PRIVACY POLICY

Website: https://armholding.org

Effective date: [INSERT DATE]

Last updated: [INSERT DATE]

Data controller: [INSERT FULL LEGAL NAME]

1. Purpose and Scope

This Privacy Policy (the “Policy”) describes the personal data ARM collects, obtains, uses, discloses, stores and otherwise processes when individuals visit armholding.org, submit a corporate enquiry, request partnership or investor information, subscribe to communications, apply for a role, report a concern, or otherwise interact with the website or the controller identified below.

“Personal data” means information relating to an identified or identifiable individual and includes equivalent concepts such as personal information where applicable. “Processing” includes collecting, using, organising, storing, disclosing, transferring, analysing and deleting personal data.

The Website Terms of Use govern use of the website. The Cookies Policy provides detailed information about cookies and similar technologies. Service agreements govern products and transactions. Where a product-specific privacy notice conflicts with this Policy for that product, the more specific notice controls.

2. Who Is Responsible for Your Personal Data

The controller responsible for processing under this Policy is [INSERT FULL LEGAL NAME], a [INSERT LEGAL FORM] incorporated in [INSERT JURISDICTION], registration number [INSERT NUMBER], with registered office at [INSERT ADDRESS] (“ARM”, “we”, “us” or “our”).

Privacy contact: [INSERT PRIVACY EMAIL/PORTAL]. Data Protection Officer or representative, if legally required: [INSERT NAME/ROLE AND CONTACT]. EU/EEA representative under Article 27 GDPR, if applicable: [INSERT DETAILS OR ‘NOT APPLICABLE’]. UK representative, if applicable: [INSERT DETAILS OR ‘NOT APPLICABLE’].

An ARM affiliate or brand is not a controller merely because it appears on the Website. Where personal data is shared within the ARM ecosystem, each recipient’s role as independent controller, joint controller or processor is identified in the relevant notice or agreement.

3. When This Policy Does Not Apply

This Policy does not govern a third-party website or a separately operated ARM-branded service that publishes its own privacy notice. It also does not govern personal data processed solely on behalf of an organisational customer where an ARM entity acts as processor; in that situation, the customer controls the processing and its privacy notice applies, subject to the relevant data-processing agreement.

If your organisation provides access to an ARM service, direct privacy questions about your organisation’s processing to that organisation. ARM will assist the controller as required by contract and law.

4. Personal Data We Collect

The data collected depends on how you interact with ARM. ARM collects only data that is necessary and proportionate for the stated purpose.

The public Website does not request account credentials, payment-card data, private cryptographic keys, biometric identifiers, government identification, proof of address, health data or criminal-offence data through a general contact form. A feature that collects these data is governed by a specific notice, lawful basis, security controls, retention rule and, where required, a data-protection impact assessment.

5. Data We Receive from Other Sources

ARM may receive business contact data from your employer or organisation, event organisers, professional advisers, recruitment providers, service providers, publicly available professional profiles, corporate registries, sanctions lists and partners that lawfully refer an enquiry. ARM will respect source restrictions and provide any notice required when data was not obtained directly from you.

ARM [DOES/DOES NOT] purchase consumer profiles or combine Website data with data-broker records for advertising. Where such processing occurs, the relevant sources, categories, purposes and opt-out rights are stated in [INSERT NOTICE OR URL].

6. Why We Use Personal Data and Our Legal Bases

Where a law requires a legal basis, ARM relies on the basis shown below. The applicable basis depends on the context and jurisdiction.

Where ARM relies on legitimate interests, it must document the purpose, necessity and balancing assessment. You may request information about the relevant assessment, subject to protection of confidential and third-party information.

Where processing relies on consent, you may withdraw consent at any time without affecting processing already carried out. Refusing optional data will not affect unrelated services. If data is required by law or to enter a contract, ARM will explain the consequence of not providing it.

7. Sensitive Personal Data

ARM does not intentionally collect sensitive or special-category data through the general website except where necessary, lawful and clearly disclosed. If you include such data in free text or an attachment when it is not requested, ARM may delete or restrict it.

Products involving identity verification, KYC, payments, custody, fraud prevention or regulated services may process government identifiers, financial information, biometric data, sanctions information or criminal-offence data. Those products require separate notices identifying the exact controller, categories, purposes, legal bases, recipients, retention, safeguards, rights and any automated decision-making.

