Privacy policy

This privacy policy applies to the websites, products and digital services operated by Arcadeus UG (haftungsbeschränkt) at arcadeus.net and all subdomains. This includes the company homepage, the central sign-in service at id.arcadeus.net, GitLab at git.arcadeus.net for internal employees and users explicitly granted access, other Arcadeus products, and contact through the contact form or by email.

The following sections explain processing for the function being used. The company homepage introduces the company and its work and itself provides no user accounts, ordering function or sign-in. The relevant sections of this shared privacy policy apply to central sign-in and to connected products.

The legal bases stated in this policy for Arcadeus's own purposes relate to processing for which we are the controller, particularly operating the company homepage and administering user access to our services. Where we process personal data in project content solely on a customer's behalf and under their instructions, that customer determines the purposes and is the controller for that processing. The responsible customer's privacy information and legal bases apply to that content. Our statutory obligations as a processor remain unaffected.

We generally receive contact details, messages and project content directly from you. If an authorised contact at your organisation or an administrator sets up your access, your username, name, email address and assigned permissions may come from that person or organisation. GitLab receives the account information needed for central sign-in from our Authentik service.

Technical connection, usage and security data arise when our services are used. Information about other project participants may also come from contributions by authorised users, such as comments, mentions or uploaded files. The relevant sections describe the categories of data and purposes of processing.

When you access our websites and web-based products, our servers process connection and access data required to deliver them. This includes the IP address, date and time, requested URL, HTTP method and status, transfer size, referring page where provided, and browser and operating system information.

Processing enables service delivery, troubleshooting and protection against attacks. Its legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our websites and services.

When a company homepage URL has no language code, we use the browser’s language preference (Accept-Language) to select an available language. The language remains part of the page address; this does not set cookies or store a language profile.

Access and technical operational logs for the company homepage, central sign-in service and GitLab are deleted no later than 14 days after collection. This period does not cover the separately described GitLab audit events, project and CI/CD data, or backups. Processing connection data is necessary to retrieve the respective service.

We operate self-managed servers using infrastructure supplied by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, and netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. They process personal data involved in providing and securing the infrastructure on our behalf.

Data processing agreements pursuant to Art. 28 GDPR are in place with both hosting providers. The servers we use and our own backup storage are located in Germany. Their infrastructure supports the delivery and protection of our self-managed services. Processing by Proton Mail is described separately.

We operate Authentik at https://id.arcadeus.net as the central sign-in service for customers and employees. It manages user accounts, verifies identity during sign-in and controls access to connected Arcadeus applications. The sign-in service also links to this shared privacy policy.

We process usernames, first and last names, email addresses and account data needed for authentication and access management. Password sign-in is available, as are multi-factor authentication (MFA) and passkeys. Sign-in through external identity providers is not currently offered.

Password verification values and the registration data needed to verify configured MFA methods and passkeys are stored within our Authentik installation in its own separate, secured database. For passkeys, Authentik stores the public key and associated registration data; the private key remains with the respective passkey authenticator and is not transmitted to Arcadeus.

If you are personally a party to the contract, account management and sign-in rely on Art. 6(1)(b) GDPR where necessary to perform that contract or take pre-contractual steps at your request. For contacts or employees of a business customer who are not personally parties to the contract, Art. 6(1)(f) GDPR applies; our legitimate interest is providing and administering access authorised for that customer. For our own employees, Art. 6(1)(b) GDPR applies where work-related account management and sign-in are necessary to perform the employment contract. Additional access protection, abuse detection and troubleshooting rely on Art. 6(1)(f) GDPR; our legitimate interest is protecting user accounts and our IT systems against unauthorised access.

The account details and authentication evidence required for the respective sign-in are necessary to access protected applications. Without them, sign-in to those applications is not possible. Providing these details is not generally required by law; a requirement to use a service for work may arise from the relevant contractual or employment relationship. The public company homepage can be visited without an account.

