This notice explains what happens to your information when you use Shape of Finance, Arpero's online tool at sof.arperotools.com, or ask for an invitation to it. Shape of Finance is open by invitation.
In short
- When you ask for an invitation or log in, we hold your name, your e-mail address and your organisation. We remove them when your invitation ends, or one month after we have said no to your request. If you have sent us your run, your name and organisation stay with it until we delete it. Our e-mail service keeps a record of each e-mail it sends for us for 90 days (section 7).
- Your answers stay on your device while you work. Nothing reaches Arpero until you choose to send them to us.
- If you ask us for support or a guided session, we hold your request and delete it one month after we have dealt with it.
- We use your answers only to write your organisation's reports and talk them through with you. We do not reuse them, combine them with other organisations' answers, sell them, or share them outside Arpero.
- We delete your run file and our copies of your reports within one month after we have talked your report through with you, and three months after you sent your run at the latest. You can ask us to do it sooner.
- You can ask us at any time to show you, correct or delete what we hold about you. You can also complain to the Information Commissioner's Office.
1. Who we are
Shape of Finance is provided by Arpero Ltd, a company registered in England and Wales under number 09773011, with its registered office at 26 York Street, Harborne, Birmingham, B17 0HG ("Arpero", "we", "us").
We decide why and how your information is used, so we are its controller under UK data protection law: the UK General Data Protection Regulation and the Data Protection Act 2018.
To ask about your information, to use any of your rights, or to complain to us, email info@arpero.co.uk or write to us at the address above.
2. What we collect
- Your request for an invitation, if you send one: your name, your work e-mail address, your organisation and when you sent it.
- Your account, if you are invited: your name, the e-mail address you log in with, your organisation, who invited you, and when your invitation starts and ends. If someone else gave us your address, for example a colleague who asked us to invite you, we got it from them. We use it only to invite you and let you log in.
- Your log-ins: when you logged in and out, your internet (IP) address and details of your browser. Our log-in provider keeps these to run the log-in and keep it secure.
- Your code from Arpero. It links your answers to your organisation. Only Arpero holds that link, in our own list of the organisations we work with and the people who receive their reports (name, job title and work email address).
- Your answers. Most of them are about how your organisation's finance function works, not about you. Your role, and what you write in your own words, can say something about you.
- Your requests for support or a guided session, if you send one: what you write in it, the times that suit you, when you sent it, and your name, e-mail address and organisation from your account.
- A recording or transcript of a guided session, only if everyone on the call has agreed to it (section 4).
- Your run file, when you send it to us with the button "Send your answers to Arpero", or with a request for support if you tick the box to send your answers so far. If you e-mail it to us instead, we also hold that email (your name, your email address and anything you write in it). With your run we keep your name and organisation, taken from your account, so that we know who sent it.
- The reports we write from your answers.
- Our own records: when your run arrived, when we released and sent your report and who checked it, and what we deleted and when. These records hold none of your answers. Your run also records which version of this notice and of the terms of use you saw.
- Technical information: your internet (IP) address and details of your browser, which our hosting provider handles to deliver the pages and protect the tool from attacks.
We do not ask about individuals, and we do not ask for sensitive information, such as information about health. Please do not name anyone, or include such information, in what you write in your own words, in your answers or in a request. You do not have to answer every question, but we cannot write your report without your answers.
3. Where your answers are while you work
Your answers are kept in your browser's own storage, on the device you use (a computer, a tablet or a phone), so that you can close the page and come back to it. They are not sent to Arpero while you answer. When you finish, the button "Send your answers to Arpero" sends your run to Arpero. A request for support sends your answers so far only if you tick the box for it. Nothing is sent until you press the button. You can also save your run as a file for yourself. "Finish and clear this device" then removes your answers from the browser. On a shared device, use it as soon as you have sent or saved your run.
When you log in, your browser keeps a record of your log-in (in its storage and in a cookie), so that you stay logged in. It is removed when you log out or your log-in ends. The tool uses no advertising or analytics cookies.
4. What we use your information for, and why we may
We use it to:
- answer your request for an invitation, and invite you if we say yes;
- answer your requests for support, and arrange and hold a guided session with you if you ask for one;
- let you log in, by sending a six-digit code to your e-mail address each time;
- read your run and write your organisation's reports;
- send your full report to you and, if you answer on your chief financial officer's (CFO's) behalf, to your CFO;
- talk your report through with your organisation;
- keep the tool secure, and keep a record of what we released and what we deleted.
Our legal basis is our legitimate interests, and your organisation's: ours in offering the tool, deciding who may use it and following it up with you, and your organisation's in receiving its reports (UK General Data Protection Regulation, article 6(1)(f)). Where the law requires us to keep a record, our basis is that legal obligation (article 6(1)(c)). For a recording or transcript of a guided session, our basis is your agreement (article 6(1)(a)), which you can withdraw at any time. You can object to our use of your information at any time (section 8).
We also write notes on how the tool worked for you, such as a question that was unclear, without your answers and without anyone's name, so that we can improve the tool.
What we do not do. We do not use your information for marketing, and we do not add you to a mailing list. We do not make decisions about you as a person: your reports draw conclusions about your organisation's finance function from the answers given, by fixed rules. Whether to invite you is decided by a person at Arpero. Shape of Finance does not send your answers to an artificial intelligence service.
