Privacy notice, Finance Process Intelligence (FPI), Arpero tools

This notice explains what happens to your information when you use FPI (Finance Process Intelligence), Arpero's online tool for reading how the processes of a finance function are run, or ask for an invitation to it. FPI is open by invitation.

In short

When you ask for an invitation or log in, we hold your name, your e-mail address and your organisation. We remove them when your invitation ends, or one month after we have said no to your request, or three months after you sent it if we have not answered it. If you have sent us your answers, your name and organisation stay with them until we delete them. Our e-mail service keeps a record of each e-mail it sends for us for 90 days (section 7).
Your answers stay on your computer while you work. To show you the free reading, the tool sends them to Arpero's server, which works it out and keeps no copy. Arpero keeps your answers only when you choose to send them to us.
We use your answers only to write your organisation's reports and talk them through with you. We do not reuse them, combine them with other organisations' answers, sell them, or share them outside Arpero.
We delete the answers you sent us, our copy of their full reading and our copies of your reports within one month after we have talked your report through with you, and three months after you sent them at the latest. You can ask us to do it sooner.
You can ask us at any time to show you, correct or delete what we hold about you. You can also complain to the Information Commissioner's Office.

1. Who we are

FPI is provided by Arpero Ltd, a company registered in England and Wales under number 09773011, with its registered office at 26 York Street, Harborne, Birmingham, B17 0HG ("Arpero", "we", "us").

We decide why and how your information is used, so we are its controller under UK data protection law: the UK General Data Protection Regulation and the Data Protection Act 2018.

To ask about your information, to use any of your rights, or to complain to us, email info@arpero.co.uk or write to us at the address above.

2. What we collect

Your request for an invitation, if you send one: your name, your work e-mail address, your organisation and when you sent it.
Your account, if you are invited: your name, the e-mail address you log in with, your organisation, who invited you, and when your invitation starts and ends. If someone else gave us your address, for example a colleague who asked us to invite you, we got it from them. We use it only to invite you and let you log in. If you also use Shape of Finance, Arpero's other tool, it is the same account.
Your log-ins: when you logged in and out, your internet (IP) address and details of your browser. Our log-in provider keeps these to run the log-in and keep it secure.
Your code. If Arpero gave you a code, it links your answers to your organisation. If not, the tool makes one, and we link it to your organisation when you send us your answers. Only Arpero holds that link, in our own list of the organisations we work with and the people who receive their reports (name, job title and work email address).
Your role, which you choose at the start, because it decides which questions you are asked.
Your answers. They are about how your organisation's finance processes are run: how each activity is done, the tools a step runs on, who takes part, how many people and how many hours, how often a step runs, the team's average hourly cost (or the rate you use for planning) and the saving you expect, and what you write in your own words about what goes well and what gets in the way. They are about your team, not about you. Your role, and what you write in your own words, can say something about you.
Your run, when you send it to us with the button "Send your answers to Arpero". Each time you finish an area, your run keeps that version of your answers, so it can hold several versions. Each press of the button sends a new copy. With your run we keep your name and organisation, taken from your account, so that we know who sent it.
The reports we write from your answers, and our own copy of the full reading of each version you send us.
Our own records: when your run arrived, and when we made and sent each report, who made it and who checked it. These records hold none of your answers. Your run also records which version of this notice and of the terms of use you agreed to, and when.
Technical information: your internet (IP) address and details of your browser, which our hosting provider handles to deliver the pages and protect the tool from attacks.

We do not ask about individuals, and we do not ask for sensitive information, such as information about health. Please do not name anyone, or include such information, in what you write in your own words, and give the team's average hourly cost or the rate you use for planning, never one person's pay. You do not have to answer every question, but we cannot write your report without your answers.

3. Where your answers are while you work

Your answers, and the free reading the tool shows you when you finish an area, are kept in your browser's own storage, on the computer you use, so that you can close the page and come back to it. To work out the free reading, the tool sends your answers to Arpero's server, run for us by Cloudflare. The server works out the reading, sends it back to your screen and keeps no copy; it writes none of your answers to a log. Nothing else is sent while you answer. To receive the full reading, press "Send your answers to Arpero": it sends your run to Arpero. Nothing is kept by Arpero until you press the button. You can also save your run as a file; it stays with you. "Finish and clear this computer" removes your answers from the browser; it does not touch any file you saved. On a shared computer, use it as soon as you have sent or saved your run.

When you log in, your browser keeps a record of your log-in (in its storage and in a cookie), so that you stay logged in. It is removed when you log out or your log-in ends. The tool uses no advertising or analytics cookies.

4. What we use your information for, and why we may

We use it to:

answer your request for an invitation, and invite you if we say yes;
let you log in, by sending a six-digit code to your e-mail address each time;
read your run and write your organisation's full reading, for each version you send us, as a PDF report;
send your report to you;
talk your report through with your organisation;
keep the tool secure, and keep a record of what we sent.

Before we send any report, one of us reads what you wrote in your own words, to check that it names nobody. If it does, we take the name out of the report and tell you. A second person checks the report before it goes.

Our legal basis is our legitimate interests, and your organisation's: ours in offering the tool, deciding who may use it and following it up with you, and your organisation's in receiving its reports (UK General Data Protection Regulation, article 6(1)(f)). Where the law requires us to keep a record, our basis is that legal obligation (article 6(1)(c)). You can object to our use of your information at any time (section 8).

We also write notes on how the tool worked for you, such as a question that was unclear, without your answers and without anyone's name, so that we can improve the tool.

