Privacy Notice

ARC XII LIMITED is a company incorporated in England and Wales.

Company number

17446143

Registered office

Sutton Business Centre, Restmor Way, Wallington, SM6 7AH

Website

arcxii.co.uk

Privacy enquiries

info@arcxii.co.uk

For personal information collected directly through the Arc XII public website and our business enquiries, ARC XII LIMITED is the data controller. This means we decide why and how that information is used.

This notice applies when you:

• visit the Arc XII public website;
• register your interest in Arc XII;
• request a demonstration;
• make an enquiry about our products or services; or
• contact us in connection with the website or a prospective business relationship.

The Arc XII platform may also process information on behalf of schools and other organisations using our services. Where a school uses Arc XII to process pupil or staff information, the school's and Arc XII's respective data protection responsibilities are governed by the relevant customer agreement and data processing terms.

This website Privacy Notice is therefore not intended to replace the privacy information provided by schools to pupils, parents, carers or staff.

When you complete an enquiry or demonstration request, we may collect:

• your name;
• your job role;
• the name of your school, Trust or organisation;
• your work email address;
• your telephone number, if you choose to provide it;
• the type of setting you work in;
• the Arc XII package you are interested in;
• whether you would like a demonstration or further information; and
• anything else you choose to include in your message.

We may also keep relevant correspondence when you communicate with us by email or another business communication channel.

When you use our website, limited technical information may be processed automatically to operate, protect and understand the website. This may include information such as:

• IP address;
• browser and device information;
• pages visited;
• referring page or website;
• date and time information;
• security and diagnostic information; and
• cookie or preference information.

The exact information available to us may depend on the website services and cookie choices in use.

The public enquiry form is intended for business enquiries.

Please do not include pupil names, SEND information, health information, assessment information, photographs, evidence or other sensitive personal information about a child or young person in the enquiry form.

Schools using the Arc XII platform should use the appropriate secure platform functions and agreed processes for information relating to pupils.

We use the personal information we collect for the following purposes.

To respond to your enquiry or demonstration request

When you contact us through the website, we use your information to respond to your enquiry, provide information about Arc XII and arrange a demonstration if you have requested one. The legal basis for this processing is our legitimate interests in responding to prospective customers and developing our business.

To manage our relationship with you and your organisation

If you become a customer or continue to engage with us following an initial enquiry, we use your information to manage that relationship — including communicating about your account, providing support and sending relevant information about the platform. The legal basis is the performance of a contract where one exists, or our legitimate interests in maintaining a business relationship where it does not.

To send you information about Arc XII

With your agreement, or where we have a legitimate interest in doing so, we may send you information about Arc XII, including updates to the platform, relevant resources or information about our services. You can opt out of marketing communications at any time by contacting us at info@arcxii.co.uk or by using the unsubscribe link in any email we send.

To operate and improve the website

We use technical information collected through the website to keep it functioning correctly, to protect it from misuse and to understand how it is being used so that we can improve it. The legal basis for this processing is our legitimate interests in operating a secure and effective website.

To comply with legal obligations

Where we are required to process personal information to comply with a legal obligation — for example, to respond to a lawful request from a regulatory authority — we will do so on that basis.

We use cookies and similar technologies on the Arc XII website. Cookies are small text files stored on your device that help us operate the website and, where you consent, understand how it is used.

Essential cookies are necessary for the website to function and are set without your consent. They do not track you for marketing purposes.

Analytics cookies help us understand how visitors use the website — for example, which pages are visited most often and whether visitors encounter errors. We only set analytics cookies if you give your consent through our cookie banner.

You can change your cookie preferences at any time using the cookie settings link in the footer of this website.

For full details of the cookies we use, please see our Cookie Policy.

We do not sell personal information to third parties.

We may share your information with:

• service providers who help us operate the website and our business, such as email delivery services, hosting providers and analytics services — these providers are only permitted to use your information to provide services to us and are required to keep it secure;
• professional advisers, such as legal or financial advisers, where necessary and subject to confidentiality obligations; and
• regulatory authorities or law enforcement agencies, where we are required to do so by law or to protect the rights, property or safety of Arc XII, our customers or others.

Where we share information with service providers outside the United Kingdom, we take steps to ensure that appropriate safeguards are in place in accordance with applicable data protection law.

We keep personal information only for as long as is necessary for the purposes described in this notice, or as required by law.

Enquiry and contact information is generally retained for as long as is reasonably necessary to manage the relationship with you or your organisation, and for a period afterwards in case of any follow-up queries or legal requirements.

Website technical and analytics information is retained in accordance with the settings of the relevant service and for no longer than is necessary for the purposes for which it was collected.

Where we no longer need personal information, we delete or anonymise it securely.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights in relation to your personal information.

• The right to be informed — you have the right to be told how we use your personal information. This notice is part of how we fulfil that obligation.
• The right of access — you have the right to request a copy of the personal information we hold about you.
• The right to rectification — you have the right to ask us to correct personal information that is inaccurate or incomplete.
• The right to erasure — in certain circumstances, you have the right to ask us to delete your personal information.
• The right to restrict processing — in certain circumstances, you have the right to ask us to limit how we use your personal information.
• The right to data portability — in certain circumstances, you have the right to receive your personal information in a structured, commonly used and machine-readable format.
• The right to object — you have the right to object to our processing of your personal information where we rely on legitimate interests as our legal basis. You also have an unconditional right to object to your personal information being used for direct marketing.
• Rights in relation to automated decision-making — you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not carry out such processing in relation to the information covered by this notice.

To exercise any of these rights, please contact us at info@arcxii.co.uk. We will respond within one month of receiving your request. In some cases we may need to verify your identity before we can action your request.

There is no charge for making a request, unless it is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to respond.

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, destruction or alteration. These measures are reviewed and updated as necessary.

Where we use third-party service providers to process personal information on our behalf, we require them to implement appropriate security measures and to process information only in accordance with our instructions.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

If you have a concern about how we have handled your personal information, please contact us in the first instance at info@arcxii.co.uk. We will do our best to resolve your concern promptly.

If you are not satisfied with our response, or if you believe we are processing your personal information in a way that does not comply with data protection law, you have the right to make a complaint to the Information Commissioner's Office (ICO).

Telephone

0303 123 1113

Website

ico.org.uk

You also have the right to seek a remedy through the courts.

We may update this Privacy Notice from time to time to reflect changes in our practices, the services we offer or applicable law. When we make changes, we will update the date at the top of this notice.

We encourage you to review this notice periodically. Where changes are significant, we will take reasonable steps to bring them to your attention.

This notice was last updated on 30 October 2026.