What we do with your data.

Arquely is the controller of the personal data described in this policy. The legal entity that will operate the site and the products is being incorporated; as soon as registration is complete, its company name, registered office and tax number will be published on this page and in the legal notice.

Until then, processing is carried out by the founding team with the same duties and the same commitments this policy describes. The rights set out here can be exercised now, without waiting for the company to be incorporated.

Contact for every data protection matter, including exercising rights: contact@arquely.com. Messages are read by the people who actually handle the subject and answered within the deadline in section 16.

This policy covers four concrete situations: (a) visits to the pages of this site; (b) joining the interest list and messages we receive through the form; (c) email correspondence, including enquiries, proposals and negotiation; (d) participation in pilots and delivery of contracted services, where Arquely determines the processing.

When Arquely processes documents and data on behalf of a client company — for example in Document Intelligence — the client is the controller and Arquely acts as a processor under the contract and the applicable data processing agreement. In those cases the contract with the client governs, not this page.

For data processed on behalf of clients, the contract and the data processing agreement (the data protection annex) signed with each client apply and prevail over this policy where they differ. This policy describes Arquely's practice when it acts as controller: the site, the interest list, correspondence and project preparation.

Either way, the principles are the same: process the minimum necessary, for the concrete purposes that were explained, and keep data only as long as it is needed.

• Personal data — any information relating to an identified or identifiable natural person.
• Data subject — the natural person the personal data relates to.
• Processing — any operation performed on personal data, from collection to deletion.
• Controller — whoever decides why and how personal data is processed; in the situations described in this policy, Arquely.
• Processor — whoever processes personal data on behalf of, and on the instructions of, the controller; Arquely has this role in services provided to client companies.
• GDPR — Regulation (EU) 2016/679, the European data protection regulation, directly applicable in Portugal.
• Supervisory authority — the independent body that oversees compliance with data protection law (in Portugal, the CNPD).
• Pilot — a time- and scope-limited project in which Arquely and a company test a service with real or anonymised data, as agreed.
• Data processing agreement — the contractual annex fixing the object, duration, nature and purposes of processing on behalf of a client.

• Lawfulness, fairness and transparency: we process data only on a basis set out in law, and we explain what we do in plain language.
• Purpose limitation: data collected for one purpose is not reused for an incompatible one.
• Minimisation: we ask only for what is necessary — on the site form, for example, only an email and an optional comment.
• Accuracy: we correct or erase data when asked, or when we detect errors.
• Storage limitation: every category of data has a deadline in section 14 and is deleted or reviewed when it ends.
• Integrity and confidentiality: data is protected with the technical and organisational measures described in section 18.
• Accountability: we document processing decisions, including provider choices and security measures, so we can demonstrate compliance.

• The email you write in the interest form — so we can reply and follow up on the contact.
• The optional comment in the form — so we understand the context of the request without asking for more fields.
• The page language (for example PT or EN) — to show the site in the right language without asking again.
• The time and date of submission — needed to manage the list and for security (abuse detection).
• A cryptographic hash of the IP address, kept in memory for a few seconds only — used solely to rate-limit repeated submissions; it is never written to a file or linked to the email.
• Honeypot fields (techniques to detect bots) — checked on the server to block spam; they contain no personal data of yours.
• Language cookie and form draft — described in detail in the Cookie Policy; the draft stores the email and comment only while the tab is open, in your own browser.

In pilots, we process the business contacts of participating companies (name, role, email and phone, when you provide them yourself), meeting notes and project decisions, and the operational data used to measure results — for example, how many documents were processed and how many needed human correction.

Wherever possible, pilots use anonymised or sample documents. When a pilot requires real data, that is agreed in writing before any processing, with defined purposes, deadlines and limits, and with the minimum data necessary.

In services contracted by a client company, Arquely processes data strictly under the contract and the data processing agreement: the client decides the purposes, Arquely executes and reports.

• We do not ask for your name, phone number, address or date of birth to use the site.
• We do not geolocate or collect precise location.
• We do not process payments on this site — no card or bank details.
• We do not process special categories of data (health, beliefs, ethnic origin, biometrics) in the site forms.
• We do not collect children's data: the site is aimed at professionals and companies.
• We do not do behavioural profiling, device fingerprinting or personalised advertising.
• We never sell or rent personal data to anyone, under any circumstances.

Consent: when you submit your email in the form, you authorise us to contact you about the products and the interest list. You can withdraw that consent at any time by writing to contact@arquely.com; processing already carried out remains valid, but we stop processing for that purpose.

Pre-contractual steps: when you ask for a proposal or negotiate a project, we need to use your data to reply, budget and prepare the contract — even before anything is signed.

Legitimate interest: we use minimal security measures to prevent spam and form abuse. We assessed that this interest does not override visitors' rights, because the IP hash exists in memory for seconds only and is never linked to an identity.

Legal obligation: once services are invoiced, the mandatory elements of invoices are kept for the period tax law requires, even if the client requests erasure.

We only send messages directly related to what you asked for or to ongoing projects: a reply to an enquiry, a follow-up to a conversation, information on pilot status and requests for decisions. We do not send newsletters or campaigns to anyone who did not ask for them, and we never share email lists with third parties.

Every message says how to stop. If you ask not to be contacted again, we remove the address from the interest list and keep only the minimal record of your request, so we can honour it.

