ProConvey Logo

Data Processing Terms

Last updated: 9 November 2026

Contents

1. When these terms apply

These terms apply when an organisation ("you") uses the ProConvey platform without a signed ProConvey licence agreement, and puts personal data about its clients or anyone else into the platform. They form part of our Terms and Conditions. If your organisation has a licence agreement, Schedule 3 (Data Processing Agreement) of that agreement applies instead.

For that personal data you are the controller and ProConvey Limited ("we", "us") is your processor. Words used in these terms have the meaning given in the UK GDPR and the Data Protection Act 2018.

ProIdentify app accounts. When you order a ProIdentify check, we create a ProIdentify app account for your client's mobile number. We are the controller of that account (the mobile number, password and sign-in records), of the security records we keep to protect the app, and of the app's error reports. Our ProIdentify privacy notice at https://proidentify.com/privacy explains that processing.

2. Details of the processing

Item Details
Subject matter Providing the ProConvey platform and support to you
Duration While you use the platform, and afterwards until the data is dealt with under section 7
Nature and purpose Hosting, storing, organising, sending and retrieving your conveyancing and property transaction data, and sending data to identity, anti-money laundering, search and property data providers when you tell the platform to, so that you can provide your services to your clients; and, when you order a ProIdentify check, running that check through the ProIdentify app with our identity verification sub-processor (identity document and passport chip checks, a face video and face comparison, a database check, and sanctions, politically exposed person and adverse media screening), collecting proof of address and proof of ownership documents when you ask for them, sending your client the invite and reminder messages, producing the report, and, if you choose it, ongoing monitoring of your client's name and date of birth for up to 12 months from the check or until you stop it
Types of personal data Names, contact details, addresses, dates of birth, identity document data and images, passport chip data, facial images, face videos and biometric data where you use facial verification, mobile phone numbers, information about your client's device and connection used to detect fraud, database check results, sanctions, politically exposed person and adverse media screening results (which may include information about alleged offences), proof of address and proof of ownership documents, source of funds and other financial information, property and title information, transaction data, correspondence and documents, and any other personal data you choose to put in
Data subjects Your clients and prospective clients, related parties such as people giving a deposit, other parties to a transaction and their representatives, and your own staff
Retention of ProIdentify check data We ask our identity verification sub-processor to delete a ProIdentify check's data 90 days after the report is filed, or when ongoing monitoring ends if that is later. It completes the deletion within up to 20 more days. We clear our own copies of proof documents and the property address at the same time. A check with no activity for 90 days is cancelled automatically, and its data is deleted 90 days after that. A check you cancel is deleted no later than 90 days after the cancellation. The report, with its images, is filed in your case or client documents and kept under your own retention decisions.

3. Our obligations

We will:

  • Instructions. Process the personal data only on your documented instructions, unless the law requires us to do otherwise. Your use of the platform's features, these terms and any other written instruction you give us are your instructions. When you order a ProIdentify check, your instructions include every part of the check described in section 2, ongoing monitoring if you choose it (until it ends after 12 months or you stop it), the invite and reminder messages to your client (unless you turn reminders off), and deleting the check's data on the schedule in section 2. If the law requires us to process the data otherwise, we will tell you first unless the law prevents us. We will tell you if we think an instruction breaks data protection law.
  • Confidentiality. Make sure that everyone we authorise to process the personal data is bound by a duty of confidentiality.
  • Security. Take appropriate technical and organisational measures to protect the personal data, as required by Article 32 of the UK GDPR. Our Security and incidents page describes our current measures and their limits.
  • Requests from individuals. Help you, as far as we reasonably can given the nature of the processing, to respond to people who exercise their data protection rights. If we receive a request directly, we will pass it to you promptly and will not respond to it ourselves except on your instructions or where the law requires us to. The platform cannot yet erase an individual person's data or produce an export of it, so we will tell you what we can and cannot do for each request.
  • Other assistance. Give you reasonable help with your obligations under Articles 32 to 36 of the UK GDPR, including data protection impact assessments and any prior consultation with the Information Commissioner's Office, taking into account the nature of the processing and the information we have.
  • Information and audits. Make available to you the information reasonably needed to show that we meet these terms, and allow for and contribute to audits, including inspections, by you or an auditor you appoint. We may ask for reasonable notice and for the audit to be arranged to limit disruption and protect other customers' data.

