This notice explains how ARKATAL PTE. LTD. ("we", "us" or "our") handles personal data when you visit our website, contact us directly or take part in relevant platform activities, including company accounts, matching, commercial agency and Engagement administration. The information and purposes relevant to you depend on your interaction and choices; a public website visitor does not undergo all platform processing described here. This notice explains practices and rights. It does not form a Platform Agreement, grant new content rights, expand processing instructions or replace a required separate notice or permission.

1. Who we are

We are ARKATAL PTE. LTD. (UEN 202637231W), a Singapore company operating https://www.arkatal.com/ .

A Client is a company procuring services; a Fractional Company is the independent supplier business; a Fractional Expert is its named individual expert. An Individual Participant may register and prepare before having a company under the personal-account provisions of the Platform Terms. Personal acceptance does not bind a future company or create company fee obligations.

Our processing roles

We determine purposes for our own platform, billing, security and permitted development operations. Where we separately agree to process data solely on a User company’s documented instructions, the relevant completed processing record and Part III of the Platform Terms govern that activity. Receiving an upload does not automatically make us its processor for every purpose. A Client and Fractional Company may separately agree delivery processing between themselves; we are not automatically a party to that arrangement. The actual activity determines the role, and the required processing record must be completed before instructed access begins. Data held on instructions is not available for an independent purpose merely because we also operate the platform.

2. Information we may receive

If you contact us by email, we receive the information you choose to provide, which may include your name, contact details, company or role, the contents of your enquiry and any CV, biography or other professional information you send us. Our website hosting or security providers may also process limited technical information needed to operate and protect the site, such as IP address, browser or device information and standard server logs.

Platform information

Depending on the service used, we receive or generate company-representative and account details; profiles, CVs, capabilities and reference information; briefs, proposals, SOWs and relevant attachments; messages and support records; authority, mandate, approval, signature and permission records; matching, Introduction and access activity; invoice, collection, remittance and other transaction metadata; proportionate verification information; feedback and outcome data; security, assessment and dispute records; and recordings or transcripts only where the relevant notices and permissions have been provided. Relevant transaction and workflow records include accumulated company matching credits, amounts applied and remaining, linked search, contracted-company and SOW identifiers, genuine workflow-progress events and access deadlines, delivery/archive status, and separately attributed assessment contributions, actual reversals, supported replacement notices and reconciliation. These records do not themselves authorise a new fee, data use or disclosure.

We identify information needed for a requested feature or required verification at collection; without it, that feature or check may not be possible. Additional enquiry details and optional permissions remain voluntary. Please provide only relevant information. Ordinary project fields are not an approved channel for unnecessary identity documents, credentials, payment authentication details, privileged material, sensitive personal data or customer production datasets. Any specially justified restricted-data processing requires an approved channel and suitable record. Uploading information does not authorise every reuse.

Sources and workspace audiences

Information may come from you, the company you represent, authorised Personnel, counterparties, reference providers, selected connected systems and platform activity. Proportionate checks may also use public company registries, websites and professional or business information, or information lawfully obtained from relevant counterparties and appropriate third parties. We do not assume private-system access or unlimited rights in professional information. A connection is limited to the permissions enabled for the selected feature.

Individuals may submit experience, complete profiling and receive personalised generalised Opportunity Summaries before company activation. Their profiles do not enter client searches or full opportunity allocation at that stage. Company activation requires separate authorised acceptance; only relevant earlier personal-profile information lawfully authorised for that company enters its workspace, not all personal records. Company business records remain controlled through verified company authority and named permissions, subject to individual and third-party rights. An email-domain match alone does not prove authority.

3. How we use information

We may use proportionate existing usage and workflow records to administer reasonable matching controls for capacity, fair access, genuine matching and prevention of abusive or excessive use. Controls can limit, require approval for, pause or discontinue further matching under the accepted Platform Terms. For a jointly proposed independent assessment, necessary administration records include the common candidate list and material offers, company representatives’ objections and confirmed reviews, relevant independence information, mutual acceptability, the disclosed selection rule and outcome. These uses remain subject to necessity, confidentiality, access restrictions and the retention rules below; they do not expand instructed Client-data purposes or independent model-training permissions.

