Privacy Policy
Last updated: 24 July 2026
Arcus AI Tech Ltd
Company number: 17299796
Registered office:
20 Wenlock Road
London
England
N1 7GU
1. About this Privacy Policy
This Privacy Policy explains how Arcus AI Tech Ltd collects, uses, stores and protects personal data when you:
- visit or interact with this website;
- contact us or submit an enquiry;
- request a design consultation or free trial;
- become a customer or use our products and services;
- communicate with us in connection with our business; or
- receive marketing communications from us.
Arcus AI Tech Ltd is the controller responsible for personal data collected through this website and in connection with its prospective and existing customer relationships.
We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations and other applicable data-protection legislation.
2. The Arcus Group
Arcus AI Tech Ltd is a member of the Arcus Group, which comprises Arcus Group Holdings Ltd, Arcus AI Ltd and Arcus AI Tech Ltd.
Arcus AI Ltd owns and licenses the Arcus AI Platform and associated intellectual property used by Arcus AI Tech Ltd. Where Arcus AI Ltd processes personal data on behalf of Arcus AI Tech Ltd in connection with the operation, maintenance, support or development of the platform, it does so under appropriate contractual arrangements.
Arcus Group Holdings Ltd is the group’s parent company and does not ordinarily process personal data collected through this website.
3. Customer Website and End-User Data
Arcus AI Tech Ltd provides managed website, eCommerce, hosting, email and related services to its customers.
Where personal data is collected through a customer’s website, eCommerce store, email service or other customer-controlled service, the customer will normally be the controller of that personal data and Arcus AI Tech Ltd will act as its processor.
In those circumstances:
- the customer is responsible for determining why and how the personal data is used;
- the customer is responsible for providing its own privacy notice to its website visitors, customers and other individuals;
- Arcus AI Tech Ltd processes the personal data only to provide the contracted services and in accordance with the customer’s lawful instructions; and
- Arcus AI Ltd, hosting providers and other technology suppliers may act as subprocessors where required to provide the services.
This Privacy Policy does not replace the privacy policy that each Arcus customer must provide for its own website or business.
4. How to Contact Us
Questions about this Privacy Policy, requests concerning your personal data and data-protection complaints should be sent to:
Email: legal@arcusai.uk
Post:
Data Protection Contact
Arcus AI Tech Ltd
20 Wenlock Road
London
England
N1 7GU
Please use the subject line “Data Protection Request” or “Data Protection Complaint”, as appropriate.
5. Personal Data We Collect
Depending on how you interact with us, we may collect:
Contact information
- name;
- email address;
- telephone number;
- postal address; and
- preferred method of communication.
Business information
- company or organisation name;
- job title or role;
- business website;
- business address; and
- information about your products, services and business requirements.
Enquiry and communication information
- information submitted through enquiry or consultation forms;
- email correspondence;
- telephone or meeting notes;
- support requests; and
- feedback, reviews and complaints.
Account and service information
- usernames and account details;
- service package and subscription details;
- website requirements and design instructions;
- content, images, products and other materials supplied to us;
- domain, hosting and email information;
- account permissions; and
- technical and support records.
Billing and transaction information
- billing address;
- invoices and payment status;
- payment references;
- subscription and transaction history; and
- relevant accounting and taxation records.
Where payments are handled by a third-party payment provider, we will normally receive transaction information rather than your complete debit or credit card details.
Technical and usage information
- IP address;
- browser type and version;
- device and operating-system information;
- pages visited;
- dates and times of visits;
- referring website or source;
- interactions with pages and features;
- security and diagnostic logs; and
- cookie or similar technology identifiers.
Marketing information
- marketing preferences;
- records of consent where consent is used;
- records of objections or unsubscribes; and
- interaction with marketing communications.
Client and end-user data
When providing services to a customer, we may process personal data contained in the customer’s website, eCommerce store, databases, email accounts, forms, order records or other customer materials. We normally process this information as a processor on behalf of the customer.
We do not intentionally collect special-category personal data or criminal-offence data through this website. Please do not provide such information unless it is genuinely necessary, lawful and specifically requested.
6. How We Obtain Personal Data
We may obtain personal data:
- directly from you;
- through this website and its forms;
- when you contact us by email, telephone, online meeting or another communication channel;
- when you register for, trial or purchase a service;
- from another person within your organisation;
- from customers who instruct us to provide services;
- from referral partners or representatives;
- from payment, hosting, analytics, communications and technical service providers;
- from publicly available business sources, where lawful and relevant; and
- automatically through cookies, logs and similar technologies.