What we do not do. We do not use your information for marketing, and we do not add you to a mailing list. We do not make decisions about you as a person: your reports read your organisation's processes from the answers given, by fixed rules and Arpero's own weighting, against Arpero's own description of the levels, never against other organisations. Whether to invite you is decided by a person at Arpero. If several people in your organisation answer, each run is read on its own; nothing is combined across people. FPI does not send your answers, or what you write, to an artificial intelligence service.

5. Who sees your information

Arpero: only the Arpero people who decide on invitations see your request for an invitation. Only the Arpero people who prepare and check reports see your answers.
The free reading is on your screen when you finish an area. You decide whether to save it and who to share it with.
Your full reading: we send it to you as a PDF file. Whoever you share your reports with can read them. Nobody else sees your answers.
Our suppliers, who may use your information only on our instructions: - Cloudflare, which hosts the tool, runs the server that works out your free reading, and protects the tool from attacks; - Supabase, which runs the log-in, holds your account and our list of the organisations we work with, and stores the runs you send us; - Mailjet, part of the Sinch group, which sends the log-in codes, our e-mails about your invitation, your request for an invitation to us, and a message to us that a run has arrived; - Microsoft, whose Microsoft 365 service holds Arpero's email and files: your request for an invitation and our reply arrive there, and we keep our copy of the full reading and your reports there.
Sinch on its own account: Sinch also uses the e-mail addresses it sends to, for its own purposes, to stop spam and fraud, keep its network secure and meet its legal duties. For that use Sinch is responsible itself; see its privacy policy at mailjet.com/legal/privacy-policy.
Nobody else, unless the law requires it.

6. Where your information is kept

Your account, your log-ins, the runs you send us and our list of the organisations we work with are kept by Supabase on servers in Frankfurt, Germany. Only the Arpero people who prepare and check reports can open your run there. Mailjet keeps its sending records on servers in the European Union (Germany and Belgium). Your request for an invitation, our reply, our copy of the full reading and your reports are kept in Arpero's Microsoft 365 email and file storage, open only to Arpero's own people.

When the tool works out your free reading, your answers pass through Cloudflare's servers, usually the one nearest to you, and are not kept there.

Cloudflare, Supabase, Sinch and Microsoft work worldwide and may handle information outside the UK and the European Union, including in the United States, for example when their support staff help us. Where they do, they are bound by the safeguards UK data protection law requires for such transfers, set out in their data protection terms with us. You can ask us for details.

7. How long we keep it

A request we say no to, and our reply: we delete them from our mailbox one month after we have replied.
A request we say yes to becomes your account; we delete the request e-mail and our reply from our mailbox one month after we have replied.
A request we have not answered: we delete it from our mailbox three months after you sent it.
Your account (your name, your e-mail address and your invitation): we remove it when your invitation ends. After that, it is gone from our log-in provider's backups within seven days. Our record of the invitation keeps only your organisation, who invited you and the dates, with nothing that names you. If you also use Shape of Finance, it is the same account, with one end date for both tools. If you have sent us your run, your name and organisation stay with it until the run is deleted (below).
Your log-ins: kept by our log-in provider for seven days.
Mailjet's records of the e-mails it sends for us: each record holds the address the e-mail went to, when it was sent, and its subject line. No subject line names you or your organisation. Mailjet keeps each record for 90 days after the e-mail was sent. The records hold none of your answers. We remove your address from Mailjet's list of contacts when your account is removed. Records of e-mails already sent stay until their 90 days have passed, but from then on they show "Deleted Contact" in place of your address. Sinch keeps what it needs for its own purposes (section 5) only as long as it needs it, as its privacy policy says.
Each run you send us, your name and organisation kept with it, our copy of its full reading and our copies of the reports made from it: we delete them within one month after we have talked the report through with you, and three months after you sent that run at the latest, also if no talk-through takes place. A later run does not extend the date of an earlier one. If you ask us to delete them sooner, we do so within five working days. This applies wherever we keep them: in Supabase, which keeps no backup copy of the run itself, so once deleted it cannot be recovered (the name and organisation kept with it stay in Supabase's daily backups for seven days more); and in our Microsoft 365 email and files.
The contact details of the people who receive your reports: we remove them when your organisation's use of the tool ends. Supabase's daily backups keep a copy for seven days more.
Copies you saved, or shared with others, are yours, and are not affected.

You can stop at any time. If you change your mind after you have sent us your answers, write to us and we will delete it. If you want your account removed before your invitation ends, write to us.

8. Your rights

You have the right to:

ask for a copy of the information we hold about you;
have it corrected if it is wrong;
have it deleted;
ask us to restrict how we use it;
object to our using it.

Some of these rights apply only in certain circumstances. To use any of them, write to us (section 1). It is free. We answer within one month, or tell you within that month if we need longer, as the law allows for complex requests. We may ask you to confirm who you are.

If you are unhappy with how we have handled your information, you can complain to us first (section 1). We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office, the UK regulator: ico.org.uk, or 0303 123 1113.

9. Arpero's other privacy policy

Arpero's privacy policy at arperocompany.com covers Arpero's company website and its other work. For FPI, this notice applies. Where the two differ, this notice applies.

10. Changes to this notice

The version and date are below. If we change what we do with information you have already given us, we will tell you before the change applies to it.

11. If you work for Arpero

Arpero's own people log in on their own log-in page, with their e-mail address, a password and a code from an authenticator app. Supabase holds their account and log-ins as in sections 6 and 7. Their account has no end date; it is removed when they leave Arpero.