1. Scope of This Privacy Notice

This Privacy Statement applies to personal information ArqaOne handles for its own business purposes, including information about website visitors, prospective clients, business contacts, newsletter subscribers, and other people who communicate directly with us.

This privacy statement does not replace any project-specific privacy notice, data processing agreement, business associate agreement, confidentiality agreement, or other contractual terms that may apply to a particular service or platform.

2. Client Data and ArqaOne's Role as a Service Provider

In many consulting, implementation, analytics, platform-development, or AI-integration engagements, ArqaOne may process personal information on behalf of a client and according to that client's instructions. In those circumstances, the client generally determines why and how the data is used, and ArqaOne acts as a service provider, processor, contractor, or business associate, as applicable.

Personal information processed solely on behalf of a client is governed primarily by the applicable client agreement and any data-processing or business-associate terms. Requests concerning such data may need to be directed to the client that controls the data.

Please do not submit Social Security numbers, financial account credentials, medical records, protected health information, or other highly sensitive information through ArqaOne's general website contact forms unless we specifically instruct you to use an approved secure channel.

3. Personal Information We Collect

3.1 Information You Provide

Depending on how you interact with us, you may provide:

• Contact information, such as your name, email address, phone number, and company or organization.
• Professional and business information, such as job title, industry, organization size, business needs, or project interests.
• Communications and inquiry content, including messages, consultation requests, feedback, and information you choose to provide.
• Marketing preferences, including newsletter or communication preferences.
• Transaction and relationship information, where applicable, such as proposals, contracts, invoices, and records of services requested or provided.

3.2 Information Collected Automatically

When you use our website, our service providers and we may automatically collect technical and usage information. This information may be personal information under applicable law even when it does not directly identify you by name.

• Internet Protocol (IP) address and approximate location derived from the IP address.
• Browser type, device type, operating system, language, and device settings.
• Pages viewed, links or buttons selected, referring pages, timestamps, session information, and other interactions with the website.
• Cookie identifiers and similar online identifiers, where used.

3.3 Information From Other Sources

We may receive business contact or relationship information from service providers, referral partners, publicly available sources, professional networks, or organizations with which you are affiliated. We use that information only for legitimate business purposes and as permitted by applicable law.

4. How We Use Personal Information

We may use personal information to:

• Respond to inquiries, schedule consultations, prepare proposals, and communicate about requested services.
• Establish, manage, and perform business relationships and contracts.
• Operate, maintain, secure, troubleshoot, and improve our website, systems, and services.
• Analyze website usage and business trends and measure the effectiveness of our content and communications.
• Send newsletters, service updates, educational content, or marketing communications where permitted by law and consistent with your preferences.
• Prevent fraud, misuse, security incidents, and other harmful or unlawful activity.
• Comply with legal, regulatory, tax, accounting, contractual, and recordkeeping obligations.
• Establish, exercise, or defend legal claims and protect the rights, property, safety, and security of ArqaOne, our clients, and others.

5. Cookies and Similar Technologies

Our website currently uses Vercel Web Analytics to understand how the website is used. This analytics service does not use cookies and does not create a persistent identifier for you or your device. It reports aggregated, anonymized usage data, such as which pages are viewed, referring pages, and general device and location information (see Section 3.2) — not information that identifies you individually.

We use this analytics data only to understand overall usage of the website and improve it. We do not use it for advertising, do not build advertising profiles from it, and do not sell it or share it with third parties for their own marketing purposes.

Because this analytics is always on and there is nothing to individually opt into or out of, we show a one-time on-site notice describing it rather than a cookie-consent banner with choices. You can review that notice, and this section, at any time.

The website may also employ cookies, pixels, local storage, or similar technologies for other purposes. Depending on the tools enabled on the website, these technologies may support:

• Strictly necessary functions, such as security, network management, form functionality, and session management.
• Analytics and performance measurement, including page usage, traffic sources, and website performance.
• Functional preferences, such as remembering user choices where applicable.

We use browser local storage for a small number of interface preferences you control directly — your light/dark theme choice, and whether you have dismissed the analytics notice described above. That information stays on your device; it is not transmitted to us and is not used for tracking.