7. How and Why We Use Personal Data
Enquiries and consultations
We use contact, business and communication information to respond to enquiries, understand requirements, arrange consultations, provide quotations and take steps towards entering into a contract.
Our lawful bases are:
- taking steps at your request before entering into a contract;
- performing a contract, where you are contracting with us personally; and
- our legitimate interests in responding to business enquiries and developing our business.
Providing and managing services
We use personal data to:
- create, operate and maintain websites and eCommerce stores;
- provide hosting, domains, email and platform access;
- provide customer service, technical support and training;
- administer free trials and subscriptions;
- manage customer accounts;
- process instructions and requested changes;
- communicate service information; and
- manage suspension, termination, migration or deletion.
Our lawful bases are:
- performing our contract with you;
- taking steps before entering into a contract; and
- our legitimate interests in administering contracts with corporate customers and communicating with their employees and representatives.
Payments and business administration
We use relevant information to issue invoices, administer subscriptions, collect payments, maintain accounts and comply with taxation and accounting requirements.
Our lawful bases are:
- performing a contract;
- complying with legal obligations; and
- our legitimate interests in managing payments, debts and business records.
Platform operation, development and security
We use technical, service and account information to:
- operate and maintain the Arcus AI Platform;
- monitor availability and performance;
- diagnose technical problems;
- provide security and prevent unauthorised access;
- detect fraud, misuse and malicious activity;
- maintain backups and business continuity;
- improve functionality and user experience; and
- develop and test improvements.
Our lawful bases are:
- performing our contracts;
- complying with legal obligations relating to security and data protection; and
- our legitimate interests in operating, protecting and improving our services.
Where development or testing can reasonably be carried out using anonymised, synthetic or non-production information, we will seek to use that information instead of identifiable personal data.
Website analytics
We use Google Analytics to understand how visitors use the website and to improve its content, navigation, performance and functionality.
Google Analytics may process information including pages viewed, session information, approximate geographic information, browser and device information, referring sources and website interactions.
Our lawful basis for processing personal data through Google Analytics is consent. Google Analytics will not be activated, and its cookies will not be set, unless you have consented to analytics cookies through our cookie preference mechanism.
You may withdraw or change your consent at any time through the Cookie Settings control available on the website.
Further information about the Google Analytics cookies used, their purposes and duration is provided in our Cookie Policy.
Marketing
We may use contact details and marketing preferences to send information about our products and services.
Depending on the circumstances, we rely on:
- consent;
- our legitimate interests in appropriate business-to-business marketing; or
- another basis permitted by applicable electronic-marketing legislation.
You may object to direct marketing or unsubscribe at any time.
Legal, regulatory and dispute purposes
We may use relevant personal data to:
- comply with legal and regulatory obligations;
- respond to lawful requests from authorities;
- prevent or investigate fraud or unlawful activity;
- obtain professional advice;
- establish, exercise or defend legal claims; and
- protect our rights, property, systems, customers and personnel.
Our lawful bases are legal obligation and our legitimate interests in protecting and administering our business.
8. AI-Assisted Services
Our services may use artificial intelligence technologies to assist with website design, content creation, coding, analysis, automation and related functions.
Where these services are used:
- we seek to minimise the personal data included in prompts and instructions;
- personal data will only be used where reasonably necessary to provide the requested service;
- customers should not include unnecessary special-category or criminal-offence data in materials supplied for AI-assisted processing;
- relevant providers may act as processors or subprocessors;
- appropriate contractual, security and international-transfer arrangements will be used where required; and
- AI-generated material may be reviewed, edited or approved by our personnel before it is used or published.
We do not use personal data collected through this website to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
9. Sharing Personal Data
We may share personal data with:
- Arcus AI Ltd, where platform-related access or processing is genuinely necessary;
- Arcus Group Holdings Ltd, where necessary for limited corporate, legal, financial, insurance, governance or regulatory purposes;
- hosting and infrastructure providers, including Instahost Ltd where it provides relevant services;
- domain-registration and email-service providers;
- payment processors and financial institutions;
- analytics providers, including Google Analytics, where you have consented to analytics cookies;
- AI and technology service providers where reasonably necessary to provide the requested services;
- communications, customer-support and meeting providers;
- professional advisers, including solicitors, accountants, auditors and insurers;
- contractors and service providers who require access to perform authorised services;
- prospective purchasers, investors or professional advisers involved in a genuine corporate transaction, subject to appropriate confidentiality safeguards; and
- courts, regulators, governmental bodies, law-enforcement agencies and other authorities where disclosure is required or permitted by law.
