Privacy and
cookies

1 Privacy Policy

ARKK supports clients with regulatory and statutory reporting, using products and services that are designed to simplify the reporting process and simplifying the regulatory filings process. The specialist solutions are underpinned by a dedicated UK-based customer support team, providing excellent customer service, which goes hand in hand with our commitment to privacy and security.

We take our responsibilities under data protection seriously, including upholding the data subject’s right to transparency. This privacy policy contains information about what data we collect and store about you, how we use it, the legal basis for using it and how long we keep it. It also tells you who we share this information with, what we do to protect your data and how to contact us.

2 Who Are We?

Arkk Consulting Limited (company number 06957576) known as ‘ARKK’ collect, use and are responsible for certain categories of your personal information. When we do this, we are the ‘controller’ of this information for the purposes of the UK General Data Protection Regulation (GDPR) and other applicable data protection laws, including the Data Protection Act 2018.

We also process data given to us by our clients under their instruction while providing services to them. When we do this, we are a data processor, which accounts for most of our processing activity.

3 Information collected By Us

We may collect personal data about you as follows: • Identity information such as your name and contact details (including your address, email and phone numbers). • Information about the business you work for and your role there. • Information about your regulatory status such as any registration details held by you or your business. • Information about partnerships and sole practitioner firm details including registration details, address, name and your position. • Personal information that may be included in communications with us. • Details of goods and services that we provide to or receive from you, or that we are arranging to provide or receive from you. • Payment information and financial information that relates to our relationship including bank details, bank account.

• Personal information given to us in relation to working at ARKK such as your CV, answers to any tests or assessments, education, training, employment history and information given in interview and meetings we may have with you.

You may also give us information that is classified as ‘special categories’ under UK GDPR, however, we do not routinely do this. We may process special category information in relation to employee health. If we are acting as Data Processor then the Data Controller will explain if we process special category information, however at present there is no provision to submit special category data to us. More information about ‘special categories’ can be found here.

4 Information Collected from Other Sources

We may also collect the same categories of information from third parties such as: • Your employer or authorised individuals in a business you work for or own. • Recruitment companies and public CV publishing companies and websites. • Information on public record, including professional networking sites. • Suppliers of goods or services. • Accountants and other professional advisers. • Our clients.

Even if we have not had direct contact with you and are processing data given to us by a third party for a purpose and with a legal basis outlined below, the contents of this privacy policy will still be in effect. We look after all personal data in the same way, regardless of where it has come from and whether we are acting as a data controller or a data processor.

5 Cookies/Tracking Technologies

By visiting www.arkksolutions.com (our website), you agree to our website’s ‘Terms and Conditions.’

You can set up your web browser to refuse cookies, but this means you will not be able to use all our website features.

5.1 Information About Our Use of Cookies

Our website uses cookies to distinguish you from other users of our website however, it does not identify you personally. This helps us to provide you with a positive experience when you browse our website and allows us to improve our site. By continuing to browse the site, you are agreeing to our use of cookies.

A cookie is a small file that we store on your browser or the hard drive of your computer if you agree. They are typically encrypted and are used to help navigate a website more efficiently and

perform certain functions. For more information about Cookies please visit www.allaboutcookies.org.

5.2 Cookies We Use

Here are the types of cookies we use on our website and what they do:

5.2.1 Strictly Necessary Cookies

These are cookies that are required for the operation of our website.

5.2.2 Analytical Cookies

Analytical cookies allow us to monitor user behaviour on our website. This enables us to analyse user activity and improve the structure of and content on the website.

5.2.3 Marketing Cookies

Marketing cookies allow us to interact with you once you have left our website – by showing you adverts for example.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

5.2.4 Google Analytics

We use Google Analytics software to collect information about how you use arkksolutions.com and how the website performs during your visit. This includes IP addresses. The data is anonymised before being used for analytics and web performance processing.

Google Analytics processes anonymised information about:

· The pages you visit on arkksolutions.com.

· How long you spend on each arkksolutions.com page.

· How you got to the site.

· What you click on while you are visiting the site.

· General country/region you access arkksolutions.com from.

· Type of device or browser you used to visit the site.

We do not store your personal information through Google Analytics (for example your name or address).

We will not identify you through analytics information, and we will not combine analytics information with other data sets in a way that would identify who you are.

6 How We Use Your Personal Information

We use your personal information for the following purposes: • To arrange the provision of services. • To comply with our legal responsibilities to regulatory bodies. • To promote and market the services of ARKK. • To manage matters relating to our payroll and employment, including our legal responsibilities as

an employer and our obligations to HMRC. • To engage with individuals who want to work at ARKK. • To engage with partners that supply us with goods and services. • To manage any queries or complaints you have about the services you receive. • To train and develop our staff at ARKK. • To monitor the quality of service we deliver to you, and ensure it meets your expectations. • To comply with legal obligations to act in the public interest and uphold the rule of law.

