Privacy Policy

1. Responsible Party and Contact

The party responsible for the processing of personal data on this website in accordance with the General Data Protection Regulation (GDPR) is:

Maximilian Heid

ARKTRIS – Company in Preparation

Johannagasse 29-35/11/13

1050, Vienna

Austria

E-Mail: maximilian@arktris.com

ARKTRIS is currently in the founding phase. Until the commencement of business operations, the data processing related to this website is the responsibility of the aforementioned person.

If you have questions regarding the processing of your personal data or the exercise of your data protection rights, you can contact us at the provided email address.

2. General Information on Data Processing

We place great importance on the protection of your personal data and process it in accordance with the General Data Protection Regulation (GDPR) as well as the applicable Austrian data protection regulations.

Personal data are information that relates to an identified or identifiable natural person. This includes, for example, names, email addresses, telephone numbers, and IP addresses.

We process personal data only to the extent necessary for the operation of our website, the handling of inquiries, communication with interested parties, or the security of our technical systems.

The processing is carried out on the basis of an applicable legal basis in accordance with Art. 6 GDPR. In particular, the implementation of pre-contractual measures (Art. 6 para. 1 lit. b GDPR), the fulfilment of legal obligations (Art. 6 para. 1 lit. c GDPR), as well as legitimate interests (Art. 6 para. 1 lit. f GDPR) are considered.

We adhere to the principles of purpose limitation, data minimisation, and storage limitation. Personal data is generally only processed as long as necessary for the respective purpose or as required by legal retention obligations or other legitimate reasons for further storage.

We explain the details of the respective processing, the service providers used, and the storage periods in the following sections.

3. Website hosting and technical access data

Our website is operated via Odoo.sh, a service of Odoo S.A., Chaussée de Namur 40, 1367 Grand-Rosière, Belgium. The hosting region of our Odoo.sh instance is located in Europe.

When visiting our website, technically required connection data is processed. This may include in particular the IP address, date and time of access, pages accessed, browser information, and other technical information regarding the connection.

The processing is carried out to provide our website, ensure its functionality and security, and to detect and prevent technical disruptions and unauthorised or abusive access.

The legal basis is Art. 6 para. 1 lit. f GDPR. Our legitimate interest lies in the secure, reliable, and functional operation of our website.

Odoo processes personal data as a data processor within the framework of hosting. Additional technical service providers may be used as sub-processors.

Technical access data is stored only as long as necessary for the stated purposes. The specific storage periods are determined by the technical and contractual regulations of the hosting provider.

4. Cookies and technically necessary storage technologies

Our website uses cookies and similar storage technologies that are used to provide basic website functions and to store technical settings.

Cookies are small pieces of information that the browser can store on your device.

In the context of our Odoo website, the following cookies are specifically used:

session_id: Used for managing the session and providing basic website functions.
frontend_lang: Stores the selected language so that our website can be displayed in the desired language.
tz: Stores information about the time zone setting.

These cookies are necessary for the technical operation and user-friendly provision of our website. We currently do not use our own cookies for personalised advertising or marketing tracking.

As far as the processing of personal data is concerned, this is carried out on the basis of our legitimate interest in accordance with Art. 6 para. 1 lit. f GDPR in the secure and functional provision of our website.

You can manage or delete cookies through your browser settings. Disabling certain cookies may result in some functions of our website not working as intended.

Information on the use of Cloudflare Turnstile as spam protection can be found in Section 7 of this privacy policy.

5. Contacting us through our website

On our website, we offer various ways to get in touch. The personal data we process depends on which form you use.

5.1 General contact form

Through the contact form on our imprint page, you can send us general inquiries.

In doing so, we process your email address, the content of your message, and your name, if you provide it voluntarily.

The information will be used to process your inquiry and for any further communication that may be necessary. The form sends your message via email to our business mailbox, which is provided through Microsoft 365.

The processing is carried out to handle your inquiry. The legal basis is Article 6(1)(b) GDPR, insofar as your inquiry relates to pre-contractual measures, otherwise our legitimate interest in processing incoming inquiries according to Article 6(1)(f) GDPR.

