Privacy Policy

1. Who we are

Arcus LLC (“Arcus”, “we”, “us”) is a management advisory firm registered with the Qatar Financial Centre (QFC No. 04428). For the purposes of Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016, the “PDPPL”) and, where applicable, the QFC Data Protection Regulations 2021 and the EU GDPR, Arcus is the controller of the personal data described in this policy.

Contact us about this policy at info@arcus.consulting or via WhatsApp at +974 3396 6131.

2. What data we collect

Depending on how you interact with us, we may collect:

• Contact details you provide - name, business name, email address, phone or WhatsApp number.
• Information you submit in our risk assessment questionnaire - about your organisation, the AI tools your team uses, and your data-handling practices.
• Correspondence - the content of messages, emails or WhatsApp exchanges you send us.
• Technical data - basic, privacy-respecting analytics about how this website is used. We do not use advertising trackers or build personal profiles.

3. How and why we use it

We process your personal data only to:

• Respond to your enquiry and prepare your AI risk assessment.
• Deliver and support the advisory services you engage us for.
• Communicate with you about your engagement and follow-up checkpoints.
• Meet our own legal, regulatory and record-keeping obligations.

We do not use your data for marketing to third parties, profiling, or any purpose beyond what is listed above.

4. Lawful basis

We rely on your consent (PDPPL Art. 4) and, where applicable, the necessity of processing to take steps at your request and to perform our agreement with you (PDPPL Art. 4). Where we process data to meet a legal obligation or our legitimate interest in running our business, we do so consistently with the PDPPL and applicable law.

5. Confidentiality and disclosure

Confidentiality is fundamental to our service. We sign a mutual confidentiality agreement before every engagement. We do not sell your data. We do not disclose audit findings, questionnaire responses or engagement details to any third party - including regulators. Arcus is a management advisory firm with no statutory obligation to report to any authority, and we do not do so.

We may share data only with:

• Trusted service providers who help us operate - for example, secure hosting and scheduling tools - under agreements that require them to protect it.
• Professional advisers where necessary for the delivery of services.
• Authorities where required by a valid and lawful legal process.

6. International transfers

Some of our service providers may process data outside Qatar. Where that happens, we rely on contractual safeguards consistent with PDPPL transfer requirements and, where applicable, GDPR Standard Contractual Clauses. We do not use providers whose data handling we cannot adequately verify.

7. Retention

We keep personal data only for as long as needed for the purposes above - typically for the duration of our engagement plus any period required to meet legal or contractual obligations - after which it is securely deleted or anonymised. You may request deletion at any time after an engagement ends.

8. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete your data, or to restrict or object to its processing.
• Withdraw consent at any time, without affecting prior lawful processing.

To exercise any of these rights, contact us at info@arcus.consulting. We will respond within 30 days.

9. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. All findings, communications and client documents are stored securely. Access is restricted to authorised personnel only.

10. How we use AI

Arcus uses AI tools to support the preparation of risk assessments and audit deliverables. Your questionnaire data is processed on our local infrastructure in Qatar. We do not transmit client questionnaire responses or engagement data to external cloud AI providers. Every AI-assisted output is reviewed by a qualified human adviser before delivery to you.

11. Changes to this policy

We may update this policy from time to time. The date above reflects the current version. Material changes will be communicated directly to active clients and reflected on this page.

12. Contact

For any question or request about your personal data:

• Email: info@arcus.consulting
• WhatsApp: +974 3396 6131
• Address: Arcus LLC, Qatar Financial Centre, Doha, Qatar