7 Legal Reasons We Collect and Use Your Personal Information

We have a legal basis for all the data we process. We rely on a different legal basis depending on the data we are processing and the reason we are processing it. We rely on the following legal basis in these circumstances.

8 Consent

In some cases, you will give us consent to use your information in a certain way. If you have given us consent to use your data, and we have no other legal basis for doing so, we will rely on your consent. The activities where we rely on your consent are: • Processing job applications. You can withdraw consent at any time, however, please be aware we will be unable to process your application if you do so. • You always have the right to withdraw your consent at any time. If you wish to withdraw your consent, please contact us using any of the details below in the ‘Get in touch’ section.

9 Legal Obligations

We will rely on our legal obligations to process information for the following purposes:

· Complying with our responsibilities to regulators and under applicable legislation.

· Complying with our legal obligations as an employer.

· Complying with obligations to HMRC regarding records keeping of our financial activity, including information relating to transactions, billing, and payments.

· Complying with obligations to HMRC regarding their requirements relating to fraud prevention.

· Defending a legal claim or upholding the rule of law.

10 Performance Of a Legal Contract

We will process information that relates to the services we are providing you with, or receiving from you, that are bound by our engagement with you (legal contract). The areas where we are processing data to enter into, or fulfil a legal contract are: • Delivering services to you under contract and keeping you updated with changes or information relating to those services. • When we are processing information from you to arrange a contract between us, such as when you give us your details to enter into an agreement for services with us. • Performance of any legal contract as a supplier or customer.

11 Legitimate Interest

We may rely on a legitimate interest to process information. When we do this, we will have assessed our legitimate interest to consider the rights and freedoms of the data subject.

We rely on legitimate interest to process personal information for the purposes to train our staff so that they can provide an exceptional service to all our clients. There may be scenarios relating to their engagement with you which we review with our staff as part of training and development.

We rely on legitimate interests in some cases. For example, to invite you to certain events such as webinars and seminars. Our legitimate interest is to provide information to our clients and contacts that will support their use of our services, and that could be of benefit to them. We also rely on legitimate interest to send you marketing information, including offers and information about our services, if we believe they will be beneficial to you.

12 Who Will We Share Your Personal Information With?

We take client confidentiality very seriously and will not share any information entered into any of our software or platforms unless required to do so by law. Other information we process we may share with: • Professional advisers, advisers and consultants that help us to manage ARKK and achieve our objectives as a business. • Training agencies that help us to develop our staff and services. • Our accountants and solicitors that are engaged by us to provide services required by law, such as filing financial information with HMRC. • We may use data processors, such as software providers, in the course of running the business

including CRM providers, email communication platforms, social media platforms and help desk management systems. • We will use third-party hosting providers to provision and host our software and platforms. • Storage and archiving providers to ensure your information is protected securely and backed up. • Any partners, suppliers or third parties we share data with will be bound by strict agreements that meet the requirements of UK GDPR and will be monitored for performance with those agreements.

We do use some third-party sub-processors to the extent necessary to process some or all of your personal information. You can view the list of sub-processors we use and the applicable products/operations they relate to here - https://www.arkksolutions.com/privacy-cookies-policy/subprocessors

We will share personal information with official bodies if required by law including the ICO, the police, law enforcement and intelligence agencies.

13 Transfer of Your Information Outside the European Economic Area (EEA)

For some business activities it is necessary for us to transfer your personal information outside the EEA or to an international organisation. In the following cases we share only identity information, contact information (e.g. name and email address) and usage information. At no point do we share any corporate confidential data you upload or process on our platform, without your express permission. The providers we use access the data as processors and all are bound by and adhere to UK GDPR requirements, such as Binding Corporate Rules or UK Standard Contractual Clauses:

1. Email distribution and tracking facilities (for marketing and product updates (including to users of the platform)).

2. Billing and invoicing (for calculating your bill and raising an invoice).

3. Contract e-signing (for binding commercial contracts).

Other than the cases above, we do not routinely transfer data outside of the EEA, and if we do we will notify you of the reasons, the legal basis for doing so, any relevant risk assessments that we want to make you aware of, and the safeguards in place to protect your rights and freedoms.

Clients can access our systems outside of the EEA by logging in to our portal. In these cases, and when we are acting as a data processor, the means, and purposes of processing (including transfer outside of the EEA) is decided entirely by our client.