We use information to respond to enquiries, keep appropriate business records, operate and secure our website and systems, and meet legal or regulatory requirements. For platform activities, the purposes below apply as relevant to the service, data and permissions involved. A general reference to operating or improving services does not authorise unrelated training or reuse of instructed Client data. We notify you of a materially new purpose and obtain any fresh permission required before that use.

Operational services and checks

Relevant operational purposes include account administration and proportionate identity/company-authority checks; matching, ranking and introductions; communications and scheduling; AI inference and assistance with requirements, documents and SOW drafts; specifically authorised connected-system actions and agency execution; invoicing, collection and remittance; support, delivery administration, disputes and independent assessments; security, fraud prevention and necessary legal or evidential recordkeeping. A connection or platform feature does not authorise an agent to send, sign, spend, change a record or take another external action beyond its specific permission and mandate.

We may conduct proportionate routine, automated and suspicion-triggered checks for covered off-platform activity, under-reporting and associated fees using lawfully held access, workflow, Introduction and transaction records and the lawful public-business and counterparty sources described above. We may make proportionate enquiries or conduct a relevant-record audit under the Platform Terms’ separate safeguards. Checks do not authorise deception, unlawful access, unrestricted surveillance, unnecessary disclosure, public allegations or repurposing instructed Client datasets. Purpose, access, confidentiality, provenance, retention and transfer controls continue to apply. Suspicion or non-cooperation alone does not establish that a fee is owed; we must establish its contractual trigger.

Operational AI and Arkatal development

Operational AI assists requested profiling, matching and document services. Separately, eligible sources may be lawfully prepared into genuinely anonymised development material under clause 15 of the Platform Terms. Only material meeting that standard is used under this route for broad training, fine-tuning, evaluation and development of models including generative AI, datasets, agents, software and workflows. We may commercialise resulting technology through subscriptions, licences, white-labelled services and standalone products, hosted or customer-operated, across lawful industries, including recruiter tools and regional partners. Technology recipients obtain no default rights to underlying customer sources, and customer-derived corpora are not sold as independently exploitable data products even if anonymised.

The company or individual content licence covers only material the accepting party can authorise. It does not consent for other people or release another owner’s confidential or IP-protected information. Before accessing identifiable sources for anonymisation preparation we must establish and record the actual applicable personal-data basis, notices and provider scope. A contractual statement or a plan to anonymise is not that basis. Missing rights or a basis block the affected processing. We assess identification risk, reasonably available linking information and recipient context; removal of names, coded identifiers or a synthetic label does not establish anonymity. Identifiable originals are not broad-development inputs under this route, and there is no mandatory broad personal-data training consent. Necessary operational or preparation processing remains subject to its own valid basis and applicable rights.

Eligible and excluded development material

Eligible sources may include authorised profiles, CVs, experience and profiling answers, briefs and SOW particulars, reference facts, minimised feedback, platform activity and authorised platform meeting audio/video and transcripts. Ordinary confidential business discussion within the owner’s rights may be generalised for authorised development; confidentiality continues. Source access for preparation is limited and the broad development use begins only after the anonymity assessment succeeds. Unauthorised employer or client material, externally obtained recordings, unsolicited emails and attachments, confidential client deliverables, source code, substantive production datasets and unrelated company documents remain excluded except through the specific additional-rights route in clause 15. Anonymising material does not release Part III processing instructions or other source restrictions.

