1. Who we are and our role
Archway Software Limited (Archway, we, us) is registered in England and Wales under company number 17113566. Our registered office is 89 Cardiff Road, Caerdydd, United Kingdom, CF15 7PL. We are registered with the Information Commissioner's Office under reference ZC190444.
Archway is the controller of personal information used to manage professional accounts, customer relationships, billing, service security, support, website enquiries, analytics, and our own legal obligations. This means we decide why and how that information is used.
When you enter applicant, client, lead, or introducer case information for your organisation, your organisation normally decides why that information is processed and is the controller. Archway processes it on your organisation's instructions as its processor. The applicant notice on this page explains that arrangement.
2. Information we collect
Depending on your relationship with us, we collect:
- your name, work email, telephone number, job title, organisation, FCA or network details, and professional role;
- account identifiers, password hashes, authentication factors, permissions, teams, and invitation records;
- subscription, package, billing, invoice, payment status, and limited payment metadata;
- support requests, feedback, call or meeting notes, enquiry details, and communications with us;
- IP address, device, browser, session, authentication, audit, feature-use, diagnostic, and security-event data;
- marketing preferences, consent records, campaign interactions, and cookie choices; and
- records needed for complaints, disputes, fraud prevention, insurance, and legal compliance.
We do not receive full payment-card details. Card payments are handled by our payment provider, which supplies us with transaction status and limited billing information.
3. Where the information comes from
We obtain professional-user information:
- directly from you when you enquire, register, use the Services, attend a demo, or contact support;
- from your employer, brokerage, network, lender, introducer firm, or account administrator;
- automatically from your device and use of the website and Services;
- from payment, identity, security, communications, analytics, and integration providers;
- from public professional sources, including Companies House, the FCA Register, and company websites; and
- from referrals, events, and business partners where they are permitted to share it.
4. How and why we use it
Provide and administer Archway
Create accounts, authenticate users, apply permissions, deliver features, process subscriptions, and support customers. We rely on performance of our contract and our legitimate interests in supplying the Services.
Secure and improve the Services
Prevent misuse, investigate incidents, maintain audit records, troubleshoot, measure performance, and improve workflows. We rely on legitimate interests in operating a secure and useful service and, where applicable, legal obligations.
Manage our business relationship
Respond to enquiries, arrange demonstrations, onboard firms, administer orders, collect fees, and manage renewals. We rely on contract steps, performance of contract, and legitimate interests in running our business.
Communicate and market
Send service notices and, where permitted, relevant product news or invitations. We rely on contract or legitimate interests for service messages and consent or the permitted business-marketing rules for marketing.
Comply and protect rights
Keep corporate and tax records, respond to lawful requests, handle complaints and legal claims, and protect Archway, customers, and others. We rely on legal obligations and legitimate interests.
Where we rely on legitimate interests, we consider the benefit, necessity, and effect on you. You may ask for more information about that assessment or object in the circumstances described below.
5. Applicant and Customer Data
Information you place in an applicant or client record is controlled by your organisation, not Archway, unless we expressly tell you otherwise. We handle that information only to provide and secure the Services, follow the organisation's documented instructions, meet our processor obligations, and comply with law.
Your organisation is responsible for its lawful basis, privacy information, special-category and criminal-offence conditions, retention decisions, data accuracy, rights responses, and the people with whom it shares case information. Our processor commitments are in the Data Processing Schedule.
6. Who receives your information
We share professional-user information only where necessary with:
- your organisation and its authorised administrators;
- database, hosting, backup, authentication, email, SMS, support, analytics, and security providers;
- Stripe for payments, Sentry for error monitoring, and Resend for email delivery;
- OpenAI and Anthropic when an authorised user invokes an enabled AI feature;
- PropertyData and selected lender, identity, AML, and integration providers when you use those features;
- professional advisers, auditors, insurers, prospective investors or purchasers under confidentiality duties; and
- regulators, courts, law enforcement, tax authorities, or other parties where disclosure is legally required or necessary to protect rights.
We do not sell personal information or share it for third-party behavioural advertising.
7. AI-assisted features
When you choose an AI-assisted feature, the prompt and relevant content needed for that task may be sent securely to OpenAI or Anthropic. We require those providers to process the content to provide and secure the feature, not to train their general-purpose models. Archway does not use Customer Data to train general-purpose AI models.
AI outputs are subject to human review and Archway does not make solely automated decisions about mortgage applicants. Your organisation controls whether a generated draft, extraction, or summary is used.
8. Data location and international transfers
Archway's primary production database and file storage are hosted in the London, United Kingdom region. We use encrypted rolling database backups retained for seven days. Some suppliers and authorised support personnel operate internationally, so limited information may be accessed or processed outside the UK.
Where a transfer is restricted, we use a lawful mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to approved standard contractual clauses. We also assess the transfer and use technical and organisational safeguards appropriate to the risk. Contact us for further information about a relevant safeguard.
9. How long we keep information
- Professional account and organisation records are normally kept for the subscription and 30-day export period.
- Residual encrypted customer backups are deleted through the routine backup cycle, normally within a further 35 days.
- Contracts, invoices, and core transaction records are normally kept for six years after the relevant relationship or financial period.
- Routine support and enquiry records are normally kept for up to two years after the last meaningful contact.
- Security, access, and audit logs are normally kept for up to 12 months, or longer where needed to investigate an incident or meet legal obligations.
- Marketing records are kept until you opt out or they are no longer useful; a minimal suppression record may then be retained to honour your choice.
We may keep a record longer where necessary for a complaint, legal claim, fraud or security investigation, regulatory request, or another legal obligation. We delete or anonymise it when that reason ends.
10. How we protect information
We use measures designed for the sensitivity and risk of mortgage information, including encryption in transit and at rest, role-based access controls, multi-factor authentication support, audit logging, encrypted backups, vulnerability management, penetration testing, incident-response procedures, and access restrictions for staff and suppliers. No system is completely secure, and users must also protect their accounts and devices.
11. Marketing and cookies
Operational messages about security, accounts, billing, or material service changes are part of the Services and are not marketing. You can unsubscribe from marketing at any time using the link in a message or by contacting us. We may keep a limited suppression record so we do not contact you again by mistake.
We use essential storage and similar technologies for authentication, security, preferences, and operation of the website and Services. Non-essential analytics or advertising technologies are used only after the required consent. You can refuse or withdraw that consent through our cookie controls without losing access to essential functions.
12. Your data protection rights
Depending on the circumstances, you may ask us for access to your information, correction, deletion, restriction, portability, or to object to processing based on legitimate interests or direct marketing. Where processing is based on consent, you may withdraw it without affecting earlier lawful processing. You also have rights relating to solely automated decisions; Archway does not use such decisions for applicants.
These rights are not absolute. We may need to verify your identity and may retain information where law permits or requires it. If your request concerns an applicant record controlled by your organisation, we will direct the request to that organisation and assist it as required.
13. Complaints, questions and contact
Email privacy questions, rights requests, or complaints to privacy@archwaysoftware.co.uk. Data protection complaints are overseen by tom.jones@archwaysoftware.co.uk. We will acknowledge a data protection complaint within 30 days, investigate it without undue delay, and tell you the outcome.
You can also write to Archway Software Limited, 89 Cardiff Road, Caerdydd, United Kingdom, CF15 7PL. If you are dissatisfied, you have the right to complain to the Information Commissioner's Office. We would appreciate the opportunity to address the issue first.
We may update this notice as our Services or legal obligations change. We will notify professional users of a material change through the Services, by email, or another reasonable channel. The effective date at the top shows when this version applies.