Data processing agreement

When your business stores personal data in Arcify — your customers, staff and suppliers — you are the controller of that data and Arcify is your processor under UK GDPR Article 28. This agreement sets out the terms on which we process it. It forms part of our terms of service and applies automatically to every account; no signature is needed. For the data we control ourselves — your Arcify account and billing — see the privacy policy.

• Subject matter and duration — the personal data your business stores in the suite, for as long as your account is open.
• Nature and purpose — storing, organising and displaying that data to provide the Arcify services your tier includes, and nothing else.
• Categories of data subjects — your customers, staff, suppliers and other contacts your business chooses to record.
• Categories of data — the contact, booking, financial, employment and related records the suite’s apps hold. You decide what goes in; do not store data the service is not designed for (such as special category data outside the fields provided for it).

• We process your data only on your documented instructions — operating the service as you configure it — unless the law requires otherwise, in which case we will tell you first where we lawfully can.
• Everyone who can access personal data at Arcify is bound by confidentiality obligations.
• We apply the technical and organisational measures described on our security page.
• We assist you, as far as reasonably possible, with data subject requests and with your own UK GDPR obligations (security, breach notification, impact assessments).
• We make available the information reasonably needed to demonstrate compliance with this agreement.

We use a small number of sub-processors to run the service, each bound by a written contract imposing equivalent data protection obligations:

• Our hosting provider — infrastructure the service runs on, hosted in the United Kingdom.
• Supabase — authentication and file storage.
• Stripe — payment processing; full card numbers never touch Arcify systems.

We will tell account holders before adding or replacing a sub-processor, so you have the chance to object. Ask support@arcify.co.uk for the current detailed list at any time.

If we become aware of a personal data breach affecting your data, we will notify you without undue delay and give you the information you need for your own notification duties — what happened, the data and people likely affected, and what we are doing about it.

You can export your data while the account is open. When it closes, we delete the personal data we processed for you, subject to any retention the law requires of us. Backups clear on their normal rolling cycle.

Questions about this agreement or a data protection matter: support@arcify.co.uk.