Privacy
Privacy Policy
Last updated: 26 June 2026
Who are we and what is the purpose of this privacy policy?
Arasai is a Northern Ireland-based business with its office at 23 Coyle Court, Antrim, County Antrim, BT1 1DH.
We are registered with the Information Commissioner’s Office (ICO) under registration number ZC186460. We are not required to appoint a Data Protection Officer; any questions about this policy or our handling of your personal data can be sent to aaron@arasai.co.uk.
Our data processing is done in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This privacy policy will explain how we use the personal information we collect from you when you use our website or our platforms. It also sets out your legal rights.
Topics
- The type of personal information we collect
- How we get your personal information and why we collect it
- How we use your information
- How we store your personal information
- Your data protection rights
- Cookies
- Privacy policies of other websites
- Changes to our privacy policy
- How to complain
The type of personal information we collect
The personal information we collect includes:
- Personal details (e.g. your name and title).
- Contact details (e.g. phone number, email address, postal address or mobile number).
- Profile information, if you set up an account with us, such as passwords and login details.
- Any other information that you provide about yourself or others when you use our platforms.
- Any feedback or background information you provide in connection with the services we offer.
We do not routinely collect special category data. If such data is provided voluntarily, we will only process it where permitted by Article 9 UK GDPR, such as with your explicit consent or where required by law.
Our services are intended for adults. Where a service is provided to a person under 18, the account must be held, and information provided, by a parent or guardian. We do not knowingly market to children.
How we get your personal information and why we collect it
Most of the personal information we process is provided to us directly by you through our website or platforms. For example, when you:
- Contact us, register for an account, or place an order for any of our products or services.
- Voluntarily complete a customer survey or provide feedback.
- When you visit our website, we automatically collect your IP address, browser type, device information, pages visited, and log/diagnostic data.
Where you need to provide certain key information, this will be marked as “mandatory” and if you do not provide this it may mean that you are unable to use our services.
We also receive personal information indirectly from other sources, which may include payment providers, service providers, business partners or publicly available information.
How we use your information
We use the information that you have given us to:
- Provide you with access to our services, such as our platforms.
- Deal with enquiries, requests and complaints received from you.
- Provide you with ongoing customer assistance and technical support.
- Where you are an existing customer, we may send you marketing about similar products and services unless you opt out - you can do so at any time. For all other marketing we rely on your consent. Marketing communications are sent in accordance with applicable electronic marketing laws, including the Privacy and Electronic Communications Regulations 2003 (PECR).
- Keep you informed and obtain your views of our activities.
- Support our business purposes, including data analysis, and improve our services.
- Comply with legal obligations to which we are subject and cooperate with regulators and law enforcement bodies.
We may share this information with trusted service providers such as hosting, infrastructure, and database providers (Vercel Inc. and Supabase Inc.), payment processors (Stripe Inc.), and regulators or law enforcement where required by law. Where third parties process personal data on our behalf, they act as processors under Article 28 UK GDPR and may only process your personal data in accordance with our instructions and applicable law. Where our US processors are certified under the UK Extension to the EU-US Data Privacy Framework (the ‘UK-US Data Bridge’), we rely on that; otherwise, we use the IDTA or the UK Addendum to the EU SCCs.
The lawful bases we rely on for processing this information are:
- Your consent, for example to send you newsletters and other communications. You can remove your consent at any time by:
- Clicking the ‘unsubscribe’ link in any marketing email
- Emailing aaron@arasai.co.uk with ‘Unsubscribe’ in the subject line
- Managing your preferences in your account settings
- We have a contractual obligation to provide services to you.
- We have a legal obligation.
- We have a legitimate interest, such as improving our services, maintaining security, preventing fraud, responding to customer enquiries and managing our business operations. We have balanced this against your privacy rights by anonymising data where possible and limiting access to authorised personnel only.
