THE ATLANTIC RENEWAL INSTITUTE

PRIVACY NOTICE

This Privacy Notice explains how The Atlantic Renewal Institute (“ARI”, “we”, “us”, or “our”) collects, uses, stores, transfers and protects personal data you provide when you contact us, visit our website, subscribe to communications, or otherwise interact with our activities. This Notice is prepared with regard to applicable data-protection law and best practice.

1. Data controller. The Atlantic Renewal Institute is the data controller responsible for the processing of personal data described in this Notice.

Contact for privacy requests: privacy@theatlanticrenewal.org or use the contact form on our website.

If you are in Mexico and wish to exercise your ARCO rights, see section 7 below.

2. Personal data we collect. Depending on how you interact with us, we may collect:

• Identity & contact data: name, email address, organization / affiliation, job title, country.

• Communications: message content you submit through forms, emails, or attachments.

• Technical data: IP address, browser and device information, cookies and usage data when you visit our website.

• Optional materials: CV, writing samples or attachments you voluntarily upload.

We do not request or process more data than necessary for the stated purposes; sensitive data will only be processed where strictly necessary and with explicit consent.

3. Purposes of processing. We use personal data for the following purposes (only as necessary and proportionate):

1.  To receive, review, and respond to inquiries submitted via our contact channels.

2.  To manage institutional communications, media requests, and event coordination.

3.  To administer subscriptions to newsletters and updates (with your consent).

4.  To store and review optional attachments you provide (e.g., CV, proposals).

5.  To maintain website security, analytics and improve the visitor experience.

We will not use personal data for purposes incompatible with the purposes originally disclosed without informing you and —where required by law— obtaining new consent.

4. Legal basis and consent. When handling your personal data we rely upon one or more lawful bases such as:

• your consent (for communications, newsletters and processing of optional uploads);

• our legitimate interests (to operate the institute, manage inquiries, ensure security, and defend legal claims), balanced with your rights; and

• compliance with legal obligations where applicable.

For processing activities that require explicit consent under local law (for example, sensitive personal data), we will ask for clear, affirmative consent before processing. Mexican law and recent guidance require transparency about purposes and special mention of sensitive categories.

5. Recipients & international transfers. We may share personal data with:

• service providers who act on our behalf (e.g., hosting providers, email platforms, analytics vendors);

• professional advisers where necessary (e.g., legal, accounting); and

• third parties when required by law or to protect our rights.

If personal data is transferred outside the country where it was collected, we will take reasonable steps to ensure an adequate level of protection (contractual safeguards, approved transfer mechanisms or other appropriate measures). Any transfers will be documented and limited to the extent necessary.

6. Retention. We retain personal data only for the time necessary to fulfill the purposes set out above, to satisfy legal, accounting or reporting obligations, or as otherwise permitted by law. Typical retention periods:

• Contact form records: retained for a reasonable administrative period (e.g., up to 3 years) unless a different lawful basis or regulatory requirement applies.

• Newsletter subscription: until you withdraw consent or unsubscribe.

• Records required for legal claims or compliance: retained as legally required.

Please adapt retention lengths to your internal policy and applicable law; Mexico’s law requires limiting retention to what is necessary for the declared purpose.

7. Your rights (including ARCO rights in Mexico) and how to exercise them. Subject to applicable law, you have the right to:

• Access the personal data we hold about you.

• Request rectification of inaccurate or incomplete data.

• Request cancellation or deletion of your personal data (where permitted).

• Object to or restrict certain processing.

• Withdraw consent at any time for processing based on consent.

• Request portability where applicable.

If you are in Mexico, the law provides for the exercise of the rights of Access, Rectification, Cancellation and Opposition (ARCO). The Atlantic Renewal Institute will respond to complete ARCO requests within the statutory term (generally 20 business days from receipt to communicate a decision, and where an action is ordered the controller typically has an additional 15 business days to make it effective). If an extension is necessary for justified reasons, we will inform you. To exercise any right, contact: privacy@theatlanticrenewal.org and provide the required identification and details of your request.

8. Cookies and analytics. Our website may use cookies and similar technologies for essential functionality and to collect aggregated analytics. Where required, we seek your consent for non-essential cookies and provide controls for managing cookie preferences. For technical details of cookies used, consult our Cookie Notice (if available) or contact our privacy team.

9. Security. We implement reasonable administrative, technical and physical measures designed to protect personal data against accidental loss, unauthorized access, use, alteration and disclosure. These measures are periodically reviewed and improved. However, no online system is completely secure; if a security incident affects your personal data we will comply with legal obligations regarding notification.

10. Minors. Our services are not intended for minors. If you are under the age required by local law to provide consent, please do not submit personal data without parental or guardian authorization. If we become aware that we have collected personal data from a minor without verification of parental consent, we will take steps to delete such data.

11. Changes to this Notice. We may update this Notice to reflect changes in law, our practices, or for operational reasons. Any material changes will be published on our website with an updated effective date.

12. Contact & complaints. For questions, to exercise your rights, or to lodge a complaint about our privacy practices, contact: privacy@theatlanticrenewal.org or use the contact form on our website. If you are in Mexico and remain unsatisfied after our response, you may file a complaint with the competent authority under local law.

September 1st, 2026.

IF NEEDED IN ANY OTHER LANGUAGE, PLEASE REQUEST IT TO:

privacy@theatlanticrenewal.org