Privacy Policy

This Privacy Policy explains how Arca (arca-capital.io) (“Arca”, “we”, “us”, “our”) collects, uses, discloses, and protects personal data in connection with the website arca-capital.io and the associated marketplace platform (the “Platform”), which connects investors (“Investors”) and founders seeking capital (“Founders”).

Arca is based in the United Kingdom and is the data controller of personal data collected through the Platform. Arca processes personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable to Users located in the European Economic Area (EEA), the EU General Data Protection Regulation (EU GDPR).

The Platform is currently in Beta. This Policy applies to the Beta version of the Platform and will be updated as the Platform, and our data practices, develop.

Depending on how you use the Platform, we may collect:

• Account information: name, email address, phone number, password, and role (Investor or Founder);
• Profile information: for Founders, business name, pitch materials, financial information, and business plans voluntarily submitted; for Investors, investment focus, indicative ticket size, and (where relevant) accredited/sophisticated investor status;
• Communications: messages sent through the Platform between Users, and correspondence with Arca (e.g. support requests);
• Usage data: pages visited, actions taken, device and browser type, IP address, and approximate location, collected automatically via cookies and similar technologies; and
• Any other information you choose to provide, including documents uploaded to support introductions or due diligence.

Under the UK GDPR and EU GDPR, we rely on the following lawful bases to process your personal data:

• Performance of a contract - to create your account, operate the Platform, and provide the marketplace service you have signed up for;
• Legitimate interests - to secure and improve the Platform, prevent fraud and abuse, and understand how the Platform is used, in each case balanced against your rights and interests;
• Consent - for optional marketing communications and non-essential cookies, which you may withdraw at any time; and
• Legal obligation - where we must retain or disclose information to comply with applicable law.

We use personal data to:

• create and manage your account and verify eligibility (e.g. investor status where relevant);
• operate the marketplace, including matching and displaying Investor and Founder profiles to one another;
• facilitate communication between Users;
• improve, secure, and troubleshoot the Platform, including identifying and fixing issues during the Beta period;
• send administrative communications, and, where you have consented, marketing communications (which you may opt out of at any time); and
• comply with legal obligations, and detect or prevent fraud, abuse, or unlawful conduct.

The Platform is accessible globally, and some of our service providers (such as cloud hosting or software tools) may store or process personal data outside the United Kingdom or the EEA. Where this occurs, we take reasonable steps to ensure an adequate level of protection, including relying on UK and/or EU adequacy regulations, the UK International Data Transfer Agreement/Addendum, EU Standard Contractual Clauses, or other appropriate safeguards recognised under the UK GDPR and EU GDPR.

We take reasonable technical and organisational measures to protect personal data from misuse, loss, and unauthorised access, including access controls and secure storage. We retain personal data for as long as your account is active, or as needed to provide the Platform, comply with legal obligations, resolve disputes, and enforce our agreements, after which it is deleted or anonymised.

You may request deletion of your account and associated information as described in Clause 10, subject to information we are required to retain by law.

The Platform uses cookies and similar technologies to keep you logged in, remember preferences, and understand how the Platform is used. Non-essential cookies are only set with your consent, which you can manage through our cookie banner or your browser settings. Disabling cookies may affect Platform functionality.

In addition to personal data, we may collect, store, and use non-personal data - that is, data that does not identify you and cannot reasonably be used to do so, such as aggregated usage statistics, anonymised or de-identified profile and activity data, and general analytics about how the Platform is used.

We may store and retain this non-personal data indefinitely, and may use it for any purpose, including improving the Platform, understanding marketplace trends, and reporting, without further notice to you. Where any data is anonymised or aggregated such that it no longer identifies an individual, it is no longer treated as personal data under this Policy or under the UK/EU GDPR.

Under the UK GDPR and, where applicable, the EU GDPR, you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data (“right to be forgotten”), subject to legal exceptions;
• request restriction of, or object to, certain processing, including processing based on legitimate interests or for direct marketing;
• request a portable copy of data you have provided to us, in a structured, commonly used format; and
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, contact us using the details in Clause 12. We will respond within one month, as required by the UK/EU GDPR. If you are not satisfied with our response, you may lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk, or, if you are located in the EEA, with your local supervisory authority.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform (including as it moves out of Beta), or legal requirements. Material changes will be notified via the Platform or by email, and the “Last updated” date above will be revised.

For privacy-related questions, access requests, or complaints, contact: info@arca-capital.io