4. Sub-processors

You give us general authorisation to use the sub-processors listed on our Sub-processors page. Before we add or replace a sub-processor, we will update that page and email your account administrators at least 30 days in advance. You may object on reasonable data protection grounds during that time. If we cannot resolve your objection, you may stop using the platform, and we will refund any fees you have paid in advance for a period you cannot use.

We will put a written contract in place with each sub-processor that gives protections for the personal data equivalent to those in these terms. We remain responsible to you for our sub-processors' performance of their obligations.

5. Transfers outside the UK

We will transfer the personal data outside the UK, or let a sub-processor do so, only where the transfer is to a country covered by UK adequacy regulations, or an International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses is in place, or another lawful transfer mechanism applies.

The case database, database backups and transactional email are held in the UK (AWS London). Application compute is in London. Better Stack telemetry is held in the EU (Germany). Clerk, Knock and Sentry process personal data in the United States under UK transfer safeguards; Clerk and Knock have no EU region. The region for Vercel Blob, where documents are stored, is to be confirmed. For ProIdentify checks, our identity verification sub-processor, Entrust, processes personal data in the European Union, and Mapbox (maps in the ProIdentify app) processes personal data in the United States under UK transfer safeguards. The Sub-processors page lists each provider's location.

6. Personal data breaches

If we become aware of a personal data breach affecting the personal data, we will tell you without undue delay. We will give you the information we have about the breach, including its nature, the people and records likely to be affected, its likely consequences and what we are doing about it, and more information as it becomes available. We will help you, as far as we reasonably can, to meet your own obligations to report the breach and to tell the people affected. Service incidents are also published at https://proconvey.betteruptime.com/.

7. At the end of the service

When you stop using the platform, tell us in writing whether you want the personal data deleted or returned to you.

  • Deletion. If you ask us to delete it, we will delete the personal data, including stored documents, from the platform manually and confirm to you in writing when we have done so. Copies held in our encrypted database backups are removed automatically when those backups expire, within 35 days.
  • Return. If you ask us to return it, we will give you a copy of the personal data held in the platform before we delete it.

ProIdentify check data held by our identity verification sub-processor is deleted on the schedule in section 2, whether or not you stop using the platform. If you stop using the platform, we stop any ongoing monitoring still running on your checks as part of closing your account, and the check data is then deleted on the schedule in section 2.

We may keep personal data where the law requires us to.

8. Your obligations

You confirm that:

  • you have a lawful basis, and have given people the information the law requires, for the personal data you put into the platform and for us and our sub-processors to process it under these terms;
  • where you use facial verification or other features that involve biometric data, you have identified and recorded a condition for processing under Article 9 of the UK GDPR and told the people concerned (our ProIdentify privacy notice helps with this, but does not replace your own privacy notice);
  • where you order screening that may reveal information about alleged offences, you have a condition for processing that information under Schedule 1 to the Data Protection Act 2018; and
  • your instructions to us comply with data protection law, and you are responsible for the accuracy and lawfulness of the personal data you put in.

9. Liability and general

Each party's liability under these terms is subject to section 17 (Liability) of our Terms and Conditions. These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction. If these terms and the rest of our Terms and Conditions conflict on the processing of personal data, these terms prevail.

Questions about these terms: our Data Protection Officer, Christopher Scantlebury, chris.scantlebury@proconvey.co.uk.

ProConvey Limited is registered in England and Wales, company number 13905278, registered office 45 Fitzroy Street, London, England, W1T 6EB.

ProConvey logo

ProConvey.co.uk

ProConvey is your all-in-one solution for conveyancing software.

Tel: 020 4592 0899

© 2025 proconvey.co.uk. All rights reserved.

ProConvey Limited. Registered in England and Wales, company number 13905278. Registered office: 45 Fitzroy Street, London, England, W1T 6EB. VAT number GB413524723.