Privacy Policy

Controller

Salar S.-Mousavi
Suarezstr. 44, 14057 Berlin, Germany
Email: contact@arcslist.com

ARCSLIST is operated as a pre-incorporation project. Upon formal incorporation as a UG (haftungsbeschränkt), this section will be updated with full company details.

Scope

This policy applies to:

• This website (arcslist.com)
• The ARCSLIST platform (invite-only, pilot phase)
• Any communication initiated through contact forms, early access requests, or direct email

Data collected

We may process the following categories of personal data:

• Name and email address
• Company name and professional role
• Message content submitted through forms
• Technical usage data necessary for secure website operation (e.g. IP address, browser type, access times)

Legal basis for processing (GDPR Art. 6)

• Contact and enquiry handling: Art. 6(1)(b) — processing necessary for steps prior to entering a contract, or Art. 6(1)(f) — legitimate interest in responding to business enquiries
• Early access waitlist: Art. 6(1)(a) — consent given at time of submission
• Website operation and security: Art. 6(1)(f) — legitimate interest in secure and reliable operation

Purpose of processing

Personal data is processed only for the following purposes:

• Responding to enquiries and managing early access communication
• Evaluating pilot partnership interest
• Operating the website securely and reliably
• Complying with legal obligations where applicable

Data is not used for automated decision-making or profiling.

Data retention

• Enquiry and contact data: retained for as long as necessary to handle the enquiry and for a reasonable follow-up period, typically no longer than 24 months unless a contractual relationship is established
• Waitlist data: retained until access is granted or the request is declined
• Technical usage data: retained in line with standard infrastructure logging periods, typically 30–90 days

Infrastructure and hosting

ARCSLIST uses Supabase for database infrastructure. Data is stored on servers located in Frankfurt, Germany (eu-central-1, Central EU region), operated by Amazon Web Services as Supabase's infrastructure provider. Supabase, Inc. acts as a data processor under a data processing agreement.

This website is hosted via Vercel, Inc. (USA). Vercel may process technical access data (e.g. IP addresses) as part of website delivery. Vercel operates under standard contractual clauses for EU data transfers.

Data sharing

ARCSLIST does not sell personal data. Data is not shared with third parties for marketing or advertising purposes.

Data may be shared with infrastructure providers (Supabase, Vercel) solely as necessary for technical operation. No other third-party sharing takes place at this stage.

UK users

ARCSLIST works with pilot partners based in the United Kingdom. For UK-based users, data processing is conducted in accordance with the UK GDPR (as retained in UK law under the Data Protection Act 2018). The legal bases and principles described above apply equally to UK users.

Data is stored within the EU (Frankfurt, Germany) and not transferred outside the EU/EEA for storage purposes.

Your rights

Under GDPR (and UK GDPR for UK users), you have the right to:

• Access the personal data we hold about you (Art. 15)
• Request correction of inaccurate data (Art. 16)
• Request deletion of your data (Art. 17)
• Restrict or object to processing (Art. 18, 21)
• Data portability where applicable (Art. 20)
• Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, contact: contact@arcslist.com
We will respond within 30 days.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority.

In Germany: Berliner Beauftragte für Datenschutz und Informationsfreiheit
Website: datenschutz-berlin.de

In the UK: Information Commissioner's Office (ICO)
Website: ico.org.uk

Contact

For all privacy-related questions: contact@arcslist.com