The sign-in service runs on our self-managed infrastructure at Hetzner and netcup. Account-related emails are sent through Proton Mail. This involves processing the email address and the content and delivery data required for the respective authentication or account-management message. The corresponding sections of this policy apply to hosting and email processing.

When you sign in through the central service, the respective connected Arcadeus applications receive your username, first and last names and email address. Identifiers and authentication confirmations needed to complete sign-in and check access permissions are also processed. This allows the application being accessed to identify the account and provide authorised access.

Passwords, password verification values, and MFA secrets and passkey registration data stored by the sign-in service are not passed to connected applications. Authentication evidence is verified centrally in Authentik.

Data is shared for the application being used to complete sign-in and provide the requested service, on the legal bases described in the account section.

Authentik user accounts are deleted after one year of inactivity, measured from the last use of the account. Account data, including registered authentication methods, is retained during active use for account management and access control.

Deletion of an Authentik account is synchronised with GitLab and results in deletion of the corresponding GitLab account. The GitLab account is therefore also deleted when the central account is removed after one year of inactivity.

You can request deletion of your Authentik and GitLab accounts before that year has elapsed by contacting support@arcadeus.net. The inactivity period is not a minimum retention period and does not restrict your statutory rights to erasure. The section on handling erasure requests explains how we assess and respond to requests.

Authentik sign-in sessions have a lifetime of two days. Signing out can end the respective session earlier. This session lifetime is separate from the retention of accounts and event logs.

Authentik records sign-ins, failed sign-in attempts and security-related events. This involves an account reference, IP address, date and time, details of the action and its result, and, where applicable, the application involved and technical browser information. These logs protect the sign-in service and support abuse detection and troubleshooting under Art. 6(1)(f) GDPR.

Authentik event and sign-in logs are deleted no later than 14 days after collection. This retention period is configured for our installation. It applies alongside the separate 14-day deletion period for access and technical operational logs for the company homepage and sign-in service. It does not set a deletion period for active accounts or GitLab data.

We operate a self-managed GitLab instance at https://git.arcadeus.net for internal development and project work. We use repositories for version control, as well as issues, merge requests, wikis and CI/CD. A package or container registry is not currently used.

Sign-in to the GitLab web interface takes place exclusively through our central Authentik service; local GitLab sign-ins are not offered. GitLab processes the account information supplied, particularly usernames, first and last names and email addresses, and associates it with the respective GitLab account and its permissions. Depending on configuration, Git access and automation also involve technical credentials such as SSH keys and access tokens.

Project work involves processing uploaded files and source code, commit histories with author and committer names, email addresses and timestamps, issues, merge requests, comments, wiki content and associated attachments. CI/CD processes the respective build and test data, job logs and generated artifacts. Technical access, sign-in and event data are also processed, particularly account references, IP addresses, times and actions performed.

Processing provides the authorised development and project functions and enables traceable version control and collaboration. Where you are personally a party to the contract, Art. 6(1)(b) GDPR applies to necessary contract performance or pre-contractual steps at your request. For contacts and employees of business customers and other authorised project participants who are not personally parties to the contract, Art. 6(1)(f) GDPR applies; our legitimate interest is organising and carrying out authorised project collaboration. For our own employees, Art. 6(1)(b) GDPR applies where use is necessary to perform the employment contract. Additional system protection and detection of unauthorised access rely on Art. 6(1)(f) GDPR; our legitimate interest is protecting the development environment and its data.

GitLab and its CI/CD runners operate on our self-managed servers at Hetzner or netcup. Notification emails are sent through Proton Mail; processing can include the email address, the reason for the notification and the project information it contains. Version checking and external Web IDE components are described in the following section. We do not currently use additional AI services to process project or build data. The relevant sections of this policy also apply to hosting, email and central sign-in.

GitLab version checking is enabled. Checking for available versions transmits technical version and connection data to GitLab. According to the provider's information, this includes the installed version, hostname, IP address and technical HTTP information. This identifies available security updates and supports secure operation under Art. 6(1)(f) GDPR. Our legitimate interest is protecting the software we operate.