ArqaOne does not currently use personal information collected through this website for cross-context behavioral or targeted advertising. If that practice changes, we will update this Privacy Statement and supply any legally required opt-out mechanism.

You can control cookies via your browser and, when available, through website cookie settings. Blocking some cookies may affect webpage functionality. Where required by applicable law, we will provide additional notice or choices for nonmandatory cookies and similar technologies.

6. How We Disclose Personal Information

We may disclose personal information only as reasonably necessary for the purposes described in this Privacy Statement, including to the following categories of recipients:

• Website, hosting, cloud, form, and infrastructure providers that help operate our website and systems.
• Communications, scheduling, customer relationship management, email, and marketing service providers.
• Analytics, security, fraud-prevention, and technical support providers.
• Accounting, payment, insurance, legal, and other professional advisers where relevant to our business relationship or legal obligations.
• Subcontractors or implementation partners involved in a client engagement, subject to appropriate contractual and confidentiality requirements.
• Government authorities, regulators, courts, law enforcement, or other parties when disclosure is required or permitted by law.
• A purchaser, successor, lender, investor, or adviser in connection with an actual or proposed merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction, subject to appropriate safeguards.

Service providers may process personal information on our behalf under contractual restrictions. Some recipients, such as professional advisers or payment providers, may act as independent controllers for limited purposes required by law or their professional obligations.

7. Sale, Targeted Advertising, and Profiling

ArqaOne does not sell personal information for monetary consideration and does not currently sell personal data as defined by the Minnesota Consumer Data Privacy Act. We also do not currently use publicly available personal information for targeted advertising based on activity across unaffiliated websites or applications.

We do not use personal information collected through the public website to make solely automated decisions that produce legal or similarly significant effects concerning an individual. If we introduce a practice that creates an opt-out right under applicable law, we will update this notice and provide a clear method to exercise that right.

8. AI-Enabled Tools and Automation

ArqaOne may use AI-enabled or automated tools to support internal productivity, analysis, drafting, classification, troubleshooting, or client service delivery. We apply these tools according to the sensitivity of the information involved, applicable contractual requirements, and reasonable security controls.

When ArqaOne processes client data with AI-enabled tools as part of an engagement, that processing is governed by the applicable client instructions, contractual terms, data processing terms, and, where relevant, business associate requirements. The public website privacy statement does not expand ArqaOne's rights to use client confidential information.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Statement, to maintain appropriate business and legal records, and to satisfy contractual or legal obligations. The retention period depends on the type of information, the nature of our relationship with you, and applicable requirements.

Our retention decisions generally consider the following categories and criteria:

• Website inquiry and prospect records: for a reasonable period after the last meaningful interaction, unless needed for an active or anticipated business relationship.
• Marketing records: while you remain subscribed or engaged, plus limited suppression records needed to honor opt-out requests.
• Client contracts, invoices, and core business records: for the period required by applicable tax, accounting, contractual, insurance, and legal requirements.
• Technical, security, and analytics records: for the period reasonably necessary for security, troubleshooting, measurement, and fraud prevention.
• Client-controlled project data: according to the applicable client agreement, documented instructions, and any legal or regulatory retention requirements.

When information is no longer reasonably necessary, we delete, anonymize, or securely dispose of it in accordance with our retention practices.

10. Data Security

We use reasonable administrative, technical, and physical safeguards designed to safeguard personal information against unauthorized access, disclosure, alteration, loss, or misuse. Safeguards may include access controls, secure cloud services, encryption where appropriate, authentication controls, system monitoring, backup and recovery practices, vendor management, and confidentiality requirements.

No method of transmission or storage is completely secure. We therefore cannot assure total security, but we review safeguards in light of the nature and sensitivity of the information we handle. If a security incident requires notice under applicable law or contract, we will provide notice as required.

11. Your Choices and Privacy Rights

11.1 Marketing Communications

You may unsubscribe from marketing emails using the unsubscribe link in the message or by contacting us. Opting out of marketing does not prevent us from sending transactional, service-related, security, or legal communications when appropriate.

