Privacy Policy

ArmiHQ ("we", "us", "our"), operated by its owner, is committed to protecting your privacy and handling your personal data with transparency, integrity, and in full compliance with Regulation (EU) 2016/679 (the "GDPR"), the Malta Data Protection Act (Chapter 586, Laws of Malta), and all other applicable data protection legislation.

This Privacy Policy explains who we are, what personal data we collect about you, why we collect it, how we use it, with whom we share it, how long we retain it, and what rights you have.

We only process your personal data where we have a valid legal basis under Article 6 GDPR:

• ▸Contract performance (Article 6(1)(b)): Processing necessary to provide the Service you have subscribed to;
• ▸Legal obligation (Article 6(1)(c)): Processing required to comply with applicable laws;
• ▸Legitimate interests (Article 6(1)(f)): Processing necessary for our legitimate business interests, where not overridden by your rights;
• ▸Consent (Article 6(1)(a)): Where we have obtained your freely given, specific, and informed consent.

Where we process special category data, we rely on your explicit consent (Article 9(2)(a) GDPR) or processing necessary for reasons of substantial public interest (Article 9(2)(g) GDPR).

2.1 Account and Registration Data

• ▸Full name, date of birth, email address, and hashed password;
• ▸Country of residence and jurisdiction;
• ▸User type (individual, club admin, range operator, gun shop, regulator);
• ▸Profile photo (optional);
• ▸Payment information (processed by Stripe — ArmiHQ does not store card details).

2.2 Identity and Compliance Data

• ▸Government-issued identity document type and number;
• ▸Nationality and residential address;
• ▸Firearms licence numbers, types, issuing authorities, and expiry dates;
• ▸EU firearms category classifications;
• ▸Photos of identity documents (stored encrypted).

2.3 Firearms and Inventory Data

• ▸Make, model, serial number, type, calibre, action, and finish;
• ▸EU category, deactivation certificate details, and legal status;
• ▸Acquisition date, purchase price, estimated value;
• ▸Maintenance records and service history;
• ▸Photos of firearms.

2.4 Activity and Usage Data

• ▸Shooting session records (date, location, rounds fired);
• ▸Ammunition stock levels and usage;
• ▸Range booking records;
• ▸Document vault contents;
• ▸Compliance status and alert history.

2.5 Technical and Usage Data

• ▸IP address, browser type, OS, and device identifiers;
• ▸Pages visited, features used, and session duration;
• ▸Error logs and performance data.

We process sensitive data including government-issued identity numbers and firearms licensing status. We process this data on the basis of your explicit consent, collected at registration. You may withdraw consent at any time, though this may prevent certain features from functioning.

We do not process biometric data, health data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, or data concerning sex life or sexual orientation.

We use your personal data for the following purposes:

• ▸Providing, operating, and maintaining the ArmiHQ Service;
• ▸Processing payments and managing your subscription;
• ▸Sending compliance alerts, expiry notifications, and system notifications;
• ▸Responding to your support requests;
• ▸Preventing fraud, abuse, and unauthorised access;
• ▸Improving the Service through analysis of aggregated, anonymised usage data;
• ▸Complying with legal obligations including law enforcement requests;
• ▸Conducting due diligence in connection with a business transfer.

We do not sell your data to third parties for marketing, use your data for profiling for marketing purposes, or make automated decisions with legal effects without human review.

5.1 Third-Party Service Providers

We share your data with carefully selected service providers who process data on our behalf under Data Processing Agreements:

5.2 Law Enforcement and Regulatory Authorities

We may disclose your data to law enforcement, firearms licensing authorities, courts, or other competent regulatory bodies when required by applicable law. Where permitted, we will notify you of such disclosure.

5.3 Business Transfers

In the event of a sale, merger, or acquisition, your data may be transferred to the successor entity as described in Section 9 below.

5.4 No Sale of Personal Data

ArmiHQ does not sell, rent, or lease your personal data to third parties for their marketing purposes under any circumstances.

Some service providers are located outside the EEA. Where we transfer personal data outside the EEA, we ensure appropriate safeguards including Standard Contractual Clauses approved by the European Commission and supplementary technical measures where required.

You may request a copy of the relevant transfer safeguards by contacting privacy@armihq.com.

Under the GDPR, you have the following rights regarding your personal data:

To exercise any right, contact privacy@armihq.com. We will respond within 30 days. Some rights are limited where we are required to retain data by law.

In the event of a merger, acquisition, asset sale, or any other change of control of ArmiHQ, you acknowledge that:

• ▸Your personal data constitutes a business asset and may be transferred to the acquiring entity;
• ▸Any transfer will be conducted under appropriate legal safeguards including data processing agreements;
• ▸The acquirer will be required to honour this Privacy Policy or provide 30 days notice of material changes;
• ▸You will be notified of any such transfer via email and via a notice on the Service website;
• ▸Where required by GDPR, we will obtain your consent or rely on legitimate interests as the basis for transfer.

We implement appropriate technical and organisational security measures including:

• ▸AES-256 encryption of data at rest;
• ▸TLS 1.3 encryption of data in transit;
• ▸Row Level Security policies enforcing data isolation between users at database level;
• ▸Signed URL access control for all private file storage;
• ▸Audit logging of all data access and modifications;
• ▸Regular backups with point-in-time recovery;
• ▸Incident response procedures compliant with GDPR breach notification requirements.

In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the IDPC within 72 hours and notify affected individuals without undue delay as required by Article 34 GDPR.

ArmiHQ uses strictly necessary cookies to maintain your authenticated session. We do not use third-party advertising or tracking cookies without your consent. Analytics data, where collected, is anonymised before processing. A full Cookie Policy is available at www.armihq.com/cookies.

The Service is not directed to individuals under 18. We do not knowingly collect personal data from minors. If we become aware of such collection, we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email not less than 30 days before they take effect. The current version is always available at www.armihq.com/privacy.