Privacy policy

This privacy policy explains personal data processing when you visit the company website arcadeus.net or contact us through its form or by email. The homepage introduces the company and its work; it provides no user accounts, ordering function or sign-in.

Separate products and other digital services explain their processing in their own privacy notices. This policy does not replace product-specific information.

When you visit the homepage, our servers process connection and access data required to deliver it. This includes the IP address, date and time, requested URL, HTTP method and status, transfer size, referring page where provided, and browser and operating system information.

Processing enables website delivery, troubleshooting and protection against attacks. Its legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the homepage.

Access and technical operational logs under our control are deleted no later than 14 days after collection. Processing connection data is necessary to retrieve the website.

We operate self-managed servers using infrastructure supplied by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, and netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. They process personal data involved in providing and securing the infrastructure on our behalf.

Data processing agreements pursuant to Art. 28 GDPR are in place with both hosting providers. Their infrastructure supports the website delivery and security purposes described above.

When you contact us, we process your email address, message and optional name. The form also supplies the selected language; receipt time and technical delivery information are processed when handling the message. Direct email correspondence includes any additional communication data you provide.

The form submits your details to our server, which sends them through Proton Mail using SMTP with STARTTLS from contact@arcadeus.net to support@arcadeus.net. Your email address is used as the reply address. Message content is not additionally stored in a form database. Technical delivery logs record delivery status and a random request identifier rather than message content.

For contractual or pre-contractual enquiries, the legal basis is Art. 6(1)(b) GDPR. Other enquiries are handled under Art. 6(1)(f) GDPR; our legitimate interest is answering questions and communicating appropriately. Where further retention is legally required, its basis is Art. 6(1)(c) GDPR.

Contacting us is voluntary and supplying these details is not a statutory requirement. The form requires a reachable email address and a message; the name is optional. Without the required details, the form cannot be submitted and the enquiry cannot be handled through this channel.

To prevent spam, we process a pseudonymous value derived from the IP address and the number of request attempts. These values are held only in memory and automatically deleted after a 15-minute window. The basis is Art. 6(1)(f) GDPR; our legitimate interest is preventing abuse. This protection does not use cookies or an external CAPTCHA service.

We use Proton Mail from Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland, to send, receive and store email. The message and metadata needed for mail delivery are processed, including sender and recipient addresses, subject, and sending and receipt times. Proton provides a data processing agreement as part of its contract for business use.

Proton identifies Switzerland, Germany and Norway as storage locations for Proton Mail. Transfers to Switzerland rely on the European Commission’s adequacy decision under Art. 45 GDPR.

More information about Proton processing and its data processing agreement: https://proton.me/mail/privacy-policy https://proton.me/legal/privacy https://proton.me/legal/dpa

We keep messages for as long as needed to handle and answer the enquiry, support a subsequent contractual relationship or protect legal claims. When these purposes no longer apply, we delete the correspondence from our mailbox unless statutory retention duties require otherwise. Business correspondence and accounting records subject to retention are kept for the applicable statutory period.

The 14-day limit for our own technical logs does not automatically apply to the Proton mailbox or backups managed by Proton. Proton states that encrypted offline backups are kept for up to 30 days. Other technically or legally necessary provider processing is governed by its privacy notices; our criteria for retaining correspondence remain applicable.

Information about backups and storage locations: https://proton.me/mail/privacy-policy

This homepage does not set cookies or use analytics, advertising or tracking services. It does not embed content from external platforms. Fonts, icons and images are served from our own website.

External links open the destination website only when you follow them. Its processing is explained in its own privacy notices.

Within Arcadeus, access is limited to people who need the data to operate the website or handle communications. The hosting providers and Proton listed above are involved in providing their respective services. Data is disclosed to public authorities or other bodies where legally required. Your own email provider is also involved when exchanging email.

We use access restrictions and appropriate technical and organisational measures. The public homepage is served over HTTPS; the SMTP connection requires STARTTLS. Transport encryption does not amount to a promise of end-to-end encryption for the contact form.

Subject to the statutory requirements, you may request access, rectification, erasure or restriction of processing. You also have a right to data portability where its conditions apply. Contact support@arcadeus.net to exercise these rights.

This homepage does not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Where processing relies on legitimate interests under Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will stop the processing unless we demonstrate overriding compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

You may send an objection to support@arcadeus.net without using a particular form.

Under Art. 77 GDPR, you may complain to a data protection supervisory authority, particularly where you habitually live, work or where you believe an infringement occurred.

The authority responsible for the company’s registered office is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany. Email: poststelle@ldi.nrw.de.