ARX Property Management Solutions Ltd ("ARX", "we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
ARX acts as the Data Controller for personal data we collect through this website, from enquiries, and in running our own business and client accounts. Where ARX processes personal data that a client organisation uploads to the ARX platform (for example residents, contractors or building records), ARX acts as a Data Processor and the client is the Data Controller. That processing is governed by our Data Processing Agreement.
1. Who We Are
ARX Property Management Solutions Ltd is registered in England and Wales (Company No. 16332429). Registered office: 66 Paul Street, London EC2A 4NA. ICO Registration No: ZC127741. ARX has not appointed a Data Protection Officer, as one is not required for our current size and processing; our data protection lead is the Founder.
Data protection enquiries: info@arx-pms.com
2. Data We Collect
2.1 Information you provide to us
- Website enquiries: first name, last name, organisation, email address, portfolio size and the message you send us
- Identity and contact details: name, job title, email address, telephone number
- Organisation details: company name, address, registration number
- Platform account credentials: username and password (passwords are stored in hashed form and are never visible to ARX staff)
- Billing information: invoicing contact and payment records. Where a card payment provider is used, card details are handled by that provider and are not stored by ARX
- Correspondence: emails and messages sent to us or through the platform
2.2 Information collected automatically
- Technical data: IP address, browser type, device type and operating system (from web server and application logs)
- Platform usage data: pages visited, features used, actions taken and session times, recorded in the platform audit trail
- Cookies: this website does not currently set any non-essential cookies. See our Cookie Policy
2.3 Data uploaded by clients
Client organisations upload data about their buildings, staff, contractors, residents and inspections to the ARX platform. For that data the client is the Data Controller and is responsible for having a lawful basis and for providing privacy information to the people concerned. ARX processes it only on the client's instructions.
3. How We Use Your Data and Our Legal Basis
- To respond to website enquiries and quotation requests - legitimate interests (responding to a request you have made)
- To set up and administer client accounts and provide access to the platform - performance of a contract
- To invoice and manage subscriptions - performance of a contract and legal obligation (accounting records)
- To provide support and respond to queries - performance of a contract and legitimate interests
- To secure the platform, prevent misuse and investigate incidents - legitimate interests and legal obligation
- To send service notices about the platform (maintenance, security, changes to terms) - performance of a contract and legitimate interests
- To send marketing about ARX - consent, which you can withdraw at any time
- To comply with legal and regulatory obligations - legal obligation
We do not sell personal data, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. AI features in the platform assist users with classification, extraction and suggested routing; a person remains responsible for the resulting decisions.
4. Who We Share Data With
We share personal data only where necessary with service providers who act on our instructions under written contracts (sub-processors), and with authorities where the law requires it. Our current sub-processors are:
- Render, Inc. - application hosting and database (Frankfurt, EU region)
- Amazon Web Services - file storage and transactional email (London, eu-west-2 region)
- SendGrid (Twilio) - backup email delivery (United States)
- OpenAI - AI classification and extraction via API; data is not used to train OpenAI models (United States)
- Sentry - application error monitoring; receives technical error data only (United States)
- UptimeRobot - external availability monitoring; receives no personal data (United States)
- GoDaddy - hosting of this website and relay of enquiry-form emails
- Google Fonts - this website loads fonts from Google's servers, which receive your IP address when the page loads
An up-to-date sub-processor list is available on request. Clients are notified in advance of any change under the Data Processing Agreement.
5. International Transfers
Platform data is stored in the UK and EU. Transfers to EU countries rely on the UK adequacy regulations. Where a sub-processor is based in the United States, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment, encryption in transit and at rest, and data minimisation (for example, monitoring providers receive technical data only).
6. Cookies
This website does not currently set any non-essential cookies and does not use analytics or advertising cookies. The ARX platform at app.arx-pms.com uses strictly necessary cookies and browser storage for login and session security only. See our Cookie Policy.
7. How Long We Keep Data
- Website enquiries: 24 months from the enquiry, unless a client relationship follows
- Client account and platform data: for the duration of the subscription, then returned or deleted under the Data Processing Agreement. Clients may instruct us to retain building safety records for longer to meet their own Building Safety Act 2022 duties
- Contracts, invoices and accounting records: 6 years after the end of the relationship (Limitation Act 1980 and HMRC requirements)
- Marketing consent records: until consent is withdrawn, plus 1 year
- Security and access logs: 12 months
8. Your Rights
- Access - request a copy of the personal data we hold about you
- Rectification - ask us to correct inaccurate or incomplete data
- Erasure - ask us to delete data where there is no lawful reason to keep it
- Restriction - ask us to limit how we use your data
- Portability - receive your data in a structured, machine-readable format
- Objection - object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent - at any time, without affecting processing already carried out
To exercise any right, email info@arx-pms.com. We will respond within one calendar month and may ask you to confirm your identity. If your request concerns data held in the platform on behalf of a client organisation, we will pass it to that client within 3 working days and assist them with their response.
9. Security
- Encryption in transit (TLS 1.2 or higher) and at rest
- Role-based access control, so users see only what their role requires
- Append-only audit trail of actions taken in the platform
- Daily automated backups with tested restore procedures
- Error and availability monitoring, dependency vulnerability scanning and patching
- Credentials held in a password manager with two-factor authentication; no shared logins
10. Personal Data Breaches
Where ARX is the Data Controller and a breach is likely to result in a risk to individuals, we will notify the ICO within 72 hours of becoming aware of it and tell affected individuals without undue delay where required. Where ARX is a Data Processor, we will notify the affected client as set out in the Data Processing Agreement so that they can meet their own obligations.
11. Complaints
If you have a concern about how we handle your data, contact us first at info@arx-pms.com. You also have the right to complain to the Information Commissioner's Office at www.ico.org.uk or on 0303 123 1113.
12. Changes to This Policy
We may update this policy from time to time. Material changes will be notified to clients at least 30 days before they take effect. The current version is always available at www.arx-pms.com/privacy-policy.html.