This Privacy Policy explains how we process your personal data when you visit this website, including any mobile or device-specific version (the “Website”), sign up for our emails, or otherwise communicate with us, including through our official social media accounts.
Personal data means any information relating to an identified or identifiable individual.
This Privacy Policy does not cover the processing of your personal data in your capacity as:
- A candidate in our recruitment process;
- Our employee or contractor.
These processing activities are covered by separate privacy notices, which we provide at the appropriate time.
Please read this Privacy Policy carefully to understand how we collect, use, and disclose your personal data.
1. Who we are
“We”, “us”, and “our” refer to Arnor Limited, a company incorporated under the laws of the Republic of Cyprus, with registration number ΗΕ 498843 and its registered address at 84 Spyrou Kyprianou Avenue, 4004 Limassol, Cyprus.
If you have any questions or concerns about how we handle your personal data, you can contact us at legal@arnor.fit or write to our registered office: 84 Spyrou Kyprianou Avenue, 4004 Limassol, Cyprus.
2. What personal data we process
In most cases, we collect personal data directly from you, such as when you contact us or subscribe to our email updates.
In some cases, personal data about you is provided to us by third parties, including our service providers, for instance as part of the know-your-customer (KYC) checks we carry out before signing a contract with you.
In addition, we collect information about how you use the Website, including through cookies and similar technologies.
You are not generally required by law to provide us with personal data. However, we may need certain information to respond to your inquiry or enter into a contract with you. If you do not provide this information, we may be unable to proceed. Please ensure that the information you provide is complete and accurate.
2.1. Information you provide or we receive from third parties
We process the following categories of personal data when you communicate or engage with us. We may also receive some data from service providers or third parties when conducting know-your-customer (KYC) checks before entering into a contract with you:
| Categories | Details |
|---|---|
| Identity and Contact Data | Your name and contact details, such as your email address. |
| Communication Data | Your communications with us, including emails, letters, and messages or interactions through our official social media accounts. |
| Business Data | Information about your business, including its name, industry, registration details, legal status, and relevant regulatory references, to the extent that this information relates to you as an individual. |
2.2. Information collected automatically
We automatically collect the following information when you interact with our Website:
| Categories | Details |
|---|---|
| Device Data | Information about your device’s hardware and software, IP address, network traffic, access dates and times, pages visited, language settings, etc. |
| Usage Data | Information about how you use the Website, including pages visited, content viewed, and links or buttons clicked. |
3. How we use your personal data
We will use your personal data for the following purposes and on the corresponding lawful bases:
| Purpose | Categories | Lawful basis |
|---|---|---|
| To provide information and respond to your requests | Identity and Contact Data Communication Data Business Data |
Contract, where necessary to take steps at your request before entering into a contract with you Legitimate interests in responding to your inquiries |
| To manage our relationship with you and fulfill our contractual obligations | Identity and Contact Data Communication Data Business Data |
Contract, where you are a party to the contract Legitimate interests in managing business relationships, including where you represent an organization |
| To detect and prevent fraud and other unlawful activities | Identity and Contact Data Business Data |
Legal obligation, where a specific law requires the processing Legitimate interests in protecting our business and managing risks |
| To comply with our legal and regulatory obligations | Identity and Contact Data Business Data |
Legal obligation |
| To administer and protect our business and the Website | Identity and Contact Data Business Data Device Data |
Legitimate interests in administering and protecting our business and Website, maintaining network security, and preventing fraud |
| To develop and improve our Website, marketing activities, and business relationships | Communication Data Device Data Usage Data |
Consent, where required for cookies or similar technologies Legitimate interests in understanding and improving our Website, marketing activities, and business relationships |
| To disclose personal data within our corporate group | Identity and Contact Data Communication Data Business Data Device Data Usage Data |
Legitimate interests in coordinating group operations, internal administration, and shared support services Legal obligation, where sharing is required by applicable law |
| To send you direct marketing communications in accordance with your preferences | Identity and Contact Data Communication Data |
Consent, where required by law Legitimate interests in promoting our business and maintaining business relationships |
4. How we disclose your personal data
4.1. Service providers
We use service providers to run the Website and support business activities. We put contractual arrangements in place and require appropriate protection for the information they receive. Depending on the activity, categories of providers include:
| Categories of providers | Purpose of processing |
|---|---|
| Hosting and technical infrastructure | To store data and documents and facilitate both internal and external communications |
| Know-your-customer (KYC) providers | To conduct know-your-customer (KYC) checks, politically exposed person (PEP) screening, and sanctions screening |
| Electronic signature services | To facilitate the electronic signing and exchange of documents |
| Data analytics providers | To understand how visitors use the Website and improve their experience |
| Marketing providers | To manage business relationships, communicate with you, and send marketing communications where applicable |
| Audit, legal, and compliance services | To obtain advice and services from lawyers, accountants, auditors, and other professional advisers |
4.2. Group companies
Where needed, we may share your personal data with other members of our group of companies to keep business processes operating, obtain legal, compliance, or financial support, meet regulatory duties, prepare reports, and oversee group activities. Group companies may also provide hosting, system maintenance, and support, or assist with business continuity during a merger or acquisition. They are required to maintain suitable technical and organizational protections for personal data.