Payment tokens, full card/bank credentials, authentication secrets, identity-document images and government identification numbers are excluded from training datasets. Restricted health, biometric, children's, legally privileged and unauthorised or unrelated third-party data are excluded unless a separately approved lawful protocol covers them; unnecessary highly sensitive personal information must not be included. Speaking, screen-sharing, transcribing or transforming excluded material does not make it eligible. Ordinary company-confidential discussion is not excluded merely because commercially sensitive. Instructed data and its copies, extracts and derivatives remain outside the development licence unless the specific independent-purpose route in clause 40.3 is first completed; original instructed copies remain protected. Before development use we apply reasonable, proportionate screening and minimisation. We do not promise perfect detection or manual review of every transcript. Please avoid restricted material and notify us promptly if it is discovered. We investigate identified problems, restrict affected use and implement required exclusion, removal, correction or other action, including relevant datasets, models and distributed copies.

Recordings and independent model providers

Before platform recording or transcription, participants receive the operational purpose, preparation/anonymised-development explanation, recipient and retention information and rights route in clauses 50–51 of the Platform Terms. Required recording consent is separately obtained; late joiners receive the notice and missing required permission is addressed before capture continues. Recording consent is not blanket training consent. No routine extra company licence for each meeting or transcript is required within the upfront content licence, but the source-processing basis and anonymity gate still apply.

A provider’s independent training, fine-tuning or improvement of its own or generally supplied models is separate from both operational inference and development on Arkatal’s behalf. It requires the specifically named provider/model purpose, eligible categories, retention, locations, reuse terms, risks and rights/withdrawal routes to be disclosed and the separate affirmative choices required by clause 52 to be recorded. Company-owner rights and individual permissions are separate. Unspecified or unselected choices grant no permission, and a new independent provider or materially different use requires a new or validly renewed choice. Ordinary protected provider access is not permission for independent training.

Non-identifying analytics

We may use genuinely non-identifying, non-confidential telemetry, statistics and artefacts for security, capacity planning, product analytics, service measurement and industry-level benchmarking where rights and law allow. We must not attempt re-identification or use a population so small or distinctive that a person, company, Engagement or confidential information is reasonably revealed. Pseudonymous records, embeddings and trained models are not automatically anonymous. This analytics permission does not authorise otherwise restricted source-content training.

4. Sharing and overseas processing

We may make personal data available to providers supporting our business where reasonably necessary for their authorised services, and disclose information where required by law or to protect legal rights. We do not sell personal data or sell, rent or license customer records, CV collections, recordings, transcripts or training corpora as independently exploitable data products. Commercialising lawfully developed technology does not release underlying information from purpose, permission, confidentiality or security limits, and models and embeddings are not automatically anonymous.

Relevant recipients and partners

Relevant recipients may include intended counterparties, authorised workspace users, cloud, AI, communications, verification and payment providers, authorised on-behalf support/development partners, advisers, independent assessors and dispute or regulatory recipients. Necessary essential records retain their agreed treatment; unrelated profiles cannot be copied into external packs, directories or training corpora. Accepted platform matching information may be shared with relevant prospective counterparties under their confidentiality obligations. Separately, authorised Opportunity Summaries may reach unregistered prospects and public audiences through email, LinkedIn, websites, advertising and other media for searches, onboarding, outreach and ArkaTal marketing. Historical examples may continue after closure, subject to the Client’s marketing-stop right. We exercise reasonable care in generalising summaries and ordinarily omit names and direct identifiers; contextual recognition may remain possible. This summary permission is not proof of anonymity for development and does not itself authorise contacting a prospect.

Partners, resellers and group companies may use, distribute or operate lawfully supplied technology under the Platform Terms' commercialisation permission. A technology-only recipient is not automatically a source-data processor and receives no source-data access or independent exploitation rights. Any access to customer information requires its own authorised role and applicable controls. Appointed development providers act on our documented behalf, without permission to train independently on that information. Platform appointment does not automatically appoint a provider as a Fractional Company's delivery subprocessor. Group status or a transfer to a competent successor on a reorganisation or sale does not expand source-data rights; notice, equivalent protection, purpose limits and applicable data-law safeguards continue.