When you use the integrated Web IDE, static editor components may be loaded from the GitLab domain *.cdn.web-ide.gitlab-static.net. Such a request provides the supplying service with the IP address and technical information needed for the HTTP connection. Providing these editor components supports the editing function you request under Art. 6(1)(f) GDPR; our legitimate interest is providing a usable development environment. The additional VS Code Extension Marketplace is disabled.

GitLab Inc., 268 Bush Street no. 350, San Francisco, CA 94104, USA, is involved as a recipient for these GitLab services. Processing in the United States is possible. GitLab Inc. participates in the EU-U.S. Data Privacy Framework; where the transfer is covered by that certification, it relies on the adequacy decision under Art. 45 GDPR. Information about GitLab's processing and the certification register: https://about.gitlab.com/privacy/ https://www.dataprivacyframework.gov/list

Service Ping, automatic generation of Service Ping data and separate event tracking to GitLab are disabled. The Gravatar connection and external Diagrams.net integration are also disabled. The 14-day period for our own technical logs is not a commitment about retention by GitLab.

Projects are private and accessible only with explicit authorisation. Customers can access their own authorised area and additional projects explicitly shared with them. Roles and permissions determine which project content can be viewed or edited. People responsible for operations and administration may access data to the extent required.

Information displayed publicly in a user profile can be viewed by other signed-in users of the instance, including other customers with GitLab accounts. Restricting a project to particular users therefore does not automatically restrict the visibility of these profile details.

Users can themselves include personal information in project content, such as files, comments or attachments. Commit authorship and project contributions also contain personal data. Access follows the project permissions. Arcadeus retains its obligations as the operator for user-submitted content; the users or customers submitting it must also respect the rights of people named in it.

Deletion of the central Authentik account after one year of inactivity is synchronised with GitLab and results in deletion of the corresponding GitLab account. Both accounts can be deleted earlier on request, subject to the statutory conditions described above.

In addition, GitLab accounts are automatically deactivated after 365 days of inactivity in GitLab; accounts that have never been used may be deactivated earlier. This deactivation alone does not delete the account or its project contributions. Signing in again can reactivate an account that has only been deactivated. Synchronised account deletion from Authentik is a separate process.

There is no single fixed deletion period for project and CI/CD data. For personal data in repositories, issues, merge requests and wikis, the determining factor is whether it is still needed for the relevant project or product, including agreed maintenance and necessary development and release documentation. Job logs and generated artifacts are separate data sets; their permissible retention depends on the respective build, test or troubleshooting purpose. Storage after those purposes no longer apply requires a further specific legal justification, such as an applicable statutory retention duty or the necessary establishment, exercise or defence of legal claims. The duration of access authorisation or a user account does not determine how long this content may be retained.

Project administrators can manage content and projects and initiate their deletion within their permissions. Where project content is processed on behalf of a customer acting as controller, content retention and deletion requirements follow that customer's instructions and the data processing agreement. Arcadeus has not configured additional automatic age-based deletion of project content or pipelines. Under the current instance setting, projects and groups normally marked for deletion remain restorable for seven days; GitLab's deletion processing then removes them permanently. The requirements described below apply independently to statutory erasure rights.

GitLab provides a default expiration period of 30 days for CI/CD artifacts. Different project settings or job definitions, and retention of artifacts from the most recent successful pipeline, can result in different or longer storage. The default artifact expiration is therefore not a general deletion period for all artifacts, pipelines or job logs.

Git commits form part of the version history and can continue to contain author information after an account is deleted. Account deletion also does not necessarily remove or anonymise all contributions, comments and attachments. We assess affected content separately when handling an erasure request; the existence of version history does not itself override statutory rights to erasure. Continued storage of personal data requires a legal basis. The statutory duty to erase personal data that is no longer necessary or is stored unlawfully also applies without an erasure request, unless a statutory exception applies.