Where a recipient acts as our processor, we require it to process personal data only for authorised purposes, protect it appropriately and comply with applicable data-protection law. Some recipients may act as separate controllers for particular processing activities, in which case they are responsible for their own compliance with data-protection law.
We do not sell personal data.
10. International Transfers
Some service providers may process personal data outside the United Kingdom.
Where personal data is transferred internationally, we will use an appropriate lawful transfer mechanism, which may include:
- UK adequacy regulations;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved standard contractual clauses;
- another approved transfer mechanism; or
- a permitted statutory exception in appropriate circumstances.
We will also assess whether additional technical, contractual or organisational safeguards are required.
Information about relevant transfer safeguards may be requested using the contact details in this policy.
11. Cookies and Similar Technologies
This website uses cookies and similar storage or access technologies.
Some cookies are strictly necessary for the security, operation and functionality of the website and may be used without consent where the relevant legal exception applies.
We also use functionality and Google Analytics cookies. These optional cookies will not be activated unless you have provided consent through the website’s cookie preference mechanism.
You will be able to accept, reject or customise optional cookie categories. Optional cookies will not be enabled by default, and you may change or withdraw your consent at any time through the Cookie Settings control available on the website.
Further information, including the names, providers, purposes and durations of the cookies used, is available in our Cookie Policy.
12. Data Retention
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.
Our usual retention approach is:
Enquiry and correspondence records will normally be retained for up to 24 months after our last meaningful contact. Customer, contractual, accounting and transaction records may normally be retained for up to six years after the end of the relevant relationship, or longer where required by law or necessary in connection with a dispute. Technical and analytics data is retained for the period appropriate to its operational or analytical purpose.
Data may be retained for longer where necessary to investigate fraud, manage a dispute, comply with a legal requirement or establish, exercise or defend legal claims.
Backup copies may remain temporarily within secure backup systems until they are overwritten or deleted in accordance with the applicable backup cycle.
13. Data Security
We use appropriate technical and organisational measures designed to protect personal data against:
- unauthorised or unlawful access;
- accidental loss or destruction;
- alteration;
- misuse; and
- unauthorised disclosure.
Measures may include access controls, authentication, encryption, secure communications, logging, backups, staff and contractor confidentiality obligations, vulnerability management and incident-response procedures.
No internet-based service can be guaranteed to be completely secure. We continually review our safeguards according to the nature of the information and the risks involved.
14. Your Data-Protection Rights
Depending on the circumstances and lawful basis involved, you may have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete information;
- request deletion of your personal data;
- request restriction of processing;
- object to processing based on legitimate interests;
- receive certain personal data in a portable format;
- withdraw consent at any time where processing is based on consent; and
- object to decisions based solely on automated processing where applicable.
These rights are not absolute and may be subject to legal conditions or exemptions.
Your right to object to direct marketing
You have the right to object at any time to the use of your personal data for direct marketing. Once you object, we will stop using your personal data for that purpose.
To exercise your rights, contact legal@arcusai.uk.
We may request reasonable information to confirm your identity and ensure that personal data is not disclosed to an unauthorised person.
15. Data-Protection Complaints
If you have a concern or complaint about how we have handled your personal data, please contact us at legal@arcusai.uk. We will acknowledge a data-protection complaint within 30 days, investigate it appropriately, keep you reasonably informed of progress and communicate the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office.
16. Children
Our website and services are intended primarily for businesses and adults acting in a business or professional capacity.
We do not knowingly collect personal data directly from children through this website.
If a service is likely to be accessed or used by children, we will consider their particular needs and implement appropriate protections in accordance with applicable data-protection requirements.
17. Third-Party Websites and Services
This website may contain links to third-party websites or services.
Third parties are responsible for their own privacy practices. We recommend reviewing their privacy information before providing personal data or using their services.
18. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, group arrangements, technology, suppliers or legal obligations.
The updated version will be published on this website with a revised “last updated” date. Where a change is material, we will take reasonable steps to bring it to the attention of affected individuals.
Use of the website does not constitute consent to changes in this Privacy Policy. Where consent is legally required for a new processing activity, we will request it separately.