11.2 Rights Under Applicable U.S. State Privacy Laws

Depending on your state, the context in which you interact with ArqaOne, and whether the applicable law covers ArqaOne or the data at issue, you may have rights to:

• Confirm whether we process and access your personal information.
• Correct inaccurate personal information.
• Delete personal information, subject to legal exceptions.
• Obtain certain personal information in a portable format.
• Opt out of sale, targeted advertising, or certain profiling, where those activities occur, and the law provides such a right.
• Obtain information about categories or specific third parties to which personal information has been disclosed, where required by law.
• Appeal a decision we make regarding a privacy-rights request, where applicable.
• Exercise privacy rights without unlawful discrimination.

Minnesota's Consumer Data Privacy Act became effective July 31, 2025. Its full controller obligations apply only to entities that meet the statutory scope criteria and include an exemption for qualifying small businesses. However, small businesses remain prohibited from selling a consumer's sensitive data without prior consent. ArqaOne will apply Minnesota-specific rights when the Act applies to the relevant processing.

11.3 How to Submit a Privacy Request or Appeal

To submit a privacy request, email support@arqaone.com with the subject line “Privacy Request” and describe the right you wish to exercise. To appeal a decision on a request where an appeal right is available, use the subject line “Privacy Appeal.”

We may request information reasonably necessary to verify your identity or your authority to act on behalf of another person. We will use verification information only for processing the request and will respond within the time required by applicable law.

12. GDPR and UK Data Protection Rights, When Applicable

Where the EU General Data Protection Regulation (GDPR) or UK data protection law applies to ArqaOne's processing, we provide the rights and information required by those laws. Applicability depends on the nature and territorial scope of the processing, including whether relevant activities involve offering goods or services to individuals in the applicable jurisdiction or monitoring their behavior there.

If the GDPR or UK GDPR applies to ArqaOne's processing of your personal data, our legal basis may include performance of a contract or steps requested before entering a contract, our legitimate interests in operating and securing our business and communicating about relevant services, fulfillment of legal obligations, or consent where consent is required.

Subject to applicable law and exceptions, you may have rights of access, correction, erasure, restriction, portability, objection, withdrawal of consent, and the right to lodge a complaint with a competent supervisory authority. Where personal data is transferred internationally, ArqaOne will use an appropriate transfer mechanism when required by law.

13. International Processing

ArqaOne is based in the United States. Personal information may be stored or processed in the United States or other locations where our service providers operate. Privacy and data-protection laws in those locations may differ from the laws where you live. Where applicable law requires additional safeguards for an international transfer, we will use appropriate contractual or other legal mechanisms.

14. Children's Privacy

ArqaOne's public website and services are directed to businesses and professionals and are not intended for children. We do not knowingly collect personal information from children under 13 through the public website. If we learn that we collected such information without appropriate authorization, we will take reasonable steps to delete it.

Where a client engagement involves information about minors, that information is processed under the client's instructions, applicable contract terms, and applicable law.

15. Third-Party Websites and Services

Our website may link to third-party websites or services. ArqaOne is not responsible for the privacy, security, or content practices of third parties. We encourage you to review their privacy notices before providing personal information.

16. Changes to This Privacy Notice

We may update this Privacy Notice to reflect updates in our services, technologies, business practices, or legal obligations. We will post the revised policy on this page and update the “Last updated” date. When required by applicable law, we will provide additional notice of material changes or obtain consent before materially different processing.

17. Text Messaging (SMS) Communications

If you voluntarily provide your phone number and opt in through a checkbox on our website (for example, on our contact form), we may send you text messages related to your inquiry, our services, or account and appointment updates. Providing a phone number and this consent are never required to use the rest of the website or to submit an inquiry without a phone number.

Message frequency may vary. Message and data rates may apply. You can opt out at any time by replying STOP, or reply HELP for help. You may also opt out by contacting us using the information in Section 18 (Contact Us).

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories of personal information disclosure described in this Privacy Notice apply, but sharing of opt-in SMS consent or phone number data with third parties for their own marketing purposes is excluded from that disclosure.

We retain a record that you opted in (including the request in which you did so) to document compliance with applicable messaging and telemarketing laws.

18. Contact Us

For privacy questions, requests, or concerns, contact:

ArqaOne LLC / ArqaOne
support@arqaone.com
https://www.arqaone.com