Data processing terms
How we process personal data on your behalf.
When you use Arqam360 on your website, you are the controller of your visitors’ data and Arqam360 is your processor. These terms are part of every Arqam360 subscription. You can attach this page to a regulator filing that asks for your processor contract.
1. What we process
- Subject: showing your consent banner and recording your visitors’ choices as proof of consent, scanning your website for cookies and trackers, and, if you turn them on, forwarding consented events to the tools you connect.
- Data: consent choices with their date, the page and an anonymous identifier; technical data such as the IP address, browser and approximate location; and any event data you choose to send.
- People: visitors to your website. Duration: as long as your subscription lasts.
2. Your instructions
- We process this data only to provide the service and on your documented instructions: your account settings and these terms.
- If we believe an instruction breaks the law, we tell you.
3. Confidentiality and security
- Everyone at Arqam360 who can access the data is bound to confidentiality.
- We apply the technical and organisational measures described on our Security page, including encryption in transit and access limited to those who need it.
4. Sub-processors
- You agree that we use the sub-processors listed below. We impose on each the same data-protection obligations as these terms.
- We tell you before adding or replacing a sub-processor, and you may object. If we cannot resolve the objection, you may end the subscription.
| Sub-processor | Purpose |
|---|---|
| Railway | Application servers and background jobs |
| MongoDB Atlas | Database hosting, including consent records |
| Vercel | Delivery of the banner script and the dashboard |
| Resend | Account and service emails to the customer |
5. Helping you
- We help you answer requests from your visitors to access, correct or object, with consent records you can search and export from the dashboard.
- We tell you without undue delay after we become aware of a personal-data breach affecting your data, with the information you need to meet your own obligations.
- We give you the information you need to show that these terms are met, and allow audits on reasonable notice.
6. Transfers
- Our providers operate infrastructure in several countries, so data may be processed outside your country. Where the law requires a safeguard or an authorisation for a transfer, we support the mechanism it provides. To ask where your data is hosted, write to admin@arqam360.com.
7. End of the service
- When your subscription ends, we delete or return the personal data on your instruction, unless the law requires us to keep it.
For a signed copy of these terms, or any question about them, write to admin@arqam360.com.
Last updated: 18 October 2026