Privacy Policy

1. Introduction

Arcetta ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our AI-powered operational systems and services.

This policy complies with international data protection regulations including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Brazil's Lei Geral de Proteção de Dados (LGPD), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable data protection laws worldwide.

2. Data Controller

Arcetta acts as the data controller for personal information collected through our website and services. For any inquiries regarding your data, please contact our Data Protection Officer at privacy@arcetta.com.co.

3. Information We Collect

3.1 Information You Provide

• Contact information (name, email address, phone number, company name)
• Account credentials and authentication data
• Business information provided during consultations
• Communications and correspondence with our team
• Payment and billing information (processed by secure third-party providers)

3.2 Automatically Collected Information

• Device information (IP address, browser type, operating system)
• Usage data (pages visited, time spent, click patterns)
• Cookies and similar tracking technologies
• Log files and analytics data

3.3 AI System Data

When using our AI-powered services, we may process operational data, workflow information, and system logs necessary to deliver and improve our services. All AI processing is conducted with strict data minimization principles.

4. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds:

• Consent: Where you have given explicit consent for specific processing activities
• Contractual Necessity: Processing necessary to perform our services and fulfill our contractual obligations
• Legitimate Interests: Processing necessary for our legitimate business interests, provided they do not override your rights
• Legal Obligation: Processing required to comply with applicable laws and regulations

5. How We Use Your Information

• Providing, maintaining, and improving our AI operational systems
• Processing transactions and managing your account
• Communicating with you about services, updates, and support
• Analyzing usage patterns to enhance user experience
• Ensuring security and preventing fraud
• Complying with legal obligations and enforcing our terms
• Research and development of new features (using anonymized data only)

6. Data Sharing and Disclosure

We do not sell your personal information. We may share your data with:

• Service Providers: Trusted third parties who assist in operating our services (hosting, analytics, payment processing)
• Business Partners: With your consent, for collaborative service delivery
• Legal Requirements: When required by law, court order, or government request
• Business Transfers: In connection with mergers, acquisitions, or asset sales

All third-party processors are contractually bound to protect your data and process it only as instructed by us.

7. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Binding Corporate Rules for intra-group transfers
• Adequacy decisions where applicable
• Certification mechanisms and codes of conduct

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, comply with legal obligations, resolve disputes, and enforce our agreements. Retention periods vary based on:

• Active account data: Duration of your account plus 3 years
• Transaction records: 7 years for tax and legal compliance
• Marketing communications: Until you unsubscribe
• Analytics data: 26 months (anonymized thereafter)

9. Your Privacy Rights

9.1 GDPR Rights (EU/EEA Residents)

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw consent at any time without affecting prior processing
• Right to Lodge a Complaint: File a complaint with your supervisory authority

9.2 CCPA/CPRA Rights (California Residents)

• Right to Know: What personal information we collect and how it's used
• Right to Delete: Request deletion of your personal information
• Right to Correct: Correct inaccurate personal information
• Right to Opt-Out: Opt-out of the sale or sharing of personal information (we do not sell data)
• Right to Non-Discrimination: Equal service regardless of exercising your rights
• Right to Limit Use of Sensitive Information: Restrict use of sensitive personal information

9.3 LGPD Rights (Brazil Residents)

• Confirmation of data processing and access to data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary data
• Data portability to another service provider
• Information about public and private entities with which data is shared
• Revocation of consent

9.4 PIPEDA Rights (Canada Residents)

• Access to your personal information held by us
• Challenge the accuracy and completeness of your data
• Withdraw consent (subject to legal restrictions)

10. How to Exercise Your Rights

To exercise any of your privacy rights, please contact us at:

We may need to verify your identity before processing your request. We will not charge a fee for most requests unless they are manifestly unfounded or excessive.

11. Data Security

We implement industry-standard security measures to protect your personal information, including:

• End-to-end encryption for data in transit (TLS 1.3)
• AES-256 encryption for data at rest
• Multi-factor authentication for account access
• Regular security audits and penetration testing
• SOC 2 Type II compliance
• ISO 27001 certified information security management
• Employee training and access controls

12. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. Types of cookies we use:

• Essential Cookies: Required for basic site functionality
• Analytics Cookies: Help us understand how visitors interact with our site
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Used with your consent to deliver relevant content

You can manage cookie preferences through your browser settings or our cookie consent manager.

13. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately at privacy@arcetta.com.co.

14. Do Not Track Signals

We honor Do Not Track (DNT) signals sent by your browser. When DNT is enabled, we disable non-essential tracking and analytics cookies.

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on our website and, where required, by email. Your continued use of our services after any changes constitutes acceptance of the updated policy.

16. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us: