Privacy policy

Last updated: September 2026

This website can be read without giving any personal data. Where processing does happen, the sections below set out which data it concerns, what it is for, and on which legal basis it rests.

This is a translation for convenience. The German version is the legally binding one.

Controller

The controller under the General Data Protection Regulation (GDPR) is Arcos Technologies GmbH, Arcisstraße 32, 80799 München, Germany, represented by its managing directors Louis Wübben and Moritz Steigerwald.

For data protection matters and to exercise your rights, write to hello@arcos.eu. The full provider details are in the imprint.

Data protection officer

We are not required to appoint a data protection officer (§ 38 BDSG, the German Federal Data Protection Act) and have not appointed one. Responsibility rests with the management at the address above.

Your rights

Under the GDPR you have the right to

  • access the data held about you (Art. 15),
  • have inaccurate data corrected (Art. 16),
  • erasure (Art. 17),
  • restriction of processing (Art. 18),
  • data portability (Art. 20),
  • object to processing based on a legitimate interest (Art. 21).

You can withdraw consent at any time (Art. 7 (3) GDPR). Withdrawal takes effect for the future and does not affect the lawfulness of processing carried out until then.

You can also lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany.

We process personal data on one of these bases:

  • Art. 6 (1) (a) GDPR — your consent, for example for the newsletter.
  • Art. 6 (1) (b) GDPR — performance of a contract or steps taken before entering one, for example an inquiry or a job application.
  • Art. 6 (1) (f) GDPR — our legitimate interest in running this website securely, in working order and accountably.
  • § 25 (2) no. 2 TDDDG (the German Telecommunications Digital Services Data Protection Act) — storage on your device where it is strictly necessary for a function you have explicitly requested.

Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. The form endpoints run in the Frankfurt am Main region; the static pages are served by Vercel’s global network, from whichever location is nearest to you.

On every request the server processes the technical data your browser sends: IP address, date and time, the address requested, the volume of data transferred, the status code, the referring page, and browser and operating system details. A page cannot be delivered without them. They serve to operate the site and to fend off attacks, and are not combined with other sources. No inference back to an individual person is drawn from them. The legal basis is Art. 6 (1) (f) GDPR.

Security

This website is served over TLS only; HTTP Strict Transport Security enforces that. On top of that we set a Content Security Policy, X-Content-Type-Options, X-Frame-Options, a restrictive Permissions-Policy — camera, microphone and location are switched off — and Referrer-Policy: strict-origin-when-cross-origin, which keeps full addresses from this website from reaching third-party servers.

The typeface is served from this domain. No Google Fonts and no other external font service is requested. Apart from the form protection described below, this website embeds no third-party content and loads no tracking pixels.

Storage on your device

While an announcement bar is active at the top of the page, this website stores a single entry in your browser’s local storage:

  • arcos.announcement — the identifier of the bar you closed. The entry is written only once you close the bar, and read on every page load after that. It keeps the notice closed.

It serves solely the function you triggered and is therefore exempt from consent under § 25 (2) no. 2 TDDDG. You can delete it at any time in your browser settings.

One cookie is set, and only if you switch language yourself:

  • lang — the language you chose, de or en. It is set when you use the language switch, lasts one year, and is sent only to this website (SameSite=Lax). If your browser asks for German, this website sends you to the German version automatically; this cookie is what records a different choice so that redirect stops overriding it. It holds no identifier and nothing else is stored in it.

That cookie also serves only the function you triggered, and is exempt from consent under § 25 (2) no. 2 TDDDG on the same basis. You can delete it at any time in your browser settings.

Beyond those two entries this website stores nothing on your device. It stores nothing for analytics, profiling or advertising, and embeds no service that requires consent. That is why there is no cookie banner.

Audience measurement

We use Vercel Web Analytics and Vercel Speed Insights to see which pages are opened and how fast they load. Both work without cookies and without any storage in your browser.

What is recorded: the time, the address opened, the referring page, filtered address parameters, an approximate location derived from the IP address, device type, operating system, browser, and loading-speed measurements. Repeat views are grouped by a hash that Vercel derives from the request on its own servers and, according to the provider, discards after 24 hours. No persistent identifier is created, and a session cannot be followed across different websites.

Because nothing is stored on your device and nothing is read from it, § 25 (1) TDDDG does not apply. The processing itself rests on our legitimate interest in reliable, data-minimizing audience measurement, Art. 6 (1) (f) GDPR.

Protecting the forms against misuse

The forms on this website are protected against automated submissions. For that we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.

