Privacy Policy

01Who is responsible for your data

[COMPANY LEGAL NAME] ("ARC", "we") is the controller of personal data collected through this website and in our relationship with clients and leads. Address: [REGISTERED ADDRESS]. Contact: [email protected].

Data Protection Officer / Encarregado (LGPD): [DPO NAME], [email protected]. EU/UK representative, if required: [REPRESENTATIVE DETAILS].

02When ARC is a processor

When we run a website, CRM, course platform, community or app for a coach, we process their clients' personal data on the coach's behalf and on their instructions. In that case the coach is the controller and their privacy notice applies. ARC acts as processor under a Data Processing Agreement. If you are a coach's client and want to exercise your rights, contact the coach first. We will help them respond.

03Personal data we collect

Data you give us

• Contact and business details: name, email, phone, business name, social handles, website.
• What you tell us in forms, calls, emails and DMs, including your goals and current numbers.
• Booking details when you schedule a call.
• Billing details. Card data is handled directly by our payment processor, [PAYMENT PROCESSOR], and never stored by ARC.

Data collected automatically

• Technical data: IP address, browser, device, pages visited, referring page and approximate location from the IP address.
• Cookies and similar technologies, as described below.

Data from others

• Social platforms, when you contact us there or interact with our content.
• Referrals from existing clients and partners.

04Why we use it and our legal bases

05AI and automated processing

We use AI tools to help draft content, summarise calls you agree to record, and support operations. A person at ARC reviews outputs before they are used for you. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

We do not use your personal data or your clients' data to train third-party AI models, and we choose providers that contractually exclude training on customer data. [ADJUST TO YOUR PROVIDERS]

06Cookies and third-party resources

Strictly necessary cookies keep the website working. Analytics and marketing cookies ([ANALYTICS TOOL], [AD PIXELS]) are only set with your consent where the law requires it, and you can change your choice at any time through [COOKIE SETTINGS LINK].

To display this website, your browser loads some resources directly from third-party providers, which receive your IP address and browser information: fonts from Google Fonts (Google), scripts from cdnjs (Cloudflare) and jsDelivr, and photos from Unsplash.

07Who we share data with

We share personal data only with:

• service providers acting on our instructions: hosting ([HOSTING PROVIDER]), CRM and email ([CRM/EMAIL PROVIDER]), scheduling (Cal.com), payments ([PAYMENT PROCESSOR]), messaging ([MESSAGING PROVIDER]) and analytics ([ANALYTICS TOOL]);
• professional advisers such as accountants and lawyers;
• authorities, when the law requires it;
• a buyer or successor, if ARC is involved in a merger or acquisition, under equivalent protection.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

08International transfers

Some providers are located outside your country, including in the United States. Where required, we protect transfers with Standard Contractual Clauses or other mechanisms recognised under the GDPR, the UK GDPR and LGPD (article 33).

09How long we keep data

• Leads who do not become clients: up to [24] months after our last contact.
• Client records and contracts: for the duration of the relationship plus [5] years, or longer where tax law requires.
• Website analytics: up to [14] months.
• Data we process for coaches: as instructed by the coach, and deleted or returned at the end of the contract.

10Your rights

Depending on where you live, you can ask us to:

• confirm whether we process your data and give you access to it;
• correct inaccurate or incomplete data;
• delete, anonymise or block data that is unnecessary or processed unlawfully;
• transfer your data to you or another provider (portability);
• object to processing based on legitimate interests, including direct marketing;
• restrict processing;
• tell you who we shared your data with;
• withdraw consent at any time, without affecting earlier processing.

Residents of US states with privacy laws can also ask to know, correct and delete their data, and to opt out of sale or sharing. We do not sell or share data for advertising. We will not discriminate against you for using these rights.

Send requests to [email protected]. We reply within the deadlines set by law (generally 15 days under LGPD, one month under GDPR and 45 days under US state laws) and may ask you to verify your identity.

You can also complain to a supervisory authority: the ANPD in Brazil, your local data protection authority in the EU/UK, or your state attorney general in the US.

11Children

This website and our services are for businesses and adults. We do not knowingly collect data from children under 16. If you believe a child has given us data, contact us and we will delete it.

12Security

We use encryption in transit, access controls, two-factor authentication on internal tools, and least-privilege access for staff and providers. No system is perfectly secure. If a breach is likely to harm you, we will notify you and the authorities as the law requires.

13Changes to this policy

We may update this policy. The "Last updated" date shows the current version, and we will tell you about material changes before they apply.

14Contact

Privacy questions or requests: [email protected]. Data Protection Officer: [DPO NAME], [email protected]. Post: [COMPANY LEGAL NAME], [REGISTERED ADDRESS].

This document is a template prepared for ARC and must be reviewed by a qualified lawyer before publication. Replace every highlighted placeholder in brackets.