14 How Long Will We Store Your Personal Data?

We will only keep your information for as long as necessary to complete the purposes we have described above. We use the following retention periods and review these periodically to make sure we are only keeping what we need (If information can be kept for two different periods, we will keep it for the longer of those two periods): • Client Information – We will keep information about you as our client for a period of 3 years after our contract with you ends unless we have another legal basis to process that information. • System Information – Any information you enter into our platforms will be kept for a maximum of 12 months after you stop making use of our services. Depending on the service, the retention periods may be shorter than 12 months as stated within the contractual agreement. • Financial Transactions – Information about you and any financial transactions, including fees paid and payments for services, we will keep for a period of 7 years to comply with HMRC requirements to keep accurate records that can be audited. • Contact Information - Information used in marketing with your consent or to pursue a legitimate interest will be kept for 30 days once you have withdrawn your consent. Otherwise, it will be retained for as long as is necessary to process personal information for the intended purposes.

15 Your Rights

Under the UK GDPR, you have a number of important rights that you can exercise free of charge. In summary, these rights are: • Transparency over how we use your personal data and fair processing of your information (which includes the right to be given the information in this policy). • Access to your personal information and other supplementary information. • Require us to correct any mistakes or complete missing information we hold on you. • Require us to erase your personal information in certain circumstances. • Receive a copy of the personal information you have provided us or have this information be sent to a third party, this will be provided to you or the third party in a structured, commonly used and machine readable format. • Object at any time to processing of your personal information for direct marketing. • Object in certain other situations to the continued processing of your personal information.

• Restrict our processing of your personal information in certain circumstances. • Request not to be subject to automated decision making which produce legal effects that concern you or affect you in a significantly similar way;

If you want more information about your rights under the UK GDPR, please see the Guidance from the Information Commissioners Office on Individual's rights under the UK GDPR.

If you want to exercise any of these rights, please contact us (see ‘get in touch’ on Contact page) and let us know who you are and what right you want to exercise. We may need to ask for additional information regarding your identity, and we may also need some information from you on specific categories of data, types of processing activities or periods of processing activities that you wish to focus your request around.

We will respond to you no later than one month from when we receive your request.

16 How To Make a Complaint

If something does go wrong or you are in anyway unhappy with how we have treated your data then please do not hesitate to contact our Data Compliance Officer, John Aligbe (see below ‘get in touch’).

The General Data Protection Regulation also gives you the right to lodge a complaint with a supervisory authority. The UK supervisory authority is the Information Commissioner’s Office who can be contacted at https://ico.org.uk/concerns/.

17 Our Security

ARKK, as a software company, put information security and confidentiality at the core of our business. We have implemented a number of measures to protect your information including: • Training all of our staff on Data Protection and information security. • Third party security reviews including penetration testing. • Maintenance of the ISO27001:2013 security standard. • Policies and procedures that cover information security and data protection legislation. • Security functions in systems such as IP locks, administration controls and logging. • Risk management processes that identify and mitigate risks and threats to your information. • Encrypted backups taken periodically to make sure data is always available. • Encryption on devices that hold data and USB ports disabled.

For more information regarding the security of your information, review our security statement.

18 Call Recording

There may be occasions when video calls are recorded such as during video presentation. Participants are informed of the recording taking place (either via audio and video notifications when they join video conference meetings) and have the option to object to the recording or leave the meeting.

We use the recorded calls to train our sales representatives and other relevant staff. The calls help us deliver quality services to our customers. In other instances, the recorded video call may also be provided to the participants in the call to review the presentation in the future, especially if there was useful information in the use and operation of ARKK’s products.

The call recordings may be shared with the following recipients:

· ARKK company staff.

· Third parties who help us deliver our services to you.

· Other third parties required by law.

We retain the calls for one year. This retention period will not apply to personal data involved in legal proceedings.

19 Future Processing

We do not intend to process your personal information for any reason other than stated within this privacy policy. If this changes, we will update this privacy policy on our website and in any documentation, we will send to you.

20 Changes To This Privacy Policy

This privacy was published in May 2024, and will be reviewed annually. We regularly review our internal security and privacy practices and may change this policy from time to time. When we do, we will inform you by updating our website and informing you in any documentation or messages we send you.

21 Get In Touch

If you have any questions about this privacy policy or the information we hold about you, please contact us and let us know it is in relation to your data. We will make sure you speak to the right person, By Post: 24 Southwark Bridge Road London SE1 9HF, United Kingdom. By Email: support@arkksolutions.com. By Phone: 020 3750 3030.

22 Compliance

Compliance Measurement

ARKK’s Data Compliance Officer (DCO) will verify compliance through various methods, including but not limited to, business tool reports, internal and external audits, and feedback to the document owner.

Exceptions

Any exception to this must be approved by ARKK’s Data Compliance Officer in advance.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

23 Document Owner & Approval

The Board of Directors is the Owner of this document and is responsible for ensuring that this document is reviewed in line with the review requirements.

A current version of this document is available to all members of staff on ARKK’s SharePoint site.

This document was approved by the DCO/Board of Directors as recorded in the Version History.