Guided sessions. We do not record or transcribe a guided session, unless everyone on the call has explicitly agreed to it beforehand. If they have, we keep the recording and any transcript in our Microsoft 365 files, open only to the Arpero people working with your organisation, and use them only to write your organisation's reports. Anyone on the call can withdraw their agreement at any time; we then stop recording, and delete the recording if they ask.
5. Who sees your information
- Arpero: only the Arpero people who decide on invitations see your request for an invitation. Your requests for support or a guided session reach the same people, and the Arpero people working with your organisation. Only the Arpero people working with your organisation see your answers.
- Your short report is on your screen when you finish. You decide whether to save it and who to share it with.
- Your full report: we send it to you as a PDF file. If you answer on your CFO's behalf, we also send it to your CFO. Whoever you share your reports with can read them. Nobody else sees your answers.
- Our suppliers, who may use your information only on our instructions: - Cloudflare, which hosts the tool and protects it from attacks; - Supabase, which runs the log-in, holds your account and stores the run files you send us; - Mailjet, part of the Sinch group, which sends the log-in codes, our e-mails about your invitation, and your requests to us (for an invitation, for support or for a guided session); - Microsoft, whose Microsoft Teams service we use for guided sessions, and whose Microsoft 365 service holds Arpero's email and files, where we keep your requests, your reports, and any run file you e-mail us instead.
- Sinch on its own account: Sinch also uses the e-mail addresses it sends to, for its own purposes, to stop spam and fraud, keep its network secure and meet its legal duties. For that use Sinch is responsible itself; see its privacy policy at mailjet.com/legal/privacy-policy.
- A call on your own service: if you invite us to a guided session on your organisation's own call service, we join it as your guest. That service is your organisation's, under its own terms, not one of our suppliers.
- Nobody else, unless the law requires it.
6. Where your information is kept
Your account, your log-ins and the run files you send us are kept by Supabase on servers in Frankfurt, Germany. Only the Arpero people working with your organisation can open your run file there. Mailjet keeps its sending records on servers in the European Union (Germany and Belgium). Your requests, your reports and any run file you e-mail us are kept in Arpero's Microsoft 365 email and file storage, open only to the Arpero people named in section 5.
Cloudflare, Supabase, Sinch and Microsoft work worldwide and may handle information outside the UK and the European Union, including in the United States, for example when their support staff help us. Where they do, they are bound by the safeguards UK data protection law requires for such transfers, set out in their data protection terms with us. You can ask us for details.
7. How long we keep it
- A request we say no to, and our reply: we delete them one month after we have replied.
- A request we say yes to becomes your account.
- A request for support or a guided session, and our replies: we delete them one month after we have dealt with it, that is, after we have answered it or held the session. Answers you sent with a request are kept as a run file (below).
- Your account (your name, your e-mail address and your invitation): we remove it when your invitation ends. After that, it is gone from our log-in provider's backups within seven days. Our record of the invitation keeps only your organisation, who invited you and the dates, with nothing that names you. If you have sent us your run, your name and organisation stay with it until the run is deleted (below).
- Your log-ins: kept by our log-in provider for seven days.
- Mailjet's records of the e-mails it sends for us: the log-in codes and our e-mails to you, and your requests to us. Each record holds the address the e-mail went to, when it was sent, and its subject line. No subject line names you or your organisation. Mailjet keeps each record for 90 days after the e-mail was sent, also when we have deleted the request itself sooner. The records hold none of your answers. We remove your address from Mailjet's list of contacts when your account is removed. Records of e-mails already sent stay until their 90 days have passed, but from then on they show "Deleted Contact" in place of your address. Sinch keeps what it needs for its own purposes (section 5) only as long as it needs it, as its privacy policy says.
- A recording or transcript of a guided session: we delete it one month after the session, or sooner if anyone on the call asks.
- Your run file, your name and organisation kept with it, any email you sent it with, and our copies of your reports: we delete them within one month after we have talked your report through with you, and three months after you sent your run at the latest, also if no talk-through takes place. If you ask us to delete them sooner, we do so within five working days. This applies wherever we keep them: in Supabase's storage, which keeps no backup copy of the file, so once deleted it cannot be recovered; and in our Microsoft 365 email and files.
- The contact details of the people who receive your reports: we remove them when your organisation's use of the tool ends.
- Our record of what we deleted and when: we keep it for six years, so that we can show we kept our promise. It holds none of your answers.
- Copies you saved, or shared with others, are yours, and are not affected.
You can stop at any time. If you change your mind after you have sent us your run, write to us and we will delete it. If you want your account removed before your invitation ends, write to us.
8. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- have it corrected if it is wrong;
- have it deleted;
- ask us to restrict how we use it;
- object to our using it.
Some of these rights apply only in certain circumstances. To use any of them, write to us (section 1). It is free. We answer within one month, or tell you within that month if we need longer, as the law allows for complex requests. We may ask you to confirm who you are.
If you are unhappy with how we have handled your information, you can complain to us first (section 1). We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. You also have the right to complain to the Information Commissioner's Office, the UK regulator: ico.org.uk, or 0303 123 1113.
9. Arpero's other privacy policy
Arpero's privacy policy at arperocompany.com covers Arpero's company website and its other work. For Shape of Finance, this notice applies. Where the two differ, this notice applies.
10. Changes to this notice
The version and date are below. If we change what we do with information you have already given us, we will tell you before the change applies to it.
11. If you work for Arpero
Arpero's own people log in on their own log-in page, with their e-mail address, a password and a code from an authenticator app. Supabase holds their account and log-ins as in sections 6 and 7. Their account has no end date; it is removed when they leave Arpero.