Data Processing Terms
Last updated: 25 September 2026
Contents
- 1. When these terms apply
- 2. Details of the processing
- 3. Our obligations
- 4. Sub-processors
- 5. Transfers outside the UK
- 6. Personal data breaches
- 7. At the end of the service
- 8. Your obligations
- 9. Liability and general
1. When these terms apply
These terms apply when an organisation ("you") uses the ProConvey platform without a signed ProConvey licence agreement, and puts personal data about its clients or anyone else into the platform. They form part of our Terms and Conditions. If your organisation has a licence agreement, Schedule 3 (Data Processing Agreement) of that agreement applies instead.
For that personal data you are the controller and ProConvey Limited ("we", "us") is your processor. Words used in these terms have the meaning given in the UK GDPR and the Data Protection Act 2018.
2. Details of the processing
| Item | Details |
|---|---|
| Subject matter | Providing the ProConvey platform and support to you |
| Duration | While you use the platform, and afterwards until the data is dealt with under section 7 |
| Nature and purpose | Hosting, storing, organising, sending and retrieving your conveyancing and property transaction data, and sending data to identity, anti-money laundering, search and property data providers when you tell the platform to, so that you can provide your services to your clients |
| Types of personal data | Names, contact details, addresses, dates of birth, identity document data and images, facial images and biometric data where you use facial verification, source of funds and other financial information, property and title information, transaction data, correspondence and documents, and any other personal data you choose to put in |
| Data subjects | Your clients and prospective clients, related parties such as people giving a deposit, other parties to a transaction and their representatives, and your own staff |
3. Our obligations
We will:
- Instructions. Process the personal data only on your documented instructions, unless the law requires us to do otherwise. Your use of the platform's features, these terms and any other written instruction you give us are your instructions. If the law requires us to process the data otherwise, we will tell you first unless the law prevents us. We will tell you if we think an instruction breaks data protection law.
- Confidentiality. Make sure that everyone we authorise to process the personal data is bound by a duty of confidentiality.
- Security. Take appropriate technical and organisational measures to protect the personal data, as required by Article 32 of the UK GDPR. Our Security and incidents page describes our current measures and their limits.
- Requests from individuals. Help you, as far as we reasonably can given the nature of the processing, to respond to people who exercise their data protection rights. If we receive a request directly, we will pass it to you promptly and will not respond to it ourselves except on your instructions or where the law requires us to. The platform cannot yet erase an individual person's data or produce an export of it, so we will tell you what we can and cannot do for each request.
- Other assistance. Give you reasonable help with your obligations under Articles 32 to 36 of the UK GDPR, including data protection impact assessments and any prior consultation with the Information Commissioner's Office, taking into account the nature of the processing and the information we have.
- Information and audits. Make available to you the information reasonably needed to show that we meet these terms, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. We may ask for reasonable notice and for the audit to be arranged to limit disruption and protect other customers' data.
4. Sub-processors
You give us general authorisation to use the sub-processors listed on our Sub-processors page. Before we add or replace a sub-processor, we will update that page and email your account administrators at least [30 days] in advance. You may object on reasonable data protection grounds during that time. If we cannot resolve your objection, you may stop using the platform, and we will refund any fees you have paid in advance for a period you cannot use.
We will put a written contract in place with each sub-processor that gives protections for the personal data equivalent to those in these terms. We remain responsible to you for our sub-processors' performance of their obligations.
5. Transfers outside the UK
We will transfer the personal data outside the UK, or let a sub-processor do so, only where the transfer is to a country covered by UK adequacy regulations, or an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses is in place, or another lawful transfer mechanism applies.
The case database, database backups and transactional email are held in the UK (AWS London). Application compute is in London. Better Stack telemetry is held in the EU (Germany). Clerk, Knock and Sentry process personal data in the United States under UK transfer safeguards; Clerk and Knock have no EU region. The region for Vercel Blob, where documents are stored, is to be confirmed. The Sub-processors page lists each provider's location.
6. Personal data breaches
If we become aware of a personal data breach affecting the personal data, we will tell you without undue delay. We will give you the information we have about the breach, including its nature, the people and records likely to be affected, its likely consequences and what we are doing about it, and more information as it becomes available. We will help you, as far as we reasonably can, to meet your own obligations to report the breach and to tell the people affected. Service incidents are also published at https://proconvey.betteruptime.com/.
7. At the end of the service
When you stop using the platform, tell us in writing whether you want the personal data deleted or returned to you.
- Deletion. If you ask us to delete it, we will delete the personal data, including stored documents, from the platform manually and confirm to you in writing when we have done so. Copies held in our encrypted database backups are removed automatically when those backups expire, within 35 days.
- Return. If you ask us to return it, we will give you a copy of the personal data held in the platform before we delete it.
We may keep personal data where the law requires us to.
8. Your obligations
You confirm that:
- you have a lawful basis, and have given people the information the law requires, for the personal data you put into the platform and for us and our sub-processors to process it under these terms;
- where you use facial verification or other features that involve biometric data, you have identified and recorded a condition for processing under Article 9 of the UK GDPR and told the people concerned; and
- your instructions to us comply with data protection law, and you are responsible for the accuracy and lawfulness of the personal data you put in.
9. Liability and general
Each party's liability under these terms is subject to section 17 (Liability) of our Terms and Conditions. These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. If these terms and the rest of our Terms and Conditions conflict on the processing of personal data, these terms prevail.
Questions about these terms: our Data Protection Officer, Christopher Scantlebury, chris.scantlebury@proconvey.co.uk.
ProConvey Limited is registered in England and Wales, company number 13905278, registered office 45 Fitzroy Street, London, England, W1T 6EB.
