ARC Privacy Policy

Effective date: October 31, 2026
Last updated: October 31, 2026

1. Introduction

Welcome to ARC (the "Platform"), an online personality assessment service designed to help individuals explore and understand aspects of their personality through structured assessments.

We respect your privacy and are committed to protecting your personal information in accordance with applicable data protection legislation, including the EU General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR), and applicable national data protection laws.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the rights available to you.

2. Who We Are

For the purposes of applicable data protection legislation, the organization operating ARC is the Data Controller.

Data Controller:: ARC AND YOU C.I.C.
Company number:: 11407440
Registered office:: 16 Beresford Square, London, England, SE18 6AY
Trading name:: ARC
Website:: https://my-arc.com
Contact email:: arcandyou@gmail.com
Telephone:: +44 7490 511145
Correspondence address:: 14 Beresford Gardens, Whetstone Road, London, England, SE3 8PY
Data protection contact:: arcandyou@gmail.com

Where required by law, details of our Data Protection Officer will be provided here.

3. Personal Information We Collect

Depending on how you use ARC, we may collect the following categories of information.

3.1 Account and registration information

First name and last name.
Email address.
Account credentials, stored in protected form.
Account identifiers.
Registration and account verification information.
Account status and relevant security records.

3.2 Assessment information

When you participate in an ARC assessment, we collect:

Your age, which you give when an assessment begins.
Assessment responses.
Selected answers and rankings.
Assessment progress.
Assessment scores.
Calculated personality results.
Assessment completion dates and related records.

Your assessment results are associated with your account or assessment session, as applicable.

3.3 Payment and transaction information

ARC may maintain records of payments associated with assessments, including:

Payment amount.
Currency.
Payment date.
Assessment or group associated with the payment.
Payment status.
Administrative transaction references.

Payments are recorded within ARC. Where payment is made through an external payment provider or another arrangement, the relevant provider may independently process payment information under its own privacy policy.

ARC does not require you to submit full payment-card details through the assessment platform.

3.4 Technical and security information

We may collect:

IP addresses.
Login and logout records.
Browser and device information where available.
Authentication and session records.
Security and administrative audit events.
Error and diagnostic information.

This information helps us maintain platform security, investigate misuse and troubleshoot technical problems.

4. How We Use Your Information

We process personal information for the following purposes:

Creating and managing user accounts.
Verifying email addresses.
Confirming that users meet the minimum age.
Authenticating users and maintaining secure sessions.
Delivering personality assessments.
Calculating and displaying assessment results.
Maintaining assessment history and preventing unauthorised repeat assessments.
Recording and administering payments.
Managing authorised administrators and group assessments.
Maintaining platform security and preventing fraud or misuse.
Responding to enquiries and support requests.
Meeting applicable legal and regulatory obligations.

We will not use assessment information for unrelated purposes without an appropriate lawful basis.

5. Lawful Bases for Processing

We rely on the following lawful bases under applicable data protection legislation:

5.1 Contractual necessity

Processing necessary to provide the ARC service, including account registration, assessment delivery, result generation and account administration.

5.2 Legitimate interests

Processing necessary for legitimate operational interests, including platform security, fraud prevention, service improvement, troubleshooting and protecting the rights of users and the platform.

We balance these interests against your privacy rights.

5.3 Legal obligations

Processing necessary to comply with applicable legal, regulatory, accounting or record-keeping obligations.

5.4 Consent

Where required, we will obtain your consent before processing information for a purpose that requires consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Personality Assessment Information

ARC collects information about assessment responses and calculated personality results.

Although personality assessment results are not automatically classified as special-category personal data under GDPR, they may be personal and potentially sensitive in context.

We therefore apply appropriate safeguards to assessment information.

We will:

Restrict access to authorised users and administrators.
Use assessment information only for legitimate ARC service purposes.
Avoid disclosing individual results to unauthorised persons.
Apply appropriate technical and organisational security measures.
Not sell individual assessment responses or results to third parties.

Assessment results are not intended to constitute medical, psychological, psychiatric or clinical diagnoses.

7. Who We Share Information With

We do not sell your personal information.

We may share information with service providers where necessary to operate ARC, including:

Cloud hosting and infrastructure providers.
Email delivery providers.
Technical support and maintenance providers.
Security and monitoring providers.
Professional advisers where necessary.
Government authorities or regulators where legally required.