Our Provider Register identifies the relevant providers, legal entities, functions, roles, processing/support-access locations and independent-training treatment. Appointed providers receive only the access necessary for their documented role, subject to applicable confidentiality, security, transfer and onward-use controls. A named provider or broad category does not establish authority for a different use.

International processing and changes

Processing and authorised support access take place in the locations applicable to the relevant provider and activity, as disclosed in our provider register and its service-specific supplier location information. Hosting and support-access locations may differ. Some services have no configured regional restriction; an international description does not mean every record goes to every country or authorise unrestricted worldwide processing. Before transfers we assess and implement the safeguards required by applicable law, including the Singapore PDPA where it applies, and comply with any narrower instructed-processing record. A material new location requires an updated notice and the applicable assessments, safeguards and any required approval before transfer. Company agreement to a country does not replace those safeguards.

We normally provide 30 days’ advance notice of a material new location or addition/replacement of an on-behalf-of provider and a reasonable route for substantiated data-protection or security objections. Urgent protective changes require prompt notice and equivalent protection. We reasonably address an objection through safeguards, an alternative provider or suspension/termination of affected optional processing where necessary, and do not proceed contrary to legally required approval. A new purpose, unapproved country or independent provider training may require further notice or permission; updating the register alone is insufficient.

Where Part III instructed processing applies, its approved record controls purposes, subprocessors, locations and safeguards. General platform authorisation does not automatically appoint a platform partner as the Fractional Company’s delivery subprocessor, permit an unlisted delivery country or expand a Client instruction. Independent training remains subject to its separate requirements.

5. Retention and security

We take reasonable steps to protect personal data in our possession or control through appropriate access controls, confidentiality, incident response and provider oversight. We keep it only while reasonably needed for the relevant service, enquiry or documented legal/business purpose, subject to the category rules below and earlier necessity reviews. We then delete, effectively anonymise or otherwise dispose of it appropriately. Account closure does not require immediate destruction of necessary contracts, fee evidence or legal records. Retained archives are access-restricted and not reused for development unless independently eligible. Shorter obligations, documented lawful holds or specifically justified lawful exceptions may apply; the periods below are review points or limits, not mandatory minimum storage periods.

Retention by category

Profiles and directory records: retained while the relationship is active and the data remains relevant. After 24 months without substantive account activity we seek reconfirmation or delete or effectively anonymise unnecessary profile data.

Signed contracts, consents and material transaction or fee evidence: the standard framework is seven years after the later of account closure or the relevant Engagement’s final settlement, with earlier necessity reviews and documented legal holds.

User evidence duties: Users have separate contractual duties to retain proportionate registered-work, Introduction and off-platform evidence under clauses 11.5 and 37.1 of the Platform Terms, subject to their necessity, privacy and retention safeguards. Those duties do not mean we collect all their records; ArkaTal retains only information necessary for its applicable purpose under the category rules in this notice.

Raw Platform Recording audio/video: up to 12 months. Working Platform Transcripts and project communications: up to 24 months after the relevant discussions or Engagement end. Material evidence may follow the protected evidence framework above, restricted to its lawful evidence purpose rather than gaining a longer development-use period.

Eligible anonymised, minimised development datasets: up to five years from selection, with annual necessity and permission review. Copying a raw recording or verbatim working transcript into development storage does not restart or bypass its shorter source-category period. Anonymity does not itself grant indefinite retention or remove surviving content restrictions. Evidence retained longer for its lawful evidence purpose does not thereby become eligible for development.

Verification documents: deleted when the justified verification or legal-retention purpose ends, normally within 90 days after completing the check; a necessary minimal verification result may remain. Live security logs: up to 12 months unless an incident or legal requirement justifies longer.

Deleted information in routine backups: expires within 90 days and is not restored for ordinary use. Separately instructed processing follows its approved record and clause 47, including return/deletion and any expressly justified backup-cycle approval. Genuinely anonymous, non-confidential statistics and artefacts may remain longer only where rights and law permit, without attempted or reasonably enabled re-identification.