You can request a review and, where applicable, erasure of your data through support@arcadeus.net; the statutory conditions and rights are described below. The following separate provisions apply to GitLab web sessions, technical logs, audit events and backups.

In addition to Authentik sign-in, GitLab manages its own web sessions and technically necessary security cookies. GitLab web sessions expire no later than two days after creation; further activity does not extend this absolute lifetime. The remember-me function is disabled. Signing out can end a session earlier. This session lifetime does not determine the validity of SSH keys or access tokens.

GitLab technical access and operational logs are deleted no later than 14 days after collection. This period applies to technical log files; it is not a deletion period for audit events stored in GitLab, CI/CD job logs, project content or backups.

GitLab records security-related events, such as sign-ins and changes to accounts, permissions and project settings. Entries can contain user identifiers and names, IP addresses, timestamps and details of the action and the account or project involved. They support traceability of security-related changes, access control and security incident investigations under Art. 6(1)(f) GDPR. Our legitimate interest is protecting our systems and the data stored in them.

No single fixed retention period is set for audit events. Continued retention of personal data requires the individual entry to remain necessary for a specific purpose, such as evidence of a change to access or permissions, investigation of a particular security incident, or the establishment, exercise or defence of a specific legal claim. The determining factors are the recorded action and the period for which evidence of it is needed for that purpose. Where an applicable statutory provision requires a particular entry to be retained, that provision determines the purpose and duration; the legal basis is then Art. 6(1)(c) GDPR in conjunction with that provision.

GitLab technically stores audit events without a set expiry date. Deleting a user account does not automatically remove or fully anonymise information in existing audit events. Names, user identifiers, IP addresses and details of the recorded action may remain after account deletion. The 14-day deletion period for technical log files does not apply to this data.

These requirements also apply after account deletion and regardless of whether an erasure request is made. Continued operation of our services and technical storage without an expiry date do not in themselves create an exception to the statutory duty to erase data. Your statutory rights to erasure or restriction remain applicable; the section on erasure requests explains how requests are handled.

We create GitLab backups daily. A rolling retention period of 14 days is configured for local GitLab backup archives. Archives older than 14 days are removed during the next daily backup run.

We also create full backups of the virtual machines running our self-hosted services, including Authentik and GitLab. The virtual machines run on Proxmox; their backups are stored on our own Proxmox Backup Server in Germany. The retention rule is set to 14 backup days. Only the last snapshot for each day is counted; days without a backup are not counted. If backups are missed, individual snapshots may therefore be older than 14 calendar days. Jobs to prune backup snapshots and remove unused data chunks through garbage collection are scheduled daily at 00:00 and 12:00 UTC.

Backups support recovery after data loss or technical failures. Deletion from the active system does not immediately remove individual records from existing backups; they may remain until the respective backup snapshot is removed in the normal retention cycle. Backup access is limited to the people responsible for it. Following a restoration, previous deletions and access blocks must be reapplied before affected data is returned to ordinary use. Proxmox Backup Server removes underlying data chunks in a separate cleanup process from the removal of a backup snapshot. The separate communication-retention section covers email backups managed by Proton.

When you contact us, we process your email address, message and optional name. The form also supplies the selected language; receipt time and technical delivery information are processed when handling the message. Direct email correspondence includes any additional communication data you provide.

The form submits your details to our server, which sends them through Proton Mail using SMTP with STARTTLS from contact@arcadeus.net to support@arcadeus.net. Your email address is used as the reply address. Message content is not additionally stored in a form database. Technical delivery logs record delivery status and a random request identifier rather than message content.

Where your enquiry concerns a contract with you or pre-contractual steps at your request, the legal basis is Art. 6(1)(b) GDPR. Other enquiries, including those from business customer contacts, are handled under Art. 6(1)(f) GDPR; our legitimate interest is answering questions and communicating appropriately in the course of business. Handling statutory data protection requests and legally required retention rely on Art. 6(1)(c) GDPR in conjunction with the applicable provisions.

