Privacy Policy

About this policy

Arda Aris Consulting, based in Amsterdam, Netherlands, explains here how personal information is handled when you visit this website, contact us or discuss a consulting engagement. This policy is written with reference to the EU General Data Protection Regulation (GDPR) and applicable Dutch data protection law. Separate contractual arrangements may apply when we process information on behalf of a client.

Who is responsible

Arda Aris Consulting is responsible for the personal information it processes for its own business purposes. For privacy questions or to exercise your rights, use the contact details on our Contact page and mark your request “Privacy”. Please describe your request without including unnecessary sensitive information.

Information you share with us

When you contact us, we may receive your name, business email address, company, role, service interests and the information in your message. During an engagement, relevant business correspondence, project records and billing details may also be required. Provide only information relevant to your request. Please do not send identity documents, financial account details or sensitive personal information in an initial enquiry.

Why we use personal information

We use enquiry information to respond, understand your needs and prepare proposals. Where you are a prospective contracting party, the legal basis is taking steps at your request before entering a contract. For communications with company representatives, we rely on our legitimate interest in managing business relationships, balanced against your rights. Contract performance supports the services agreed with individual clients; legal obligations support required accounting and compliance records. Where an activity requires consent, that consent is requested separately. An enquiry does not subscribe you to marketing.

Website hosting and technical information

This website is built and hosted with Framer. Delivering pages and maintaining reliable access can involve technical information, including network and device information. Framer describes its native website analytics as cookie-free. Additional services can have different privacy implications. Our Cookie Policy explains the distinction between essential technologies, analytics and optional third-party features.

Who may receive information

Information may be accessed by people who need it to respond to your request or deliver agreed services, and by providers supporting relevant hosting, communications or business administration. Access and disclosure must be limited to the purpose involved. We may also disclose information where required by law or necessary to establish, exercise or defend legal claims. We do not sell personal information.

International transfers

Our Amsterdam location does not mean that every provider processes information exclusively in the Netherlands. Where personal information is transferred outside the European Economic Area, the transfer must have a valid GDPR basis, such as an applicable adequacy decision or appropriate safeguards, including European Commission standard contractual clauses where relevant. You may contact us to ask about the safeguards applicable to your information.

How long information is kept

Retention depends on why information was collected. Enquiry correspondence is kept for the period needed to address the request and any relevant follow-up. Project and contractual records may be retained for the engagement and any applicable legal claim period. Records subject to Dutch tax retention requirements are generally kept for seven years, with longer periods for certain records where the law requires them. Information should be deleted or anonymised when there is no continuing purpose or legal requirement to keep it.

Security and confidentiality

Access should be restricted to people with a business need, using measures appropriate to the sensitivity and risks of the information. No website, email system or method of transmission can guarantee absolute security. If you believe information has been disclosed incorrectly, contact us promptly and avoid sending further sensitive material through the website. Confidential project information should be exchanged through channels agreed for the engagement.

Your privacy rights

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your personal information, and object to processing based on legitimate interests. You can withdraw consent at any time without affecting processing carried out lawfully before withdrawal. Rights are subject to applicable conditions and exceptions. We may request proportionate information to verify your identity. GDPR requests are normally answered within one month; a permitted extension of up to two further months will be explained within that first month. You may lodge a complaint with the Dutch Autoriteit Persoonsgegevens or another competent supervisory authority.

Information about other people

Our services and website are intended for business audiences. Please share another person’s information only where you have a lawful reason and authority to do so. The website is not directed at children and does not seek their personal information. Contact us if you believe information about a child has been provided so that the circumstances can be reviewed.

Questions and updates

For questions about this policy, retention or the handling of your information, visit our Contact page. We may update this policy to reflect changes in our services, legal requirements or data processing. The date above identifies the latest revision. Where required, material changes will be communicated through an additional notice.