4.3. Public authorities and legal proceedings
We may share your personal data with public authorities where applicable law requires or allows it. This can include responding to a lawful request or court order, bringing or defending legal claims, or safeguarding the rights, privacy, safety, or property of our group companies, you, or others.
4.4. Corporate transactions
Personal data may form part of a transaction involving our business or assets, including an acquisition, disposal, merger, consolidation, or bankruptcy. In those circumstances, it may be disclosed or transferred to a recipient that must handle it in accordance with applicable data protection law. We will give any legally required notice of the transaction and a resulting change of controller.
5. International data transfers
We work with service providers in various countries, including countries outside the European Economic Area (“EEA”) and the United Kingdom (“UK”). These countries may not provide the same level of protection for personal data. Where a transfer is subject to the GDPR or UK GDPR, we use an applicable transfer mechanism described below:
| Transfer mechanism | Description |
|---|---|
| Adequacy decision | We may transfer personal data to countries, territories, or recipients covered by an applicable adequacy decision of the European Commission or UK adequacy regulations. Further information is available on EEA adequacy decisions and UK adequacy arrangements. |
| Appropriate safeguards | Where applicable, we use contractual safeguards, such as the European Commission’s Standard Contractual Clauses and, for UK transfers, the UK Addendum or International Data Transfer Agreement. We apply additional safeguards where necessary to protect your personal data. |
| Derogations | In specific circumstances, we may rely on a permitted exception, such as your explicit consent, a transfer necessary to perform a contract with you, important reasons of public interest, or legal claims. We rely on these exceptions only where their legal conditions are met. |
Please contact us if you would like further details of the mechanism used for your personal data or a copy of the relevant safeguards.
6. Security
We use technical and organizational safeguards appropriate to protecting personal data from loss, destruction, unauthorized changes, access, or disclosure, whether accidental or unlawful. Access is restricted to people who need the information for legitimate business purposes.
7. Data retention
We keep your personal data only for as long as necessary to fulfill the purposes for which it was collected. The retention period depends on the type of data collected and on applicable laws, which may require us to keep certain data for a specified time.
For most business-related processing, our default retention period is six years. Some records connected with a contract may need to be kept longer to meet legal requirements, including tax and accounting obligations.
When we no longer need your personal data, we securely delete it or anonymize it so that it can no longer be linked to an individual. You can contact us for information about the retention period that applies to your personal data.