We only store your information for as long as is necessary to process your inquiry and any further communication that may be required. Subsequently, the data will be deleted unless there are legal retention obligations or other lawful reasons for further storage.

5.2 Callback request

You can request a phone call via the callback form on our website.

In doing so, we process your phone number as well as any other information you provide voluntarily. This may include your name, your email address, your company, your message, and your preferred time of day for the callback (morning or afternoon).

The submitted information will be stored in our CRM system (Odoo) as a sales opportunity. We use this data solely for processing your callback request and any resulting business communication. A separate contact entry is not automatically created through the form.

If a sales opportunity is concluded without the establishment of a business relationship and is archived as lost, it will be automatically deleted from the active CRM system no earlier than 90 days after its conclusion. The cleanup occurs daily and processes a maximum of 30 corresponding records per run.

If a business relationship is established, the applicable retention periods for that business relationship apply. Deleted data may temporarily remain in technical backup copies.

6. Contacting us by email

If you contact us by email, we process your email address, possibly your name, as well as the content of your message and any personal data contained therein. Additionally, technical information regarding the email transmission may be processed.

We use this data to address your concern, to respond to your message, and for any further necessary business communication.

The processing is carried out on the basis of Art. 6 para. 1 lit. b GDPR, insofar as your contact serves to initiate or execute a contract. For other inquiries, the processing is based on our legitimate interest in proper communication in accordance with Art. 6 para. 1 lit. f GDPR.

For our business email communication, we use Microsoft 365. In this context, emails and the associated personal data are processed by Microsoft as a service provider. Within our team, only those individuals who need access to the data for processing the respective concern are granted access.

We store email correspondence only as long as necessary for processing the respective concern and any subsequent business relationship. Legal retention obligations and other legitimate reasons for longer storage remain unaffected.

7. Cloudflare Turnstile (Spam protection)

To protect our website and our forms from automated entries, spam, and abusive access, we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA.

Turnstile is integrated through the standard integration of our website platform Odoo. When accessing the corresponding protected pages, a connection to Cloudflare is established.

In this process, Cloudflare processes technical information to detect automated access. This may include, in particular, the IP address, technical characteristics of the connection, browser information, and details about the accessed website.

We use Turnstile to protect our website from automated access and abuse. According to Cloudflare, Turnstile does not access the contents of your form submissions or messages.

The legal basis for processing personal data to protect our website is our legitimate interest under Art. 6 para. 1 lit. f GDPR in the security and functionality of our online presence.

Cloudflare processes technical data to provide Turnstile on our behalf. To the extent that Cloudflare processes this data to improve its own bot detection, Cloudflare states that it acts as an independent controller.

In connection with the use of Turnstile, personal data may be transferred to the USA. Cloudflare specifically refers to the EU-US Data Privacy Framework and to appropriate contractual guarantees, including the standard contractual clauses of the European Commission.

Further information on data processing by Cloudflare can be found here:

Cloudflare Turnstile Privacy Addendum:

https://www.cloudflare.com/turnstile-privacy-policy/

Cloudflare Privacy Policy:

https://www.cloudflare.com/de-de/privacypolicy/

8. Data Backup and Test Environments

To ensure the operational security and recoverability of our systems, our hosting provider Odoo.sh regularly creates technical backups of our database.

Odoo.sh retains seven daily, four weekly, and three monthly backups in accordance with its documented backup policy. Additionally, we can create manual backups before technical changes, which will remain available for three days.

For the development and testing of new features, we use a separate test environment, which is updated with a copy of the production system as needed. The respective staging test database is automatically deleted after one month. If necessary, a new test copy can be created from the production system before the existing test database is automatically deleted. Access to the test environment is restricted to authorised personnel.

Personal data that has been deleted from the active system may temporarily remain in existing backups or test environments. These copies are used solely for technical purposes and are not used as a permanent data archive.

