Privacy Policy

1. Introduction

This Privacy Policy explains how Arcora Ltd, trading as Arc ("Arc", "we", "us", "our"), collects, uses, stores and protects personal data in connection with the provision of our software platform for residential childcare providers within the United Kingdom.

Arc acts as a data controller in respect of personal data relating to website visitors, prospective customers, and account administrators. Arc acts as a data processor in respect of personal data uploaded to or created within customer accounts.

This Policy applies to personal data processed in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

2. Identity of the Controller

Arcora Ltd (trading as Arc) Fairoak Farmhouse, Barnstaple, EX31 4AU Registered Company Number: 17046553 ICO Registration Number: ZC096810 Email: privacy@arccare.co.uk

Arcora Ltd is the data controller for the purposes described in Section 3 of this Policy.

3. Personal Data Processed by Arc as Data Controller

We process personal data provided directly to us when an account is created, a demonstration is requested, or an enquiry is submitted. This may include names, job titles, email addresses, telephone numbers and organisation details.

Where applicable, we process billing contact details and information necessary to administer subscriptions and maintain financial records. Payment card data is processed by our payment service provider and is not stored by Arc.

When users access the platform or website, we process technical information including IP addresses, authentication records, browser type, device information and activity logs. This information is used for security monitoring, audit purposes, system integrity, fraud prevention and service improvement.

Where processing is based on legitimate interests, those interests include maintaining platform security, preventing unauthorised access, improving functionality, ensuring regulatory readiness and administering customer relationships.

4. Customer Data Processed by Arc as Data Processor

Arc provides a secure software platform through which customer organisations may upload, create and store personal data relating to staff, children, safeguarding matters, incident reporting and regulatory documentation.

In respect of such data, the customer organisation acts as the data controller and Arc acts solely as a data processor. Arc processes personal data only on documented instructions from the customer and does not use customer data for advertising, profiling or resale.

The obligations governing this processing are set out in the applicable customer contract and Data Processing Agreement.

5. Lawful Bases for Processing

Where Arc acts as a data controller, personal data is processed on the basis of contractual necessity, legitimate interests, or compliance with legal obligations.

Where Arc acts as a data processor, processing is carried out on behalf of the customer in accordance with Article 28 UK GDPR and pursuant to contractual obligations.

6. Data Storage and Security

Customer data is hosted within the United Kingdom using infrastructure located in the AWS London region (eu-west-2).

Arc implements appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These measures include encryption of data in transit using TLS, encryption of data at rest, role-based access controls, authentication safeguards, audit logging and secure infrastructure configuration.

Access to personal data is restricted to authorised personnel who require access for legitimate operational or support purposes and who are subject to confidentiality obligations.

7. Data Retention

Personal data processed in connection with customer accounts is retained for the duration of the contractual relationship.

Upon termination of a customer account, customers will be provided with a 30-day period to export their data. Following expiry of that period, personal data will be permanently deleted from active systems, subject to backup retention cycles not exceeding 30 days and any legal retention requirements.

Personal data processed by Arc as data controller, including financial and accounting records, may be retained for the period required by applicable law.

8. Subprocessors

Arc engages carefully selected third-party service providers to support the operation of the platform, including cloud infrastructure providers, payment processors and email delivery services.

Each subprocessor is subject to contractual obligations consistent with UK GDPR requirements. A current list of subprocessors is available upon request.

9. International Transfers

Certain subprocessors may process limited personal data outside the United Kingdom. Where this occurs, Arc ensures that appropriate safeguards are in place, including adequacy regulations or the use of approved international data transfer mechanisms, to ensure personal data remains protected in accordance with UK GDPR.

10. Data Subject Rights

Individuals whose personal data is processed by Arc as data controller have the right, subject to applicable law, to request access to their personal data, request rectification of inaccurate data, request erasure, request restriction of processing, request data portability, and object to processing based on legitimate interests.

Where Arc acts as a data processor, data subject requests should be directed to the relevant childcare provider as data controller. Arc will provide reasonable assistance to customers in fulfilling valid requests.

11. Personal Data Breaches

Arc maintains internal procedures for detecting, investigating and responding to personal data breaches. Where Arc becomes aware of a personal data breach affecting customer data, we will notify the relevant customer without undue delay and in sufficient time to enable the customer to meet its obligations under Article 33 of the UK GDPR.

12. Cookies

Arc uses essential cookies and similar technologies necessary for authentication, session management and platform security. We do not use advertising or behavioural tracking cookies within the platform.

Our public website uses privacy-preserving analytics to understand which pages are useful. These analytics set no cookies, do not store IP addresses, and do not track visitors across other websites. Because nothing is stored on your device, no cookie consent is required. This processing is carried out on the basis of our legitimate interest in maintaining and improving the site.

Further information is available in our Cookie Policy.

13. Complaints

If you have concerns about how personal data is handled, you may contact us using the details set out above. You also have the right to lodge a complaint with the Information Commissioner's Office.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify customers through the platform or by email. The latest version will always be available on our website.