8. Data protection rights
8.1. Your rights
Under data protection law, you have a number of rights in relation to your personal data. Below is a summary of the legal rights you have:
| Right | Description |
|---|---|
| Right to access | You have the right to obtain confirmation of whether we process personal data about you and receive a copy of that data, together with information about how we use it. |
| Right to rectification | You may ask us to correct personal data about you that is inaccurate and to complete data that is incomplete. |
| Right to erasure | You have the right to ask us to delete your personal data in certain circumstances. We will do so where the law requires, but we may need to retain certain data (for example, tax records). |
| Right to restriction of processing | You may ask us to restrict processing in certain circumstances, for example, while we check the accuracy of your personal data or assess an objection you have raised. |
| Right to object | You may object, on grounds relating to your particular situation, to processing based on legitimate interests. We will stop unless we can demonstrate compelling overriding grounds or need the data for legal claims. You can object to direct marketing at any time. We will then stop processing your data for those purposes. |
| Right to data portability | Where processing is automated and based on consent or a contract, you may receive the personal data you have provided to us in a structured, commonly used, machine-readable format and transmit it to another controller. Where technically feasible, you may ask us to transmit it directly. |
| Right to withdraw consent | Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal. You can unsubscribe from marketing emails using the link in any such email, or contact us. |
| Right not to be subject to automated decision-making | We do not make decisions about you that produce legal effects or similarly significantly affect you based solely on automated processing. Nevertheless, under the applicable data protection laws, you have the right to not be subject to a decision based solely on automated processing, without human involvement, that has a legal effect or significantly affects you. This right allows you to request the involvement of one of our employees or representatives in the decision-making process. |
| Right to complain | You may complain to the relevant data protection authority, particularly in the country where you habitually reside or work, or where an alleged infringement occurred. You are welcome to contact us first, but you do not have to do so before making a complaint. |
8.2. How to exercise your rights
You are not required to pay any charge for exercising your data protection rights. We have one month to respond to you. Please contact us as described below if you wish to exercise your data protection rights. We may need to request specific information from you to confirm your identity before complying with your request.
9. Automated decision-making
Automated decision-making occurs when a system uses personal data to make a decision without human involvement. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
10. Minors
The Website is not intended for or directed at individuals under the age of majority in their jurisdiction. If you are under the age of majority in your jurisdiction, you must not use the Website or provide any personal data to us.
If you have any reason to believe that a minor has shared any information with us, please contact us as described below.
11. Cookies
When you visit or interact with the Website, we and authorized third parties use cookies and similar technologies, such as web beacons, pixels, tags, and scripts (collectively, “cookies”).
Cookies allow us and these third parties to collect information about your device and how you interact with the Website. We use this information to support navigation, remember your preferences, improve the Website’s performance, analyze its use, and personalize content.
11.1. What cookies are
Cookies are small text files stored on your computer or mobile device when you visit a website. Similar technologies may also collect information about your device and browsing activity without storing a text file.
11.2. Storing cookies
Cookies set by us are called “first-party cookies”. Cookies set by other providers, such as analytics and advertising providers, are called “third-party cookies”.
Cookies may remain on your device for the duration of your browsing session (“session cookies”) or until they expire or you delete them (“persistent cookies”). Persistent cookies allow information, such as your preferences, to be remembered across visits.
11.3. Types of cookies we use
We may use the following types of cookies:
| Type | Description |
|---|---|
| Necessary cookies | These cookies are essential for the Website to operate and provide functions such as navigation and security. They do not require your consent and cannot be disabled through our consent management platform. You can block them through your browser settings, but some parts of the Website may not work properly. |
| Functional cookies | These cookies remember your preferences, such as language or region, to provide a more personalized experience. |
| Performance cookies | These cookies collect information about how visitors use the Website, such as which pages they visit. They help us understand usage patterns and improve the Website’s usability and performance. |
| Marketing cookies | These cookies collect information about your browsing activity, including across websites, to deliver advertising relevant to your interests and measure its effectiveness. |
11.4. How to manage cookies
Where consent is required, we ask for it through our consent management platform before using the relevant cookies. You can use the Website’s cookie controls to change your choices or withdraw consent.
Your browser also provides controls for removing cookies or preventing them from being stored. The following links explain how to manage your cookie preferences:
- Information about cookies in general;
- How to manage your cookies in Mozilla Firefox;
- How to manage your cookies in Chrome;
- How to manage your cookies in Safari;
- How to manage your cookies in Microsoft Edge.
The following industry services offer additional choices for advertising provided by participating businesses:
- Network Advertising Initiative;
- Digital Advertising Alliance;
- Digital Advertising Alliance (Canada);
- European Interactive Digital Advertising Alliance;
- DAA AppChoices (mobile).
12. How to contact us
For any questions about this Privacy Policy or how we handle personal data, or to exercise your data protection rights, you can contact us at legal@arnor.fit or write to our registered office: 84 Spyrou Kyprianou Avenue, 4004 Limassol, Cyprus.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. The current version will always be available on the Website, with the date of the latest revision shown at the top. Where required by law, we will provide additional notice of material changes. Please check this Privacy Policy from time to time.