Last updated: 18 March 2026
Fortium ("we", "us", "our") is a practice management platform for UK accountancy firms. We act as a data processor on behalf of the accountancy firms ("Organisations") that use our platform, and as a data controller for information we collect directly from visitors to this website and from Organisation administrators during registration.
When an Organisation registers, we collect: firm name, business address, email address, phone number, and details of the registering user (name, email, job title). Staff members invited to the platform provide their name, email address, phone number, and job title.
Organisations store their own client records on the platform, which may include: client name, business type, company number, addresses, tax dates, contact details (name, email, phone, date of birth, nationality), and any information entered into custom fields. We process this data on behalf of the Organisation.
Organisations and their clients upload documents to the platform. These are stored in encrypted object storage. We do not access the content of uploaded documents except as necessary to provide the service (for example, AI-powered document categorisation when enabled by the Organisation).
The platform stores invoice records, payment history, time records, and billing information created by Organisations. Payment processing for subscriptions is handled by third-party payment processors; we do not store full payment card details.
Messages sent through the in-app messaging system, emails synced from connected email accounts (Microsoft 365, Gmail), and WhatsApp messages sent through the platform are stored to provide the communication features.
When you visit this website or submit the register interest form, we collect: your name, email address, company name, and standard web server logs (IP address, browser type, pages visited).
When a proposal or document is signed electronically, we capture and store the signature image, signer name, IP address, and timestamp to create a verifiable signing certificate.
We use the information we collect to:
Under the UK General Data Protection Regulation (UK GDPR), we process personal data on the following bases:
We retain Organisation data for the duration of the subscription and for a reasonable period afterwards to allow for reactivation or data export. Organisations can request deletion of their data at any time.
Where Organisations use the platform to store records subject to HMRC retention requirements, they are responsible for configuring appropriate retention periods. The platform supports the standard 6-year HMRC retention period and provides tools for Organisations to manage data lifecycle.
Audit logs are retained for the lifetime of the Organisation account to support regulatory compliance and accountability.
We do not sell personal data. We share data only in the following circumstances:
We implement appropriate technical and organisational measures to protect personal data, including:
Under the UK GDPR, you have the following rights in relation to your personal data:
If your data is held on behalf of an Organisation (as their client or contact), please direct your request to that Organisation in the first instance. The Organisation can use our platform's built-in GDPR data export tools to fulfil subject access requests.
For data we control directly (website visitors, Organisation administrators), contact us using the details in section 12.
Portal accounts are created by Organisations for their clients. Portal users can access documents, upload files to document requests, view invoices, sign proposals and documents, send messages, and complete compliance questionnaires. Portal data access is scoped to the individual client record — portal users cannot see other clients' data.
Portal user credentials and access are managed by the Organisation. If you have questions about your portal account, contact your accountancy firm directly.
Fortium includes optional AI-powered features such as document categorisation and practice insights. These features process Organisation data locally and are enabled at the Organisation's discretion. AI usage is logged per user and subject to rate limits. Organisations can disable AI features entirely in their settings.
We may update this privacy policy from time to time. We will notify registered Organisations of material changes via email. The "last updated" date at the top of this page indicates when this policy was last revised.
If you have questions about this privacy policy or wish to exercise your data protection rights, contact us at:
Email: privacy@fortium.software
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.