Privacy Policy

Last updated: 29 September 2026

1. Who we are

ARCA Desk is operated by 3Roc Ltd, a company registered in England and Wales. We are registered with the UK Information Commissioner's Office (ICO). For data protection enquiries, contact us at privacy@3roc.co.uk.

2. Data we collect

We collect the following categories of personal data:

  • Account data: name, email address, job title, and password hash.
  • Usage data: ticket content, comments, knowledge base activity, and login events.
  • Technical data: IP address, browser type, session tokens, and audit logs.
  • Payment data: billing contact details and Stripe customer references (we do not store full card numbers).

3. How we use your data

We use personal data to:

  • Provide and operate the ARCA Desk platform.
  • Authenticate users and maintain security.
  • Send service notifications (ticket updates, SLA alerts, CSAT requests).
  • Process payments via Stripe.
  • Comply with legal obligations.

4. Legal basis

We process personal data under the following legal bases under UK GDPR: contract performance (to provide the service), legitimate interests (security and fraud prevention), and legal obligation (HMRC and regulatory compliance).

5. Data storage and transfers

The customer database is held in Ireland. Our infrastructure providers (AWS, Supabase, Stripe) operate under Data Processing Agreements compliant with UK GDPR.

6. Data retention

We retain account data for the duration of your subscription plus 90 days after cancellation, unless you request earlier deletion. Ticket data, including comments, attachments and other content kept on the ticket, is retained for the duration of your subscription.

Sign-in and sign-out audit entries (login and logout, including failed and locked sign-in attempts) are removed after 30 days. Other audit log entries are retained for 12 months and are not removed by that 30-day job.

Apart from the sign-in and sign-out entries described above, these retention periods are not applied by an automatic deletion job.

7. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate personal data.
  • Request deletion of your personal data.
  • Object to processing or request restriction.
  • Data portability (receive your data in a structured format).

To exercise any of these rights, contact privacy@3roc.co.uk.

8. Cookies

We use essential cookies for authentication and session management. See our Cookie Policy for full details.

9. Contact

For any privacy-related enquiries, contact our Data Protection contact at privacy@3roc.co.uk. You also have the right to lodge a complaint with the ICO at ico.org.uk.