Privacy Policy
Last updated: 25 September 2026
Contents
- 1. Who we are
- 2. Our two roles
- 3. Information we collect and where it comes from
- 4. How we use it and our lawful basis
- 5. If you do not give us information
- 6. Who we share it with
- 7. Where your information is held
- 8. How long we keep it
- 9. How we protect it
- 10. Automated decisions
- 11. Your rights
- 12. Complaints
- 13. Cookies
- 14. Children
- 15. Changes to this policy
- 16. Contact us
1. Who we are
ProConvey Limited ("ProConvey", "we", "us") provides a cloud-based conveyancing platform used by law firms, conveyancers, estate agents and mortgage brokers in England and Wales.
ProConvey Limited is registered in England and Wales, company number 13905278. Our registered office is 45 Fitzroy Street, London, England, W1T 6EB.
ProConvey Limited is registered with the Information Commissioner's Office, registration number ZB544378 (current to 8 May 2027).
Data Protection Officer: Christopher Scantlebury, chris.scantlebury@proconvey.co.uk
This policy explains how we use personal data, as required by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.
2. Our two roles
When we act for a firm (processor). Law firms and other businesses that use ProConvey put information about their clients and their transactions into the platform. For that information the firm is the controller and we process it only on the firm's instructions. Our processor terms are set out in Schedule 3 (Data Processing Agreement) of the ProConvey licence agreement between us and the firm, or, for a firm without a licence agreement, in our Data Processing Terms. If you are a client of a firm that uses ProConvey, the firm's own privacy notice explains how your information is used, and you should contact the firm first. If you contact us, we will pass your request to the firm.
When we decide how information is used (controller). We are the controller for information about people who use our website, people who hold user accounts on the platform for their organisation, our customers' billing and account contacts, clients of firms who pay us directly for searches or a Fast Track Sale package, people who contact us or receive our business communications, and information we use to keep the platform secure. The rest of this policy mainly explains that processing.
3. Information we collect and where it comes from
| Who | What we collect | Where it comes from |
|---|---|---|
| Account users | Name, work email address, phone number, job title, organisation, branch and team, sign-in credentials and session information, settings you choose | You, or the organisation that invites you. If you sign in with Google or Microsoft, those services confirm your identity to us. |
| Customer account and billing contacts | Contact details, invoices, payment status and payment method details. Card payments are handled by Stripe; we do not store full card numbers. | You and your organisation; Stripe |
| Clients who pay us directly | Name, email address, the property address and case reference, what you bought, payment status and payment method details. Card payments are handled by Stripe; we do not store full card numbers. | Your conveyancer or estate agent, who asks you to pay; you; Stripe |
| People who contact us | What you tell us when you ask a question, request a demo or ask for help, including support chat messages | You |
| Website visitors | IP address, browser and device information, pages viewed and, where you agree, information from non-essential cookies | Your device, through our website and the cookie tools described in our Cookie Policy |
| Everyone who uses the platform | Sign-in events, application activity records (for example document access grants and exports), error reports and system logs | Created by the platform when you use it |
4. How we use it and our lawful basis
| Purpose | Lawful basis under the UK GDPR |
|---|---|
| Providing user accounts and the platform to our customers' users | Legitimate interests in providing the service our customers have asked us to provide to their users; contract where the user is themselves our customer (for example a sole trader) |
| Billing and account management | Contract; legal obligation (tax and accounting records) |
| Taking payment from clients who pay us directly, and handling cancellations and refunds | Contract; legal obligation (tax and accounting records) |
| Answering enquiries and giving support | Legitimate interests in responding to people who contact us |
| Keeping the platform secure, preventing fraud and investigating incidents | Legitimate interests in protecting the platform and our customers' data; legal obligation where the law requires it |
| Sending business-to-business updates about our services | Legitimate interests in telling business contacts about our services. Where the law requires consent (for example for sole traders and some partnerships), we ask for it. You can opt out at any time. |
| Non-essential website cookies | Consent |
Where we rely on legitimate interests, we have considered whether our interests are overridden by yours. You can ask us for more detail and you can object (see Your rights).
5. If you do not give us information
You do not have to give us information. If an account user does not give us the details needed to set up an account, we cannot give them access to the platform. If a customer does not give us billing details, we cannot provide paid services.
6. Who we share it with
We use suppliers to run the platform and our business. They act only on our instructions. The suppliers that process personal data, what they do and where they process it are listed on our Sub-processors page.
When a firm uses identity, anti-money laundering, source of funds, search or property data services in the platform, the firm's data is sent, at the firm's direction, to the provider it chooses. Some information also goes to organisations that act as controllers in their own right, such as HM Land Registry and Stripe. These are also listed on the Sub-processors page.
We may also share information:
- where the law requires it, for example with a regulator, court or law enforcement body;
- to establish, exercise or defend legal claims; and
- with a buyer, investor or adviser if our business is sold or restructured, under a duty of confidence.
We do not sell personal data.