During a restoration, previously deleted data may again be present in the active system.

9. Recipients and international data transfers

To provide our website, to process requests, and to conduct our business communication, we use external service providers. Personal data may be transmitted to these service providers or processed by them on our behalf.

The currently used service providers include, in particular:

Odoo S.A. (Belgium): Provision and hosting of our website as well as our CRM system via Odoo.sh.
Microsoft: Provision of our business email communication via Microsoft 365.
Cloudflare, Inc. (USA): Provision of Cloudflare Turnstile to protect our website forms from automated submissions and abuse.

Where service providers process personal data on our behalf, this is done on the basis of appropriate data processing agreements, where required by law.

When providing these services, additional subprocessors may be used. This may also involve the processing of personal data outside the European Economic Area, particularly in the USA.

Such data transfers only occur in compliance with the requirements of Art. 44 et seq. GDPR. This may include adequacy decisions by the European Commission or suitable safeguards such as the standard contractual clauses of the European Commission.

10. Retention Period and Deletion

We generally store personal data only as long as it is necessary for the respective processing purpose or there is a legal retention obligation or another lawful reason for further storage.

The retention period particularly depends on the type of data, the purpose of its processing, and the course of a possible business relationship.

The following principles apply to the individual processing operations:

General contact inquiries and email correspondence: The data will be deleted as soon as they are no longer needed for processing the request and any further communication that may be required, provided there are no lawful reasons for longer retention.
Callback requests in the CRM: Unsuccessful and archived sales opportunities will be automatically deleted from the active CRM system no earlier than 90 days after their conclusion. The cleanup runs daily and processes a maximum of 30 records per run.
Ongoing business relationships: Personal data will be processed for as long as it is necessary for the respective business relationship. Subsequently, they will be deleted unless there are legal retention obligations or other legitimate reasons to the contrary.
Technical backups: Data that has already been deleted may temporarily remain in backups until the respective backup periods expire. You can find details in Section 8.

If personal data is no longer needed for the original purpose, we will check whether further storage is legally required or permissible. If this is not the case, the data will be deleted.

11. Rights of data subjects

If we process personal data about you, you have the following rights under the General Data Protection Regulation (GDPR):

Right of access (Art. 15 GDPR): You can request information about whether and which personal data we process about you.
Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate or the completion of incomplete personal data.
Right to erasure (Art. 17 GDPR): You can request the deletion of your personal data under the legal conditions.
Right to restriction of processing (Art. 18 GDPR): You can request that the processing of your data be restricted under certain conditions.
Right to data portability (Art. 20 GDPR): You can request that certain personal data be provided to you in a structured, commonly used, and machine-readable format or transmitted to another controller, provided that the legal requirements are met.
Right to object (Art. 21 GDPR): You can object at any time to processing based on Art. 6 para. 1 lit. f GDPR for reasons relating to your particular situation.
Right to withdraw consent (Art. 7 para. 3 GDPR): Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future. The lawfulness of processing until the withdrawal remains unaffected.

To exercise your rights or if you have questions about the processing of your personal data, you can contact us at maximilian@arktris.com.

We will process your request within the framework of the legal requirements. In principle, we will inform you no later than one month after receipt of your request about the measures taken. In cases provided for by law, this period may be extended.

12. Right to lodge a complaint with the Austrian Data Protection Authority

If you believe that the processing of your personal data violates the General Data Protection Regulation (GDPR), you have the right to lodge a complaint with a competent data protection supervisory authority in accordance with Art. 77 GDPR.

In Austria, this is:

Austrian Data Protection Authority

Barichgasse 40–42

1030 Vienna

Austria

Website: www.dsb.gv.at

The right to complain exists regardless of whether you have previously contacted us with your concerns. You can also contact another supervisory authority competent under Art. 77 GDPR.

13. Update of this privacy policy

We regularly review this privacy policy and adjust it as necessary, particularly when the processing of personal data, the technologies used on our website, or the legal framework changes.

The current version of this privacy policy is available on our website.

As of: October 2026