8. Cookies, Analytics and Similar Technologies

ARM uses cookies, local storage and similar technologies for website operation, preferences, security and [INSERT CONFIRMED OPTIONAL PURPOSES]. The Cookies Policy at [INSERT COOKIES POLICY URL] identifies the technologies, providers, purposes and durations and explains how to manage choices at [INSERT COOKIE SETTINGS LINK].

Where consent is required, ARM activates non-essential technologies only after consent and records or withdraws that choice in accordance with applicable law.

9. Marketing Communications

ARM may send corporate updates, event information or product news where permitted. Marketing messages will identify the sender and provide an unsubscribe method. You may opt out at any time by using the unsubscribe link or contacting [INSERT MARKETING/PRIVACY CONTACT].

Opting out of marketing does not prevent service, security, legal or transactional communications. ARM retains a minimal suppression record to honour the opt-out.

10. How We Disclose Personal Data

ARM may disclose personal data only where necessary and lawful to:

• hosting, cloud, content-delivery, cybersecurity, analytics, consent-management, communications, recruitment, document-management and professional-service providers acting under contract;
• the ARM entity responsible for the enquiry or product, after its identity and role have been established and disclosed;
• professional advisers, auditors, insurers, banks and prospective transaction parties subject to appropriate confidentiality and due-diligence safeguards;
• courts, regulators, law-enforcement bodies and public authorities where disclosure is legally required or necessary to protect rights, safety and security; and
• a successor or purchaser in a merger, financing, reorganisation, insolvency, sale or transfer, subject to applicable notice and protection requirements.

ARM [DOES/DOES NOT] sell personal data or share it for cross-context behavioural advertising as defined by applicable United States state law. Required opt-out controls are available at [INSERT LINK OR ‘NOT APPLICABLE’].

11. Service Providers and Recipient Register

ARM discloses personal data to the following categories of recipients for the stated purposes. The identity and location of each provider are recorded in ARM’s vendor register and disclosed below where required.

12. International Transfers

Personal data may be processed outside your country when recipients or infrastructure are located elsewhere. ARM will make a restricted transfer only when a lawful mechanism and required safeguards are in place.

For transfers from the EEA, UK or Switzerland, safeguards may include an adequacy decision, approved standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another valid mechanism, together with supplementary measures where required. Applicable mechanisms and destination countries: [INSERT VERIFIED DETAILS].

You may request information about applicable safeguards by contacting [INSERT PRIVACY CONTACT]. ARM may redact confidential or third-party information.

13. Retention and Deletion

ARM retains personal data only for the periods below and longer only where a legal hold, statutory obligation or active dispute requires it. Data is deleted or anonymised when the applicable period ends.

Backup copies are isolated from ordinary use and deleted after [INSERT BACKUP RETENTION PERIOD].

14. Security

ARM uses appropriate technical and organisational measures designed to protect personal data, taking account of processing risks. Measures must include, as appropriate, access control, least privilege, authentication, encryption in transit and at rest, secure development, logging, monitoring, vulnerability management, backups, incident response, provider due diligence, staff confidentiality and training.

No system is completely secure. If a personal-data breach occurs, ARM will investigate, contain, document and notify affected individuals or authorities when required. Report security concerns to [INSERT SECURITY CONTACT], not through a public form.

15. Your Privacy Rights

Depending on your location and the processing, you may have the right to:

• request access to and a copy of personal data;
• correct inaccurate or incomplete data;
• request deletion or restriction of processing;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain data in a structured, commonly used and machine-readable format and transmit it to another controller;
• withdraw consent at any time;
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where the right applies;
• appeal ARM’s refusal of a request where applicable; and
• complain to a competent data-protection or privacy authority.

Rights are not absolute. ARM may refuse or limit a request where law permits and will explain the reason and available complaint or appeal route.

16. How to Exercise Your Rights

Submit a request through [INSERT PRIVACY REQUEST PORTAL/EMAIL] or by post to [INSERT ADDRESS]. Describe the right, relevant interaction and preferred response method. ARM will not require unnecessary personal data.

ARM may take proportionate steps to verify identity and authority. An authorised agent must provide [INSERT REQUIRED PROOF]. ARM will respond within [INSERT APPLICABLE PERIOD] and may extend the period only where legally permitted and notified.

ARM will not discriminate against you for exercising a privacy right. A fee will be charged only where legally permitted, such as for a manifestly unfounded or excessive request.