• Hosting and infrastructure: where the site and tools run (the specific provider will be identified on this page once production infrastructure is contracted).
• Transactional email: the service that delivers messages and keeps the sending log.
• Internal contact and project management tools, with access limited to the team.
• In document services: OCR and language model (AI) services, always under Arquely's or the client's instructions, depending on each role.
• Professional advisers (legal or accounting), when necessary, with their own professional secrecy duties.

Data is accessible only to those who need it for the purposes described: the Arquely team and a small set of providers acting on its behalf. None of them may use the data for their own purposes; all are bound by contracts with confidentiality and security duties.

Arquely's preference is to keep data inside the European Economic Area. When a provider involves a transfer outside the EEA, it only happens with a mechanism under Chapter V of the GDPR — for example an adequacy decision by the European Commission or the standard contractual clauses — plus supplementary measures where necessary.

For clients and participants in Mozambique, processing follows applicable Mozambican law (for now Law No. 3/2017 and the regime that replaces it) and data may be processed in Portugal, in Mozambique or in the region agreed with the client, always with the same care.

Choosing any provider outside the EEA requires a documented decision and informing the client before any data is transferred.

• Access (Article 15 GDPR): know whether we process your data, which data and in what circumstances, with a copy.
• Rectification (Article 16): correct inaccurate data or complete incomplete data.
• Erasure (Article 17): ask for deletion when data is no longer necessary or the basis falls away.
• Restriction (Article 18): ask us to pause processing of some data, for example while a correction is being assessed.
• Portability (Article 20): receive the data you provided in a structured, machine-readable format.
• Objection (Article 21): object to processing based on legitimate interest, such as form security.
• Automated decisions (Article 22): not to be subject to decisions with significant effects taken by algorithms alone — in our services, human review is mandatory.
• Withdraw consent: at any time and without giving reasons, where the basis is consent.
• Notification of corrections (Article 19): when we rectify or erase data, we inform those who received it, unless impossible.
• Complain (Article 77): lodge a complaint with a supervisory authority — see section 17.

Write to contact@arquely.com with the right you want to exercise and enough information to locate the data (for example, the email used in the contact). The request needs no particular form and no justification.

Where there are well-founded doubts about who is asking, we may request the minimum additional information to confirm the request comes from the data subject; we never ask for more than necessary.

Exercising rights is free of charge. We reply within one month, extendable by two months for complex requests, with the data subject informed during the first month. If a request is refused, we explain why and how to complain.

If the data concerns someone else (a colleague or a client, for example), we forward the request to whoever can satisfy it, respecting each party's duties.

You may lodge a complaint with the national supervisory authority: the Portuguese Data Protection Commission (CNPD), whose contacts are published at www.cnpd.pt. In Mozambique, the competent personal data authority will be named here as soon as its designation is formally confirmed; until then, requests can be addressed to Arquely, which routes them under applicable law.

You can always start with us: many problems are solved faster in a direct conversation, and Arquely's reply neither prevents nor conditions the complaint to the authority.

• Encrypted connections (HTTPS/TLS) on every page, without exception.
• Access restricted per person and per project, with individual accounts and minimal permissions.
• Multi-factor authentication on the services that support it.
• Passwords and keys stored only in dedicated managers, never in shared documents.
• Demonstration environments separated from environments with real data.
• Pilot documents stored in an identified location and deleted at the agreed deadline.
• Updated systems and periodic access reviews.
• Logging minimisation: we prefer not to collect data over having to protect it.

We apply technical and organisational measures appropriate to the risk, including:

If a personal data breach occurs — unauthorised access, loss or disclosure — we record the incident, assess the risk and act to contain it. Where the law requires it, we notify the supervisory authority within 72 hours of becoming aware, describing the nature of the breach, its likely consequences and the measures taken.

If the breach poses a high risk to anyone's rights, we communicate directly with the affected people. In services provided to companies, we inform the client without undue delay, so it can meet its own obligations.

We do not take decisions with significant effects on people based solely on automated processing, and we do not profile anyone for advertising or behaviour scoring. In document services, OCR and AI software extracts and classifies information, but decisions that produce effects — approve, reject, post — go through human review, as described in the Service Conditions.

If that ever changes in a project, the basis and the procedure will be explained in writing before processing starts.

The site, the interest list and the products are aimed at professionals and companies, not at anyone under 18. We do not knowingly collect children's data. If we find we have received it, we delete it as soon as possible.

The site uses one language cookie and, in the form, a draft kept in your own browser's session storage. There are no analytics, advertising or social media cookies. The full inventory, with names, durations and reasons, is in the Cookie Policy published on this site.

To serve the page in the right language, we may read technical headers your browser sends (such as the preferred language). That signal is used at request time and is not stored as personal data. A manual language choice lives in the cookie described in the Cookie Policy.

This policy is reviewed whenever Arquely's practice or the law changes. The effective date is at the top of the page; previous versions can be requested by email. Material changes are communicated to those on the interest list, before they take effect, where the law requires it.

Continuing to use the site after a published change means accepting the version in force for subsequent visits; for processing based on consent, fresh consent is only requested when the change requires it.

This policy is governed by the GDPR and the Portuguese law implementing it (Law No. 58/2019). Where the data subject or the processing is subject to Mozambican law, Law No. 3/2017 also applies, together with the regime that replaces it.

Nothing in this policy reduces any mandatory right granted by the law of the data subject's country: in case of conflict, those rights prevail.

For any question about this policy or your data — including access, correction, deletion or objection requests — write to contact@arquely.com. We aim to reply within the same business day whenever possible, and never leave a request unanswered beyond the legal deadlines.