Privacy notice | Arithmia

1. Who we are

Arithmia (company number SC826807, registered in Scotland) of 48 West George Street, Glasgow G2 1BP, United Kingdom, is the controller of the personal information described in this notice. Contact us about privacy at contact@arithmia.org or by post at the address above.

We are registered with the Information Commissioner's Office (ICO). Registration number: [ICO registration number].

2. What this notice covers

This notice covers personal information about people who visit our website, contact us, are customers, prospective customers or business partners (and their staff), suppliers, and people who apply to work with us.

It does not cover data we process for our customers. When we process data on a customer's behalf, including patient or health data, we act as the customer's processor. The customer decides how that data is used, and its own privacy notice applies. Please contact the customer organisation about that data.

3. Information we collect

Who	Information	Source
Website visitors	IP address and technical information your browser sends (see section 8). We do not use cookies, analytics or advertising trackers.	Your browser
People who contact us	Name, work email, phone, organisation, role, and what you tell us in your message	You, by email
Customers, prospects and partners	Business contact details, role, communications, meeting notes, contract and billing details	You, your organisation, business networks (e.g. Enterprise Europe Network, Konfer, LinkedIn), events and public sources
Suppliers	Business contact details, contract and payment details	You or your organisation
Job applicants	CV, contact details, right-to-work information and interview notes	You, recruiters, referees

We do not intend to collect special category data (such as health information) about these people. Please do not send it to us unless we ask for it for a specific reason.

4. Why we use it and our lawful basis

Purpose	Lawful basis (UK GDPR Art. 6)
Replying to enquiries and preparing proposals	Legitimate interests (responding to people who contact us); or steps before a contract
Providing our services and managing the customer relationship	Contract; legitimate interests where the contract is with your employer
Business development: contacting business contacts about relevant services	Legitimate interests. You can object at any time. We follow the electronic marketing rules (PECR) for business email
Managing suppliers and paying invoices	Contract; legal obligation (accounting and tax records)
Recruitment	Steps before a contract; legal obligation (right-to-work checks)
Security of our website and systems, and keeping records required by law	Legitimate interests; legal obligation

We do not sell personal information, and we do not make decisions about you based solely on automated processing.

5. Who we share it with

Only with service providers who help us run the business, under contracts that require them to protect it: cloud hosting providers (such as Amazon Web Services and Microsoft), our email, office and collaboration software providers, our accountants, banks, insurers and professional advisers, and recruitment partners. We may also share it where the law requires, or with a buyer if our business is sold.

Arithmia is related to BrainBerry Ltd (same founder). We share personal information with BrainBerry Ltd only where it provides a service to us under a written agreement.

6. International transfers

Some providers process information outside the UK, for example in the EU or the United States. When they do, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for details.

7. How long we keep it

Enquiries that do not lead to business: up to 2 years after our last contact
Customer and supplier records: the length of the relationship plus 6 years (tax records and limitation periods)
Unsuccessful job applications: 6 months after the decision, unless you agree to longer
Website technical logs: up to 12 months, for security

8. Cookies and our website

Our website does not set cookies and does not use analytics or advertising trackers. Pages load fonts from Google Fonts; to deliver them, your browser sends your IP address to Google, which acts under its own privacy policy. Our hosting provider may keep technical access logs (IP address, time, page requested) for security.

9. Your rights

You have the right to: access your personal information; have it corrected; have it erased; restrict or object to our use of it (including direct marketing, at any time); receive it in a portable format; and withdraw consent where we rely on consent. To use any of these rights, email contact@arithmia.org. We reply within one month.

10. Security

We protect personal information with access controls, multi-factor authentication, encryption in transit and at rest, and the policies of our information security management system, which is designed to ISO/IEC 27001.

11. Complaints

Please contact us first so we can try to help. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, telephone 0303 123 1113.

12. Changes to this notice

We review this notice at least once a year. The date at the top shows when it last changed.