17. Automated Decision-Making and Artificial Intelligence

The public website [INSERT WHETHER IT USES AUTOMATED DECISIONS OR PROFILING]. ARM will not make a solely automated decision producing legal or similarly significant effects unless it has a lawful basis, provides required information and safeguards, and offers human intervention, an opportunity to express a view and a means to contest the decision where required.

ARM [DOES/DOES NOT] use Website enquiries, submissions or user content to train or fine-tune AI models. Where personal data is used to develop or evaluate AI, the relevant notice specifies the data, purpose, legal basis, sources, retention, access, opt-out or objection rights, de-identification measures and human oversight.

Product-specific AI features require separate, contextual disclosure of input processing, output review, model providers, data retention, training use and material risks.

18. Children’s Privacy

The website is not directed to children under [INSERT AGE]. ARM does not knowingly collect children’s personal data through the general website. If ARM learns that data was collected without required parental authorisation or another lawful basis, it will take appropriate steps to delete or restrict it.

Any product intended or likely to be accessed by children requires a separate age-appropriate design and privacy assessment, including age assurance, parental consent where required, default settings and child-friendly notices.

19. Australian and Regional Privacy Rights

19.1 Australian Privacy Framework

Where the Privacy Act 1988 (Cth) applies to ARM or the relevant processing, ARM handles personal information in accordance with that Act and the Australian Privacy Principles (APPs). This includes obligations concerning transparent management, collection, notice, use and disclosure, direct marketing, cross-border disclosure, security, access and correction.

19.2 Access and Correction in Australia

You may request access to personal information ARM holds about you and ask ARM to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. ARM will respond within the period required by law and will give written reasons and complaint information where access or correction is refused.

19.3 Direct Marketing

ARM uses personal information for direct marketing only where permitted by the Privacy Act 1988 (Cth), the Spam Act 2003 (Cth) and other applicable law. Every electronic marketing message provides the sender’s identity and a functional unsubscribe method. ARM will action an unsubscribe request within the legally required period.

19.4 Overseas Disclosures

Before disclosing personal information to a recipient outside Australia, ARM takes the steps required by APP 8 and identifies the likely destination countries in section 12. Contractual or technical safeguards do not remove any accountability imposed by Australian privacy law.

19.5 Eligible Data Breaches

ARM maintains a data-breach response process. Where the Notifiable Data Breaches scheme applies and ARM has reasonable grounds to believe an eligible data breach has occurred, ARM will notify the Office of the Australian Information Commissioner and affected individuals in accordance with the Privacy Act 1988 (Cth).

19.6 Other Jurisdictions

Individuals outside Australia have the additional rights and complaint routes stated in [INSERT REQUIRED JURISDICTIONAL SUPPLEMENTS OR ‘NOT APPLICABLE’].

20. Regulatory and Law-Enforcement Requests

ARM may preserve or disclose personal data when required by valid law, legal process or a competent authority. ARM will review requests for legal validity, scope and proportionality, challenge inappropriate requests where reasonably available, and disclose only data reasonably required. ARM will notify the individual where permitted and appropriate.

21. Changes to This Policy

ARM may update this Policy when processing, technology, law, products or organisational arrangements change. The revised Policy will state its last-updated and effective dates. If a change materially affects individuals, ARM will provide additional notice or obtain consent where required.

22. Contact and Complaints

22.1 Contact ARM

Privacy questions, access or correction requests and complaints may be submitted to [INSERT PRIVACY EMAIL/PORTAL] or [INSERT POSTAL ADDRESS]. Data Protection Officer or Privacy Officer: [INSERT CONTACT OR ‘NOT APPLICABLE’].

22.2 Complaint Handling

ARM will acknowledge a privacy complaint, investigate it fairly and provide a written outcome within [INSERT TARGET PERIOD, NOT EXCEEDING APPLICABLE LAW]. ARM may request information reasonably needed to investigate the complaint.

22.3 External Complaint

If you are not satisfied with ARM’s response, or ARM does not respond within 30 days, you may lodge a complaint with the Office of the Australian Information Commissioner at https://www.oaic.gov.au. Where the complaint concerns a financial service, an approved external dispute-resolution scheme such as the Australian Financial Complaints Authority may apply: [INSERT APPLICABLE EDR DETAILS OR ‘NOT APPLICABLE’].