7. Where your information is held
The conveyancing case database, its backups and transactional email are hosted in the United Kingdom (AWS London, eu-west-2). Application compute runs in London (Vercel lhr1). Better Stack log and uptime telemetry is processed in the EU (Germany). Clerk (identity: names, email addresses, phone numbers, credentials and sessions), Knock (notification recipient details and content) and Sentry (error and session data) process personal data in the United States under UK transfer safeguards (the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses and, where the supplier is certified, the UK–US data bridge). Clerk and Knock offer no EU region. The storage region of Vercel Blob, which holds client documents, is to be confirmed. Other suppliers that receive personal data, and their locations, are listed in the sub-processor register.
Transfers to the European Economic Area rely on the UK's adequacy regulations. You can ask our Data Protection Officer for more information about the safeguards we rely on for a transfer.
8. How long we keep it
ProConvey works to the CLC Transaction Files Code retention standard, generally 6 to 15 years depending on matter type. Automated deletion at the end of the retention period is not yet in place.
For information a firm puts into the platform, the firm decides how long it is kept. What happens to a firm's data when its licence ends is set out in clause 13 of the licence agreement.
We keep account, billing, client payment and enquiry records for as long as the customer relationship lasts and afterwards for as long as we need them for legal, tax and accounting purposes.
Security records (sign-in events and application activity records) are kept while the account is active and for as long as needed to investigate incidents; AWS CloudTrail logs are kept for 12 months. Error reports and uptime logs are kept for the periods set in our Sentry and Better Stack accounts. Website cookie data is kept for the periods shown in the table in our Cookie Policy. Business contact details used for marketing are kept until you object or they are no longer relevant.
Deletion in the platform today is a soft delete: the record is hidden but stays in the database, and in backups until they expire. The platform cannot yet erase an individual person's data or produce an export of an individual's data, and deleting an organisation does not remove its stored documents or its backups.
9. How we protect it
- The case database and its backups are encrypted at rest, and traffic to the platform uses HTTPS.
- Access is role-based, and each user has their own sign-in.
- Staff users can turn on an authenticator app for their ProConvey sign-in. It is optional and not required. Clients are not asked to use multi-factor authentication.
- New confidential documents are stored privately and opened through short-lived signed links after an access check. Some older document links remain publicly reachable. Listing photos, logos and letterhead images are public.
- Database: Aurora continuous point-in-time recovery (recovery point about 5 minutes) and daily encrypted snapshots kept for 35 days, in London only. There is no copy in a second region. Client documents are stored in Vercel Blob (Amazon S3 durability). ProConvey does not keep a separate copy of documents, so there is no ProConvey recovery point for documents. Better Stack and 1Password are not backups; 1Password is the credential store.
No system is completely secure. How we tell customers about incidents and personal-data breaches is explained on our Security and incidents page.
10. Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you. Identity checks that a firm chooses to run through the platform, including facial matching, are carried out by the provider the firm selects, at the firm's direction; the firm's privacy notice explains them.
11. Your rights
Under UK data protection law you have the right to:
- be told how your information is used;
- get a copy of your information;
- have inaccurate information corrected;
- have your information erased, where the law allows;
- restrict how it is used;
- receive it in a portable format, where the law allows;
- object to its use, including for direct marketing (we will always stop direct marketing if you object);
- withdraw consent at any time, where we rely on consent; and
- not be subject to decisions made solely by automated means that significantly affect you.
Some rights apply only in certain circumstances, and the law allows some exemptions. To use a right, contact our Data Protection Officer (see Contact us). We reply within one calendar month. If a request is complex we may extend that by up to two further months, and we will tell you within the first month. We may need to confirm your identity. There is normally no fee.
If your request is about information a firm put into the platform, we will pass it to that firm, because the firm decides how to respond.
Please be aware of the limits described in How long we keep it: the platform cannot yet fully erase a single person's data or produce an export of it, so we handle these requests manually and will tell you exactly what we can and cannot do.
12. Complaints
If you are unhappy with how we have handled your personal data, please tell our Data Protection Officer first. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
You can also complain to the Information Commissioner's Office at www.ico.org.uk.
13. Cookies
Our website uses cookies, including cookies set by third-party content such as embedded videos. You can accept or reject non-essential cookies in our Cookie Preference Center. See our Cookie Policy.
14. Children
Our services are for businesses and are not directed at children.
15. Changes to this policy
We update this policy when our practices change. The date at the top shows when it was last changed. If we make a significant change that affects account users, we will tell them.
16. Contact us
Data Protection Officer: Christopher Scantlebury, chris.scantlebury@proconvey.co.uk
Post: Data Protection Officer, ProConvey Limited, 45 Fitzroy Street, London, England, W1T 6EB
General enquiries: support@proconvey.co.uk
ProConvey Limited is registered in England and Wales, company number 13905278. Registered office: 45 Fitzroy Street, London, England, W1T 6EB. VAT number GB413524723.