Matching-result access and incident notices

Identifying matching results are initially accessible for the Matching Result Access Period defined in clause 2.13 of the Platform Terms (Platform Terms), starting when they first become accessible. Evidenced genuine progress in the associated workflow, such as a genuinely booked meeting, starts a fresh period for that result set; passive viewing or automated refreshes do not. A valid signed SOW separately extends access only to its contracted Fractional Company’s relevant details, including its named expert’s details relevant to the Engagement. The extension ends on delivery of the linked work or completion of necessary bounded close-out after early termination. Other companies and unrelated profiles receive no signed-work extension. Clause 8.9 of the Platform Terms governs the detailed access rules, including multiple SOWs, signing after expiry and any independently valid ordinary period. We record and show the applicable deadline or signed-work status. When no period or extension permits ordinary access, identifying results are archived and no longer ordinarily retrievable; necessary signed and essential records remain separately available through controlled routes. Expiry does not extinguish unused matching credits or require destruction of necessary restricted evidence. Backend retention follows the category rules above and does not create a browsable or exportable profile directory. Security, lawful suspension and authorised-account controls continue to apply.

We assess incidents, take appropriate containment and response action, and meet applicable statutory notification duties. Under the Platform Terms, we notify an affected User company without undue delay and within 24 hours after awareness of a breach materially affecting that company’s confidential or personal information, with available details and updates. This is not an unconditional promise to notify every individual within 24 hours and does not replace or postpone a statutory deadline. Separately instructed processing is also subject to the relevant incident duties and record. No system can be guaranteed completely secure.

6. Your choices and requests

Subject to the PDPA, other applicable law and relevant exceptions, you may contact us to request access to personal data, correction of inaccurate information, withdrawal of consent where consent is the basis, and other applicable rights. We assess requests using proportionate independent identity-verification controls; identification numbers must not be used as account passwords. Relevant information held through providers and relevant model-derived personal data are included in our assessment; contractual terms do not waive mandatory rights. Withdrawal may affect our ability to continue a request or provide an affected service, and we explain relevant consequences.

Different permissions and withdrawal

A company or Individual Participant may withdraw the content licence for future source-data use through the DPO or account privacy route. This is distinct from withdrawing relied-on personal-data consent, other statutory requests, and a Client’s request to stop future marketing reuse of Opportunity Summaries. We distinguish these requests and explain their consequences. The marketing route requires reasonable-period removal from channels we control but does not promise recall of messages already sent or independent third-party copies.

We assess potentially identifying model-derived information and proportionate required measures, including relevant distributed copies. No blanket exemption applies to weights or embeddings and no perfect automatic unlearning is promised. Genuinely anonymous material need not be re-identified to locate an individual, but potentially identifying data cannot be labelled anonymous to avoid rights. Continued use of anonymous artefacts and lawfully developed technology remains subject to surviving content rights, confidentiality and applicable law; the identifiable originals retain their separate protections.

You can revoke a connector through its available controls, subject to reasonable implementation time; dependent features may then stop working. Declining recording and selecting or withdrawing optional development/provider choices remain separate actions. Acknowledging this notice, accepting public Website Terms or accepting a company Platform Agreement is not a blanket individual consent or selection of every optional permission.

7. Contact us and changes

For privacy questions, requests or complaints, please contact our Data Protection Officer at enquiries@arkatal.com or use available account privacy controls. For general enquiries, contact enquiries@arkatal.com. You may exercise applicable statutory rights or contact a competent regulator. We may update this notice from time to time and publish the current version with its update date. We retain the relevant historical notice and permission versions for evidence. Posting an updated notice does not itself authorise a new purpose, expanded data permission, independent model-provider training or amendment to an instructed-processing record. We provide required notice and obtain any required fresh permission before the affected processing; material provider/location changes also follow the controls described above.