Privacy Policy

1. Who we are (data controller)

Arpacore B.V., Coolsingel 65, 3012 AC Rotterdam, Netherlands. Registered with the Dutch Chamber of Commerce (KvK) under 62627058 · VAT NL854893180B02. For any privacy question or to exercise your rights, email info@arpacore.com.

2. What data we collect

• Booking & contact data — the name, company name, VAT number, email address, phone number, and the message you provide when you book a discovery call or a paid session.
• Account data — your email address and a unique account identifier used to give you access to the client portal via a passwordless sign-in link.
• Engagement data — appointments, invoices, and documents shared with you through the client portal.
• Usage data — collected via Google Analytics, and only with your consent: pages visited, approximate location (derived from your IP address, which GA4 does not store), device and browser type, and on-page interactions.
• Technical data — stored in cookies and similar technologies, as described in our Cookie Policy.

3. How and why we use your data (legal bases)

• To respond to your bookings and provide our services — performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR).
• To issue invoices and meet our accounting and tax obligations — legal obligation (Art. 6(1)(c)).
• To operate, secure, and improve the website and prevent abuse — our legitimate interests (Art. 6(1)(f)).
• To measure website usage with analytics cookies — your consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not sell your personal data, we do not use it for advertising, and we do not carry out automated decision-making that produces legal effects concerning you.

4. Service providers we use

We share personal data only with providers that process it on our behalf under appropriate data-processing agreements:

• Google (Firebase) — database (Firestore), authentication, and file storage.
• Stripe — payment processing for paid sessions. Stripe also acts as an independent controller for fraud prevention and its own legal compliance.
• Google Analytics — website analytics, loaded only after you consent.
• Amazon Web Services (AWS) — website hosting and delivery.

5. International transfers

Some providers may process data outside the European Economic Area (for example in the United States). Where this happens, the transfer is protected by appropriate safeguards such as the EU–U.S. Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses.

6. How long we keep it

• Booking, account, and engagement data — for the duration of our relationship and afterwards as needed to handle queries or legal claims.
• Invoices and accounting records — 7 years, as required by Dutch tax law.
• Analytics data — according to our Google Analytics retention settings.
• Cookies — for the periods set out in the Cookie Policy.

7. Your rights

Under the GDPR you have the right to access your data and to request its rectification or erasure, to restrict or object to processing, to data portability, and to withdraw consent at any time. To exercise any of these rights, email info@arpacore.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

8. Security

We rely on the security controls of our providers — encryption in transit, access controls, and role-based permissions — to protect your data. No method of transmission or storage is 100% secure, but we work to protect your personal data using appropriate measures.

9. Changes to this policy

We may update this Privacy Policy from time to time. The “last updated” date above reflects the most recent version.

10. Contact

Questions about this policy or your personal data? Email info@arpacore.com.