DRAFT FOR REVIEW · INTEGRATIONS PENDING

Privacy policy

Draft last updated: 10 September 2026

1. Data controller

• Trading name: Arkhé AI Systems
• Owner: Ismael Mendoza Niella, self-employed professional
• NIF: 46619088C
• Address: Calle Campins, 120, 17404 Riells i Viabrea, Girona
• Contact email: ismaelmendoza@arkheaisystems.com

2. Data processed

The assessment and meeting booking processes involve identity and professional details, contact details, business information, assessment answers and communications with Arkhé AI Systems.

3. Purposes

• Handle enquiries and meeting requests.
• Prepare requested assessments, diagnoses and proposals.
• Manage pre-contractual, contractual and after-sales relationships.
• Send marketing communications only where consent or another valid legal basis exists.
• Protect the website, prevent abuse and obtain technical information about its operation.

4. Legal basis

Depending on the circumstances, processing will be based on consent, requested pre-contractual measures, performance of a contract, compliance with legal obligations or duly balanced legitimate interests.

5. Retention

Data will be retained for as long as necessary for the purpose for which it was collected and subsequently for periods required to meet legal obligations or address potential liabilities. Data used for marketing communications will be retained until consent is withdrawn or processing is objected to.

6. Recipients and providers

Data will not be disclosed to third parties except where legally required or necessary to provide the service. OpenAI, as the ChatGPT Sites provider, and HubSpot, as the CRM provider, may access data to host the website and manage requests, alongside necessary email, scheduling and support providers, subject to appropriate contractual safeguards.

7. International transfers

If a provider processes data outside the European Economic Area, the mechanisms and safeguards required by data protection law will apply.

8. Rights

Individuals may request access, rectification, erasure, objection, restriction or portability of their data and withdraw consent by writing to ismaelmendoza@arkheaisystems.com. They may also lodge a complaint with the Spanish Data Protection Agency.

9. Security and accuracy

Technical and organisational measures appropriate to the risk will be applied. Users must provide accurate information and report any relevant changes.