Contacting us is voluntary and supplying these details is not a statutory requirement. The form requires a reachable email address and a message; the name is optional. Without the required details, the form cannot be submitted and the enquiry cannot be handled through this channel.

To prevent spam, we process a pseudonymous value derived from the IP address and the number of request attempts. These values are held only in memory and automatically deleted after a 15-minute window. The basis is Art. 6(1)(f) GDPR; our legitimate interest is preventing abuse. This protection does not use cookies or an external CAPTCHA service.

We use Proton Mail from Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland, to send, receive and store email. The message and metadata needed for mail delivery are processed, including sender and recipient addresses, subject, and sending and receipt times. A data processing agreement under Art. 28 GDPR is in place with Proton.

Proton identifies Switzerland, Germany and Norway as storage locations for Proton Mail. Transfers to Switzerland rely on the European Commission’s adequacy decision under Art. 45 GDPR.

More information about Proton processing and its data processing agreement: https://proton.me/mail/privacy-policy https://proton.me/legal/privacy https://proton.me/legal/dpa

We keep messages for as long as needed to handle and answer the enquiry, support a subsequent contractual relationship or protect necessary legal claims. When these purposes no longer apply, we delete the correspondence from our mailbox unless statutory retention duties require otherwise. Commercial and business correspondence subject to statutory retention is generally kept for six years, and accounting vouchers for eight years (section 257 HGB and section 147 AO). The period generally begins at the end of the calendar year in which the correspondence was received or sent, or the voucher was created. Any different statutory retention requirements remain applicable.

The 14-day limit for our own technical logs does not automatically apply to the Proton mailbox or backups managed by Proton. Proton states that encrypted offline backups are kept for up to 30 days. The provider's information supplements our explanation of Proton's processing; our own information and erasure obligations remain applicable.

Information about backups and storage locations: https://proton.me/mail/privacy-policy

The company homepage itself does not set cookies or use analytics, advertising or tracking services. It does not embed content from external platforms. Fonts, icons and images are served from our own website. These statements about the company homepage do not apply indiscriminately to all products and subdomains.

The central sign-in service uses technically necessary session and security cookies to complete the requested sign-in, identify the signed-in session and protect authentication flows. Storage or access relies on section 25(2)(2) TDDDG where strictly necessary for the sign-in service explicitly requested by the user. The legal bases in the account section apply to the associated processing of personal data. The corresponding sign-in session has a lifetime of two days and can be ended earlier by signing out. Blocking these necessary cookies may prevent sign-in.

On id.arcadeus.net, Authentik uses in particular authentik_session to identify the session and authentik_csrf to protect against forged form requests. The confirmed two-day sign-in session is separate from the lifetime of other security cookies. Under the standard in use, authentik_csrf has a browser lifetime of approximately one year, which may be renewed when the cookie is issued again. The authentik_device cookie recognises a previously used device to protect sign-ins; its default lifetime is 30 days from each issuance. By default, the cookies are assigned to the sign-in service's host.

For account switching, Authentik may additionally use authentik_user_switching to associate sign-in sessions used in the same browser. The software default gives this cookie a browser lifetime of 365 days from issuance. This association does not extend the validity of the individual sign-in sessions.

GitLab additionally uses its own technically necessary session and security cookies for the requested development and project functions. Section 25(2)(2) TDDDG also applies where storage or access is strictly necessary for the service explicitly requested by the user. The legal bases described in the GitLab section apply to the associated personal data. The corresponding GitLab web session expires no later than two days after creation. Authentik sign-in does not replace these GitLab session functions.

GitLab's session cookie is named _gitlab_session and belongs to the host git.arcadeus.net. It is configured as a browser session cookie; server-side sign-in validity ends no later than the two days described above. Browsers may retain session cookies longer depending on their restoration settings, without extending server-side sign-in validity. Our configuration does not offer the remember-me function or its associated remember_user_token cookie.

