ARX Privacy Policy

Information about how UAB “Prodest” processes personal data related to the ARX website and services.

Last updated: 1 October 2026

1. Who is the Data Controller

This Privacy Notice is provided by UAB “Prodest”, legal entity code 304063823, registered office at Guobų g. 19, Puskelnių k., LT-68104 Marijampolė Municipality, Lithuania (Prodest or we).

When we process data relating to visitors to the ARX website, prospective customers, customer contact persons, newsletter recipients or ARX account users for our own purposes, we generally act as the data controller.

When a customer uses ARX to process AML / financial crime prevention data relating to its customers, end users or other individuals, the customer generally acts as the data controller and Prodest as the data processor acting on the customer’s documented instructions and under a data processing agreement.

2. Personal Data We May Process

·       Contact details: name, surname, employer, position, email address, telephone number and other information you provide through a contact form or when corresponding with us.

·       Account and authentication data: user identifier, organisation, role, access rights, login times, authentication information and security-event data.

·       Usage and activity logs: actions performed on the platform, configuration changes, alert and case status changes, assignments, comments, approvals and other records required for the audit trail.

·       Technical data: IP address, browser and device information, session data, error logs and security logs.

·       Commercial and administrative data: contract, order, licence, invoice and payment information to the extent it relates to individuals.

·       Marketing preferences: newsletter subscription status, consent records and opt-out information.

·       Support and communications data: history of enquiries, incidents, correspondence and technical support.

3. AML Data Submitted to ARX by Customers

Under a customer’s instructions, ARX may process identification and KYC data relating to customers or third parties, transaction history, account or payment information, sanctions, PEP or watchlist screening results, risk indicators, alerts, investigation materials, notes, documents and other data that the customer chooses to submit to the system.

The composition of this data, the lawful basis for processing, retention periods and information provided to data subjects are primarily determined by the customer acting as data controller. If an individual wishes to exercise rights concerning data submitted to ARX by a specific Prodest customer, the request should generally be addressed to that customer. We will assist the customer in meeting its obligations to the extent required by the GDPR and our agreement.

4. Why We Process Data and Our Legal Basis

Purpose

Examples of Data

Legal Basis

Responding to enquiries and arranging demonstrations

Contact and communications data

Legitimate interest in responding to business enquiries; where applicable, steps prior to entering into a contract

Providing and administering ARX accounts

Account, role, authentication and usage data

Performance of a contract and legitimate interest in providing the Services securely

Ensuring security, auditability and incident investigation

Logins, IP addresses, activity and audit logs

Legitimate interest in protecting the system and customers and ensuring traceability

Billing and accounting

Contract, invoice and contact-person data

Performance of a contract and compliance with legal obligations

Newsletter and direct marketing

Email address and subscription preferences

Consent or another applicable legal basis under electronic communications and marketing rules

Service improvement and technical analysis

Technical and usage data

Legitimate interest in improving and maintaining the Services; non-essential cookies only where the required consent has been obtained

5. Automated Analysis and AI

ARX may analyse transaction behaviour and other data provided by customers to identify anomalies, emerging risk patterns and generate alerts for investigation. These features are intended to support analysts and investigators rather than independently make a final legal or regulatory decision.

Where such analysis is carried out on data provided by a customer, Prodest generally acts as a data processor, while the customer determines the purposes and means of processing, human-review processes and, where applicable, obligations to provide information about automated decision-making.

6. Who We May Share Data With

We may disclose personal data, only to the extent necessary, to the following categories of recipients:

·       cloud, hosting, backup and infrastructure service providers;

·       authentication, email, communications, customer-support and system-monitoring service providers;

·       payment, accounting and professional advisers where necessary;

·       competent public authorities or law enforcement agencies where disclosure is required by law;

·       other subprocessors used by us to provide ARX on behalf of customers, in accordance with the data processing terms agreed with the customer.

7. Transfers of Data Outside the EEA

Data is not transferred outside the European Economic Area (EEA).

8. How Long We Retain Data

We retain personal data no longer than is necessary for the purposes for which it was collected, or for as long as required by law, contracts, dispute management or security needs.

·       Contact-enquiry data – generally for up to 2 years after the last meaningful contact, unless the relationship becomes contractual.

·       Newsletter data – until consent is withdrawn / the recipient unsubscribes, while retaining a minimal suppression record for as long as necessary to honour the opt-out.

·       Customer contract and accounting data – for the duration of the contract and thereafter for as long as required by accounting, tax, limitation-period or other mandatory rules.

·       Account, security and audit logs – in accordance with the ARX retention policy and the customer’s agreed configuration, taking into account security, traceability and compliance needs.

·       AML data processed on behalf of the customer – in accordance with the customer’s documented instructions, the agreement and the DPA; upon termination of the Services, data is returned or deleted in accordance with the agreed procedure, unless retention is required by law.

9. Cookies and Similar Technologies

The Website may use strictly necessary cookies required for its operation, security, language selection or session management. Analytics, marketing or other non-essential cookies should be used only after obtaining the required user consent and providing an easy way to withdraw it.

Detailed information about the names, providers, purposes and lifetimes of the cookies used should be provided in a separate cookie table or consent-management interface.

10. Your Rights

Where Prodest is the controller of your personal data, depending on the circumstances and applicable law, you may have the right to:

·       receive information about the processing of your data and access the personal data being processed;

·       request correction of inaccurate data or completion of incomplete data;

·       request deletion of data or restriction of processing where the legal conditions are met;

·       object to processing based on legitimate interests;

·       receive the data you have provided in a structured, commonly used and machine-readable format where the right to data portability applies;

·       withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal;

·       lodge a complaint with the State Data Protection Inspectorate (VDAI).

When you ask to exercise your rights, we may request information necessary to verify your identity. Certain rights are subject to exceptions and limitations under the GDPR.

11. Data Security

We use technical and organisational safeguards designed to manage risks relating to access, confidentiality, integrity, availability and traceability. Measures may include access-rights management, authentication, protection of data in transit, activity logging, backups, system monitoring and incident-management procedures.

No information system can be considered completely protected against every risk, so our safeguards are periodically reviewed in light of technology, threats and the nature of the processing.

12. Children’s Data

ARX and its website are not intended for children. We do not knowingly collect children’s personal data for the purpose of providing a direct-to-consumer service. If a customer lawfully processes such data in the context of its AML or legal obligations and submits it to ARX, Prodest processes it only in accordance with the customer’s instructions and the DPA.

13. Changes to this Notice

We may update this Privacy Notice periodically to reflect changes to the Services, technology or legal requirements. The latest version will be published on the Website together with the date of the most recent update.

14. Privacy Contact Details

UAB “Prodest”

Supervisory authority in Lithuania: State Data Protection Inspectorate (VDAI). Current VDAI contact details and complaint submission methods should be provided or linked from the official VDAI website.