As soon as you open a page carrying a form, your browser loads the Turnstile script from Cloudflare, which gives Cloudflare your IP address and technical characteristics of your browser. Turnstile then checks in the background whether a submission comes from a person, and only asks a question in borderline cases. We run Turnstile in standard mode; “Pre-Clearance”, which would set a persistent cookie, is switched off.

We also use the Vercel Firewall to limit how many submissions one IP address can make within a time window. The legal basis for both is Art. 6 (1) (f) GDPR: without this protection the forms would be open to bulk submissions.

Contact form

Through the contact form you send us your name, your email address, your company, the topic of your inquiry and your message. We process these details to answer your inquiry and to keep a record of the exchange. You receive an acknowledgement by email.

The details are stored in our customer management system, Attio (see below). The legal basis is Art. 6 (1) (b) GDPR where your inquiry is aimed at a contract, and otherwise Art. 6 (1) (f) GDPR.

Newsletter

The newsletter uses double opt-in: after you sign up you receive an email with a confirmation link, and the newsletter is only sent once you confirm. That establishes that the sign-up came from you.

The legal basis is your consent, Art. 6 (1) (a) GDPR together with § 7 (2) no. 2 UWG (the German Act Against Unfair Competition). To evidence that consent (Art. 7 (1) GDPR) we store the time of sign-up and of confirmation, the IP address used, the browser identification, the version of the sign-up form and the consent wording recorded for that sign-up.

We use Resend to send it (see below). The unsubscribe links in every issue carry your email address in cryptographically signed form so that unsubscribing works without signing in and without a further step. Unsubscribing is final: older links cannot reactivate an unsubscribed address. You can unsubscribe at any time through the link in any issue or by email to hello@arcos.eu.

Job applications

Applications run through a form provided by Tally (see below), where you enter your details and career history and upload your documents. We process this data to decide on your application; the legal bases are Art. 6 (1) (b) GDPR and § 26 (1) BDSG. You receive an acknowledgement by email.

The documents are transferred into our customer management system, Attio, and made available there only to the people involved in the selection. If we do not end up working together, we delete the application six months after the process closes. We keep it longer only where you have explicitly agreed to being contacted about a later opening.

Recipients and processors

To run this website and its forms we work with these processors, with each of which a data processing agreement under Art. 28 GDPR is in place:

  • Vercel Inc., USA — hosting this website, audience measurement, protection against overload.
  • Cloudflare, Inc., USA — protecting the forms against automated submissions.
  • Resend, Inc., USA — sending the newsletter, confirmation and acknowledgement emails; the sending domains are in the EU.
  • Attio Limited, 42 St John’s Square, London EC1M 4EA, United Kingdom — customer management, evidence of newsletter consent, and handling job applications.
  • Tally BV, Sint-Pietersnieuwstraat 11, 9000 Gent, Belgium — application forms.

Alongside those we use ordinary communication and office services, with which data processing agreements are likewise in place. Beyond that we disclose data where we are legally obliged to. We do not sell personal data.

Transfers to third countries

Vercel, Cloudflare and Resend are based in the United States. Those transfers rest on the European Commission’s standard contractual clauses under Art. 46 (2) (c) GDPR, which form part of each provider’s data processing agreement. Where a provider additionally participates in the EU-US Data Privacy Framework, the Commission’s adequacy decision for that framework applies as well.

Attio Limited is based in the United Kingdom. Transfers there are covered by an adequacy decision of the European Commission.

Tally BV is based in Belgium and states that it stores form data in the European Union.

Retention

We keep personal data only as long as the purpose requires:

  • Contact form inquiries: until the matter is closed, then, where it becomes a business transaction, for the retention periods required by commercial and tax law.
  • Newsletter: until you unsubscribe. The evidence of consent and of the unsubscribe is kept beyond that, because we have to be able to produce it in a dispute.
  • Job applications: six months after the process closes.
  • Technical server data: according to the hosting provider’s retention periods, which it needs for delivery and attack detection.

No automated decision-making

There is no automated decision-making in individual cases and no profiling under Art. 22 GDPR. Audience measurement stops at aggregates.

Providing data is voluntary

You are under no obligation to provide personal data. This website can be read in full without filling in a form. Without the details marked as required in a form, however, we cannot deal with that particular request.

The footer and some pages link to our profile on LinkedIn, our area on GitHub, and a scheduling tool at cal.com; below news and story articles there are also share links to LinkedIn, Facebook, X and email. These are ordinary links: a connection to the provider concerned is made only once you click one, and that provider’s privacy policy applies from that point. We embed none of their content in this website and transmit no data to them while you are simply reading our pages.

Changes to this privacy policy

If what this website processes changes, we change this policy. The date above the text says when it was last revised.