Privacy, in plain English.

From the website. When you submit the contact form, we record your email, any company name you provide, the paragraph you write, and your consent. Nothing else: no tracking pixels, no marketing cookies, no session replay.

From server logs. Standard request logs (IP, user agent, path, timestamp) for debugging and abuse prevention. Kept for 30 days, then rotated out.

Inside a paid engagement. Personal data that flows through the agents and tools we deploy, for example, customer phone numbers in a renewal-agent deployment. That data is processed on your behalf under the DPA, not collected by Arcken for ourselves.

The contact-form paragraph is so the founders can read your message and decide which engagement fits. If it does, we reply and scope the first call. If it doesn’t, we reply with who to talk to instead.

Server logs are kept because without them we can’t debug a broken page or catch automated abuse. They are never linked to the contact-form submissions in any reporting.

The website is served from EU edge infrastructure. The contact-form endpoint is hosted on EU infrastructure with no transatlantic data transfer by default.

Internal tooling (email, calendar, coding assistants) may use global vendors where they ship best, but none of that tooling touches your product, your customer data, or the contact-form paragraph. The line between what we use to build and what your business runs on is clean.

Nobody. We don’t sell contact data, don’t share it with partners, and don’t enrich it against third-party sources. The contact-form paragraph is read by the two founders.

For paid engagements, sub-processors are named in the DPA and the SOW. You will see the full list before the engagement starts, not afterwards.

Contact-form submissions are kept until the conversation is closed: either the engagement ends, or we decide there’s no fit and part ways. Either way, you can ask us to delete the record sooner by emailing hello@arcken.nl.

Server logs: 30 days, rotated. Engagement data: per the DPA, named in the SOW.

You have the right to request access to, correction of, deletion of, or portability of your personal data, and to object to processing. Email hello@arcken.nl and we will act on it within the GDPR-required timeline (typically one month, extendable by two).

You also have the right to complain to your national data protection authority. In the Netherlands, that’s the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).