Privacy Policy

1. Who we are

Arcus LLC (“Arcus”, “we”, “us”) is a management advisory firm registered with the Qatar Financial Centre (QFC No. 04428). For the purposes of Qatar's Personal Data Privacy Protection Law (Law No. 13 of 2016, the “PDPPL”) and, where applicable, the QFC Data Protection Regulations 2021 and the EU GDPR, Arcus is the controller of the personal data described in this policy.

Contact us about this policy at info@arcus.consulting or via WhatsApp at +974 3396 6131.

2. What data we collect

Depending on how you interact with us, we may collect:

• Contact details you provide - name, business name, email address, phone or WhatsApp number.
• Information you submit in our risk assessment questionnaire - about your organisation, the AI tools your team uses, and your data-handling practices.
• Correspondence - the content of messages, emails or WhatsApp exchanges you send us.
• Technical data - basic, privacy-respecting analytics about how this website is used. We do not use advertising trackers or build personal profiles. If you arrive through the link of an Arcus partner (an ambassador), we store that partner's referral code in your browser - in local storage and a first-party cookie - for up to 90 days so the partner can be credited for the introduction. Choosing Decline on our cookie banner clears it. After that, we keep the code from a partner link you open only until you close the tab.

3. How and why we use it

We process your personal data only to:

• Respond to your enquiry and prepare your AI risk assessment.
• Deliver and support the advisory services you engage us for.
• Communicate with you about your engagement and follow-up checkpoints.
• Attribute introductions made through our ambassador programme and pay the introducer.
• Meet our own legal, regulatory and record-keeping obligations.

We do not use your data for marketing to third parties, profiling, or any purpose beyond what is listed above.

4. Lawful basis

We rely on your consent (PDPPL Art. 4) and, where applicable, the necessity of processing to take steps at your request and to perform our agreement with you (PDPPL Art. 4). Where we process data to meet a legal obligation or our legitimate interest in running our business, we do so consistently with the PDPPL and applicable law.

5. Confidentiality and disclosure

Confidentiality is fundamental to our service. We sign a mutual confidentiality agreement before every engagement. We do not sell your data. We do not disclose audit findings or questionnaire responses to any third party - including regulators. Arcus is a management advisory firm with no statutory obligation to report to any authority, and we do not do so.

If an Arcus ambassador introduced you to us, we tell them only that an enquiry arrived and how far it has progressed - and, if you engage us, which service you chose and any commission due to them. We never share your identity, contact details, questionnaire answers or findings with them.

Beyond that, we may share data only with:

• Trusted service providers who help us operate - for example, secure hosting and scheduling tools - under agreements that require them to protect it.
• Professional advisers where necessary for the delivery of services.
• Authorities where required by a valid and lawful legal process.

6. Ambassador programme

Our ambassador programme rewards people who introduce new clients to Arcus. If you take part as an ambassador, we hold:

• Your name, email address, phone number and referral code.
• The details you give in your application - your LinkedIn profile, if you give it, and the kind of companies you know.
• Daily counts of visits through your link, and records of the leads attributed to you (a number, a stage and dates - never the prospect's identity) and of the commission due or paid to you.

We use this information to run the programme, credit your introductions and pay your commission. Our legal basis is our agreement with you and our legitimate interest in running the programme.

When a commission becomes due, we ask for your payout details. Those are held in our accounting records, not on this website's systems.

To have your ambassador data deleted, email info@arcus.consulting. We will close your account and delete what we can. We keep your referral code, permanently retired so it is never issued to anyone else, and the commission records we are legally required to keep.

7. International transfers

Some of our service providers may process data outside Qatar. Where that happens, we rely on contractual safeguards consistent with PDPPL transfer requirements and, where applicable, GDPR Standard Contractual Clauses. We do not use providers whose data handling we cannot adequately verify.

8. Retention

We keep personal data only for as long as needed for the purposes above - typically for the duration of our engagement plus any period required to meet legal or contractual obligations - after which it is securely deleted or anonymised. You may request deletion at any time after an engagement ends.

9. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete your data, or to restrict or object to its processing.
• Withdraw consent at any time, without affecting prior lawful processing.

To exercise any of these rights, contact us at info@arcus.consulting. We will respond within 30 days.

10. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. All findings, communications and client documents are stored securely. Access is restricted to authorised personnel only.

11. How we use AI

Arcus uses AI tools to support the preparation of risk assessments and audit deliverables. Your questionnaire data is processed on our local infrastructure in Qatar. We do not transmit client questionnaire responses or engagement data to external cloud AI providers. Every AI-assisted output is reviewed by a qualified human adviser before delivery to you.

12. Changes to this policy

We may update this policy from time to time. The date above reflects the current version. Material changes will be communicated directly to active clients and reflected on this page.

13. Contact

For any question or request about your personal data:

• Email: info@arcus.consulting
• WhatsApp: +974 3396 6131
• Address: Arcus LLC, Qatar Financial Centre, Doha, Qatar