The main purposes for which we process personal data, and the lawful bases we rely on, are:
| Purpose | Lawful basis |
|---|---|
| Provide and manage accounts and platforms | Contract - Article 6(1)(b) |
| Payments and financial records | Legal obligation - Article 6(1)(c) |
| Customer support and service communications | Contract - Article 6(1)(b) / Legitimate interests - Article 6(1)(f) |
| Security, analytics and service improvement | Legitimate interests - Article 6(1)(f) |
| Fraud prevention | Legitimate interests - Article 6(1)(f) |
| Marketing emails and newsletters | Consent - Article 6(1)(a) |
How we store your personal information
Your information is securely stored in the United Kingdom and the United States.
For international data transfers:
- UK to EU/EEA: we rely on the UK adequacy regulations.
- Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including where applicable UK adequacy regulations, approved contractual safeguards such as the IDTA or UK Addendum to EU Standard Contractual Clauses, or other lawful transfer mechanisms.
We implement appropriate technical and organisational security measures to protect your personal data, including encryption, access controls, regular security assessments, and staff training.
We will only retain your data for as long as necessary to achieve the purposes listed above. Your data in respect of financial transactions will be retained for at least 7 years to comply with regulatory requirements. Account data is retained while your account is active and for 12 months after closure to facilitate reactivation, unless you request earlier deletion by exercising your right to erasure. Support enquiries and analytics data shall be kept for 24 months. Once these periods have expired, we will delete your data, unless legally required to retain it. We regularly review the personal information we hold and delete or anonymise it when we no longer need it. We do not engage in automated decision-making/profiling.
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you without undue delay as required by law.
Your data protection rights
Under data protection law, you have rights including:
- Your right of access – You have the right to ask us for copies of your personal information.
- Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
- Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
- Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances - this right applies where our processing is based on your consent or on a contract with you and is carried out by automated means.
- Your right to withdraw consent - Where we rely on your consent, you have the right to withdraw it at any time. This does not affect the lawfulness of any processing carried out before you withdrew it.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. This may be extended by up to two months for complex or numerous requests.
If you would like to exercise any of these rights, please contact us at: aaron@arasai.co.uk or write to us at: Arasai, 23 Coyle Court, Antrim, County Antrim, BT1 1DH.
Cookies
Cookies are text files placed on your computer. We use cookies in a range of ways to improve your experience on our website and platforms, including:
- Keeping you signed in
- Recognising your previously selected preferences such as your language or location
- Understanding how you use our website
Essential cookies are required for the website and platforms to function, including authentication/session cookies and security cookies. These cannot be disabled and are set automatically without consent, as permitted under The Privacy and Electronic Communications Regulations 2003.
Analytics cookies help us understand how visitors use our site so that we can improve performance. We set analytics cookies only where you have given consent through our cookie banner, and you can withdraw that consent at any time via our cookie settings.
Certain cookies may be exempt from consent where they fall within a legal exemption under PECR, including cookies that are strictly necessary to provide a service requested by the user or other recognised exemptions. Where we rely on such an exemption, we will still tell you about the cookie and, where appropriate, give you a means to opt out.
We maintain a full list of the cookies we use - including each cookie’s name, purpose, provider and duration - which is available via our cookie settings.
When you first visit our website, we display a cookie banner requesting your consent for non-essential cookies. You can choose to:
- Accept all cookies
- Reject non-essential cookies
You can review and change your cookie preferences at any time by clicking the cookie settings link in our website footer.
You can set your browser not to accept cookies, however, some of our website features may not function as a result.
For further information, visit allaboutcookies.org
Privacy policies of other websites
Our website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.
Changes to our privacy policy
We keep our privacy policy under regular review and place any updates on this web page. This privacy policy was last updated on 26 June 2026.
How to complain
You have the right to complain directly to us about how we have handled your personal data, and we will make it easy for you to do so. You can contact us at aaron@arasai.co.uk or write to us at: Arasai, 23 Coyle Court, Antrim, County Antrim, BT1 1DH, by whatever method you find easiest. We will acknowledge your complaint, investigate it, and respond - normally within 30 days. If you are not satisfied with our response, or we have not responded within that period, you can escalate your complaint to the relevant supervisory authority:
Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113 - Website: https://ico.org.uk