At Arcus Partners, we are committed to safeguarding the privacy and personal data of our clients, prospects, business partners, stakeholders we engage with in our work, website visitors, event participants, and job applicants.

This Privacy Policy explains how we collect, use, share, and protect personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Belgian data protection law.

In Belgium, the GDPR is supplemented by the Law of 30 July 2018 on the protection of natural persons with regard to the processing of personal data. Compliance is overseen by the Belgian Data Protection Authority (APD/GBA).

1. Who We Are

Arcus Partners is an independent corporate and public affairs advisory firm. We are based in Brussels and work with clients in Europe and internationally.

Data Controller

Arcus Partners SA, Avenue des Arts 44, 1040 Brussels, Belgium
Enterprise number: 1044.083.452, RLE Brussels
Website: www.arcuspartners.global

For any questions regarding this Privacy Policy or the processing of your personal data, please contact us at:

contact@arcuspartners.eu

We have not appointed a Data Protection Officer, as we are not required to by law. The address above is our point of contact for all data protection matters.

2. Scope of This Policy

This Privacy Policy applies to personal data collected through:

  • Our website
  • Business development activities
  • Professional networking activities
  • Client engagements
  • Stakeholder research, engagement and media monitoring carried out for our clients
  • Events and webinars
  • Recruitment activities
  • Supplier and associate relationships
  • Marketing communications
  • Correspondence by email, telephone, social media, or other channels

3. Personal Data We Collect

Depending on our relationship with you, we may collect the following categories of personal data.

Professional Contact Information

  • Name
  • Title
  • Employer
  • Business email address
  • Business telephone number
  • Professional biography
  • LinkedIn profile information you choose to make public

Client and Project Information

  • Information shared during projects
  • Meeting notes
  • Workshop participation details
  • Stakeholder feedback
  • Project correspondence
  • Contract and invoicing information

Website Information

  • IP address
  • Browser type
  • Device information
  • Our website does not use cookies, analytics or tracking tools, and has no contact or sign-up forms. Our hosting provider records limited technical data, such as IP address and browser type, in server logs in order to deliver and secure the site.

Event Information

  • Registration details
  • Organisation
  • Dietary requirements and accessibility needs (only with your explicit consent)
  • Attendance records
  • Professional interests
  • Photographs or recordings, where we tell you in advance

Stakeholder and Media Information

Much of our work involves understanding public debate on the issues that matter to our clients. To do this, we may process information about people in public or professional roles, such as elected representatives, officials of EU institutions and national governments, journalists, academics, and representatives of companies, NGOs and trade associations. This may include:

  • Name, role, organisation and professional contact details
  • Public statements, publications, votes and positions on policy issues
  • Media coverage and social media posts made in a professional capacity
  • Notes of meetings and other interactions with us

We collect this information from publicly available sources, such as institutional websites, official registers including the EU Transparency Register, parliamentary records, news media and professional social media, as well as from our own interactions with you. Where this information reveals political opinions, we process only what you have made public yourself, and only as it relates to your public or professional role.

If we hold information about you in this way, you can ask us what we hold and where it came from, and you can object at any time using the contact details in section 1.

Recruitment Information

  • CV, cover letter and application details
  • Education and employment history
  • Interview notes and assessments
  • References, where you have agreed to us contacting them

Supplier and Associate Information

  • Contact details of supplier and associate staff
  • Contract, payment and invoicing details

4. How We Use Your Personal Data

We process personal data only for legitimate business purposes, including:

  • Delivering consulting and advisory services
  • Mapping stakeholders and monitoring public debate for our clients
  • Managing client relationships
  • Preparing proposals and contracts
  • Organising events and webinars
  • Managing professional networks
  • Responding to enquiries
  • Recruiting employees and associates
  • Managing supplier relationships
  • Producing thought leadership and industry insights
  • Complying with legal and regulatory obligations

5. Legal Bases for Processing

Under the GDPR, Arcus Partners processes personal data based on one or more of the following legal grounds:

Performance of a Contract

Where processing is necessary to provide services to clients or suppliers.

Legitimate Interests

Including:

  • Business development
  • Client relationship management
  • Professional networking
  • Stakeholder research and engagement for our clients
  • Service improvement
  • Security and fraud prevention
  • Internal administration

We always balance our legitimate interests against individuals' rights and freedoms. You can ask us for more information about how we have done this.