Service providers acting as processors are expected to process information under appropriate contractual and confidentiality obligations.

We may also disclose information where necessary to establish, exercise or defend legal claims or protect the rights and safety of users and others.

8. International Data Transfers

ARC may use service providers or infrastructure located outside the European Economic Area or the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate legal transfer mechanism is in place, where required.

Such mechanisms may include:

An applicable adequacy decision.
Standard Contractual Clauses approved by the European Commission.
The UK International Data Transfer Agreement or UK Addendum, where applicable.
Other legally recognised safeguards.

9. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, including applicable legal, accounting and operational requirements.

Different categories of information may have different retention periods.

Our retention arrangements will cover:

User account information.
Assessment responses and results.
Payment and transaction records.
Authentication and security logs.
Administrative audit records.

Our default retention period is three years from your last activity on ARC. We may keep information for longer where a statutory obligation requires it, such as accounting or tax record-keeping, or where a legitimate exception applies, such as resolving a dispute, establishing or defending a legal claim, or investigating a security incident.

ARC does not delete information automatically when a retention period ends. Our procedure for reviewing and deleting information manually is not yet operational. Until it is, you can still ask us to delete your information, as described below.

To request deletion, contact us using the details in section 17. We may need to verify your identity. We will tell you the outcome of your request, and we may keep information where a statutory obligation or legitimate exception requires it.

Where information is no longer required, it will be securely deleted or anonymised, subject to applicable legal requirements and technical limitations.

10. Data Security

We implement appropriate technical and organisational measures designed to protect personal information against:

Unauthorised access.
Accidental loss.
Destruction.
Alteration.
Unauthorised disclosure.
Other unlawful processing.

These measures may include access controls, password protection, encryption, secure communication, audit logging, backups and restricted administrative privileges.

No internet-based service can guarantee absolute security. However, we take reasonable and appropriate steps to protect information entrusted to us.

11. Your Data Protection Rights

Subject to applicable law and any relevant exemptions, you may have the right to:

Access: Request a copy of personal information we hold about you.
Rectification: Request correction of inaccurate or incomplete information.
Erasure: Request deletion of personal information in certain circumstances.
Restriction: Request restriction of processing in certain circumstances.
Portability: Request certain information in a structured, commonly used and machine-readable format.
Object: Object to processing based on legitimate interests.
Withdraw consent: Withdraw consent where processing relies on consent.
Complain: Lodge a complaint with the relevant data protection supervisory authority.

To exercise your rights, contact:

Email:: arcandyou@gmail.com

We may need to verify your identity before responding.

We aim to respond within the time limits prescribed by applicable data protection law.

12. Automated Processing and Assessment Results

ARC uses programmed assessment rules to evaluate responses and calculate personality results.

These calculations are part of the service you request when completing an assessment.

The results should not be treated as a medical diagnosis, a definitive statement about your identity or a substitute for professional advice.

Where applicable data protection law grants you rights concerning solely automated decisions that produce legal or similarly significant effects, you may exercise those rights by contacting us.

13. Cookies and Session Technologies

ARC uses essential technical technologies, including authentication and session cookies, to:

Maintain secure user sessions.
Authenticate users.
Protect account access.
Support essential platform functionality.

Where non-essential cookies or tracking technologies are introduced, we will provide appropriate information and obtain consent where required by law.

14. Children's Privacy

The minimum age to use ARC is 16.

ARC is not intended for children below the minimum age specified in its registration requirements.

We ask you to confirm that you meet this age when you register, and to give your age when an assessment begins. We rely on what you tell us and do not independently verify your age.

If we become aware that personal information has been collected from a child in circumstances where processing is not permitted, we will take appropriate steps in accordance with applicable law.

15. Data Breaches

If a personal data breach occurs, we will investigate and take appropriate steps to contain, assess and mitigate its effects.

Where legally required, we will notify the relevant supervisory authority and affected individuals within the applicable statutory time limits.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our services, operations or legal obligations.

The updated version will be published on the ARC website with a revised effective date.

17. Contact Us

For privacy-related enquiries, requests or complaints, contact:

ARC

Email:: arcandyou@gmail.com
Telephone:: +44 7490 511145
Website:: https://my-arc.com
Correspondence address:: 14 Beresford Gardens, Whetstone Road, London, England, SE3 8PY