Privacy policy.

01 · Who controls your data

Arc-One is the data controller for the personal data described in this policy, and is registered in England and Wales.

You can reach us about anything in this policy at the address on our contact page.

02 · What we collect

• What you type into our contact form: your name, work email, company, an indication of size and budget, and whatever you tell us about the problem.
• Correspondence: emails, call notes and anything else exchanged while we work out whether to work together.
• Engagement records: the scope documents, invoices and delivery records an engagement produces.
• Website analytics: which pages are viewed, the site that referred the visit, the country it came from and the class of device (phone, tablet or desktop), counted in aggregate by our hosting provider’s analytics. It sets no cookies and stores no personal data: nothing in it identifies you.

03 · Why we collect it, and our lawful basis

• To reply to an enquiry and work out whether we can help — our legitimate interest in responding to someone who contacted us.
• To deliver an engagement and invoice for it — performance of a contract.
• To keep accounting and tax records — a legal obligation.
• To understand which pages are read — our legitimate interest in improving the site, using data that does not identify anyone.

04 · What we do not do

• We do not sell personal data, and we do not share it with anyone for their own marketing.
• We do not use advertising or tracking cookies, and we do not build profiles of visitors.
• We do not send marketing email to people who have not asked for it.

05 · Client data inside an engagement

Where an engagement requires us to process personal data belonging to your business, you remain the controller and we act as your processor under a written data-processing agreement.

That agreement sets out what we may do with the data, the security we apply, our use of any sub-processors, and what happens to the data when the engagement ends.

We work on the minimum data needed to build the thing, and we prefer anonymised or synthetic data wherever the work allows it.

06 · Who else touches it

We use a small number of service providers to run the business — website hosting, email, document storage, accounting and analytics. Each processes data only on our instructions.

Where data leaves the UK, transfers are made under the safeguards UK data-protection law requires. Ask us and we will tell you which providers hold what.

07 · How long we keep it

• Enquiries that do not become engagements: up to 24 months, then deleted.
• Engagement and correspondence records: for the duration of the engagement and 6 years afterwards.
• Accounting records: 6 years from the end of the relevant financial year, as tax law requires.

08 · Your rights

Under UK data-protection law you can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on consent, you can withdraw it at any time.

Ask us and we will respond within one month. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk.

09 · Security

Access to client material is limited to the people working on that engagement. Credentials are held in a password manager, not in documents or messages, and systems holding client data require authentication.

If a breach occurs that is likely to risk your rights, we will tell the Information Commissioner’s Office within 72 hours and tell you without undue delay.

10 · Changes to this policy

When this policy changes we will update the date at the foot of the page. Material changes affecting an existing engagement will be told to you directly.