Links to Arcadeus products at arcadeus.net and its subdomains lead to services covered by this shared privacy policy. Links to services operated by others open the destination website only when you follow them. Those operators explain their processing in their own privacy notices.

Within Arcadeus, access is limited to people who need the data for operations, account administration, access management or communications. Connected applications receive the account data described above; authorised project participants can access content shared with them and visible profile information. The hosting providers and Proton are involved in their respective services; GitLab is involved in the separately described version and editor requests. Data is disclosed to public authorities or other bodies where required by law or where necessary and legally permitted in an individual case to protect legal claims. Your own email provider is also involved when exchanging email.

We use access restrictions and appropriate technical and organisational measures. The company homepage uses HTTPS; submission of the contact form to our server and SMTP delivery to Proton are protected by transport encryption. This does not provide end-to-end encryption for the contact form.

You may send an erasure request to support@arcadeus.net at any time. We assess the request and erase the personal data covered by it without undue delay where the conditions of Art. 17 GDPR are met and no statutory exception applies. Deleting an account is separate from assessing other data in project content, audit events and backups.

For each backup containing data affected by an account or project deletion, we keep an associated deletion note outside the systems to be restored. This covers existing backups and any later backups that still contain affected data, including while deletion is pending in GitLab or because they contain older backup archives. The note identifies the accounts or projects whose deletion must be reapplied after restoration and remains associated with the relevant backup. Following restoration, those deletions are reapplied before the affected data is returned to ordinary use. The note implements erasure duties and prevents renewed use of data already deleted; the processing necessary for this relies on Art. 6(1)(c) in conjunction with Art. 5(1)(e) and Art. 17 GDPR. Its retention is tied to the relevant backup and any remaining need to reapply the deletion.

Continued storage is permissible only where it has a legal basis and the data remains necessary. We assess this specifically for security data, for example to prevent unauthorised access or investigate a particular security incident. A general reference to IT security or possible criminal offences does not override the right to erasure. Where erasure is required under Art. 17(1) GDPR, only the statutory exceptions apply, such as statutory retention duties or the establishment, exercise or defence of legal claims under Art. 17(3) GDPR. The scope and duration of continued storage remain limited to what is necessary. An erasure request does not restart the stated retention periods for ordinary technical logs or existing backups.

We explain the measures taken and any data retained, including its purpose, legal basis and deletion period or retention criteria. This includes explaining how remaining data in GitLab audit events and existing backups is processed.

We respond without undue delay, normally no later than one month after receiving the request. If the complexity or number of requests requires an extension, this may be up to two further months; we inform you of the extension and reasons within the first month. If a request is refused in whole or in part, we explain why and inform you of the possibility of complaining to a supervisory authority and seeking a judicial remedy.

If we have reasonable doubts about your identity, we may request the additional information necessary to confirm it. Where legally required, we notify recipients of your data about erasure or restriction of processing. On request, we tell you who those recipients are. Restoring backup data must not reverse erasure rights that have already been exercised effectively.

Subject to the statutory requirements, you may request access, rectification, erasure (the right to be forgotten under Art. 17 GDPR) or restriction of processing. You can request erasure before the stated inactivity or retention periods have elapsed. You also have a right to data portability where its conditions apply. Contact support@arcadeus.net to exercise these rights.

This homepage does not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Where processing relies on legitimate interests under Art. 6(1)(f) GDPR, you may object on grounds relating to your particular situation. We will stop the processing unless we demonstrate overriding compelling legitimate grounds or need the data to establish, exercise or defend legal claims.

You may send an objection to support@arcadeus.net without using a particular form.

Under Art. 77 GDPR, you may complain to a data protection supervisory authority, particularly where you habitually live, work or where you believe an infringement occurred.

The authority responsible for the company’s registered office is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW). Postal address: Postfach 20 04 44, 40102 Düsseldorf, Germany. Email: poststelle@ldi.nrw.de. Further contact options: https://www.ldi.nrw.de/kontakt