Legal Obligations

Where processing is required for:

  • Financial reporting
  • Tax compliance
  • Professional obligations
  • Legal proceedings

Consent

Where required by law, including email marketing to people who are not existing clients, dietary or accessibility information, and event photography. You can withdraw your consent at any time. This does not affect processing carried out before you withdrew it.

Our Role in Client Work

In most client work, Arcus Partners decides how and why personal data is used and acts as a controller. Where we process personal data only on a client's instructions and on its behalf, we act as a processor, and the client's own privacy notice applies to that data.

6. Marketing Communications

Arcus Partners may send:

  • Industry insights
  • Newsletters
  • White papers
  • Event invitations
  • Research publications
  • Company updates

You may unsubscribe at any time by:

We send email marketing only to people who have agreed to receive it, or to existing clients about similar services. You can object to direct marketing at any time, and we will stop.

7. Use of AI Tools

We may use AI tools, including Claude by Anthropic, to support research, drafting and analysis. We use them only with information that is not confidential, and on client work only where the client has agreed. AI tools do not make decisions about individuals.

We use business versions of these tools under terms that do not allow the provider to train its models on our data.

8. Sharing Personal Data

We do not sell personal data.

Where necessary, we may share information with:

  • Cloud and website hosting providers, including Microsoft and Netlify
  • IT and business software providers, including Odoo for client management, invoicing and accounting
  • AI tool providers, as described in section 7
  • Legal advisers
  • Financial advisers
  • Accountants and auditors
  • Professional subcontractors and associates
  • Event management providers
  • Our clients, where sharing stakeholder information is part of the agreed work
  • Regulatory authorities
  • Public authorities when legally required

Service providers that process personal data for us do so under a data processing agreement and must keep it confidential and secure.

9. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), Arcus Partners will ensure appropriate safeguards are in place, including:

  • European Commission Standard Contractual Clauses
  • Adequacy decisions
  • The EU-US Data Privacy Framework, for US providers certified under it
  • Other lawful transfer mechanisms recognised under the GDPR

Some of our service providers, including Microsoft, Netlify and Anthropic, are based in or may transfer data to the United States. You can ask us for a copy of the relevant safeguards.

10. Data Retention

We retain data only for as long as necessary.

Typical retention periods include:

Data TypeRetention Period
Client project recordsUp to 10 years after project completion
Stakeholder and media informationFor the length of the relevant client engagement, reviewed at least annually
Contractual, accounting and tax records10 years, as required by Belgian law
Marketing contactsUntil you unsubscribe or withdraw consent, reviewed at least every 3 years
Prospects and business development contactsUp to 3 years after last contact
Recruitment recordsUp to 6 months after the process ends, or up to 24 months with your consent
Event participation recordsUp to 3 years

Retention periods may be extended where required by law or ongoing legal proceedings.

11. Your Rights

Under the GDPR, you have the right to:

  • Access your personal data
  • Correct inaccurate information
  • Request erasure of personal data
  • Restrict processing
  • Object to processing
  • Withdraw consent
  • Request data portability
  • Not be subject to decisions based solely on automated processing
  • Lodge a complaint with a supervisory authority, in Belgium or in the EU country where you live or work

To exercise your rights, contact:

contact@arcuspartners.eu

12. Security Measures

Arcus Partners implements appropriate technical and organisational measures including:

  • Access controls
  • Multi-factor authentication
  • Encrypted systems where appropriate
  • Secure cloud storage
  • Confidentiality obligations for staff and associates
  • Periodic security reviews
  • A procedure for handling and reporting data breaches

While no system can guarantee absolute security, we continuously work to protect personal data against unauthorised access, misuse, loss, or disclosure.

13. Complaints

Individuals may lodge a complaint with the Belgian Data Protection Authority.

Belgian Data Protection Authority (APD/GBA)
Rue de la Presse 35, 1000 Brussels, Belgium
Website: https://www.dataprotectionauthority.be
Email: contact@apd-gba.be

You can also complain to the data protection authority in the EU country where you live or work. We would, however, appreciate the chance to address your concerns first.

14. Changes to This Privacy Policy

Arcus Partners may update this Privacy Policy periodically.

The latest version will always be available on our website together with the date of revision.