and its accounting firm need them, and at least as long as accounting and tax law require. When you delete your account, your sign-in and personal details are removed at once; the business records you worked on stay with the business, showing an anonymous former member.
Bank alert messages are kept only as long as they are useful. The bank's message text is deleted 7 days after the alert is matched to its line on the bank statement, and 30 days after an alert is dismissed or set aside as a duplicate. Bank emails forwarded to us are deleted from our mailbox after 7 days. A bill reminder's message text is deleted 30 days after the bill is paid or removed. What stays is the transaction itself and a one-way fingerprint of the message, so the same message is never recorded twice.
When our reader cannot make out a bank alert, we keep a copy of its wording with every number, name, email address and link removed, not linked to any business or person, so we can teach the reader that bank's format.
Your choices and rights
- See and correct your details on your account page.
- Turn phone notices on or off at any time, and choose which emails you receive in notification settings.
- Delete your account from inside the app: open your account menu and choose Delete account.
- Ask us for a copy of your personal data, or raise any other request under the Personal Data Protection Act, No. 9 of 2022, by writing to us at the address below.
Security
Data is encrypted in transit and stored with access limited to each business and its firm. Sign-ins use one-time codes and two-factor authentication, uploaded files are scanned for malware, and changes to the books are recorded in a tamper-evident audit trail.
Children
The service is for businesses and their advisers, and is not meant for children under 16.
Changes
We will post any change to this policy here with a new effective date, and tell account holders of significant changes by email or in the app.
Contact
GSK Partners, No. 301 1/1, Galle Road, Mount Lavinia, Sri Lanka
Email: accounting@gskpartners.io