Last updated: 28/07/2026
The controller responsible for data processing on this website is:
ARC Consultancy e.K. [Insert street and house number] [Insert postcode and city] Germany
Email: info@arcconsultancy.de Phone: +49 176 92351589
[If applicable, insert commercial register number and registering court]
A data protection officer is [not appointed / can be reached at: …] — please check whether appointment is mandatory under § 38 BDSG (German Federal Data Protection Act).
We process personal data of our users only to the extent necessary to provide a functional website along with our content and services. Processing generally takes place only with the user’s consent, or where otherwise permitted by law.
Where we obtain consent for processing operations, Art. 6(1)(a) GDPR serves as the legal basis. Where processing is necessary for the performance of a contract or pre-contractual measures (e.g. inquiries about our consulting services), Art. 6(1)(b) GDPR is the legal basis. Where processing is necessary to safeguard a legitimate interest (e.g. traffic analysis, IT security), Art. 6(1)(f) GDPR is the legal basis.
Personal data is deleted or blocked as soon as the purpose of storage no longer applies, unless statutory retention obligations (in particular German commercial and tax law retention periods under the HGB and AO) require otherwise.
Every time our website is accessed, our system automatically collects data and information from the visitor’s computer system, including:
This data is stored in log files. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technically error-free provision and security of our website. This data is deleted once it is no longer required for this purpose, typically after [e.g. 7 or 30] days.
Our website is hosted by [insert hosting provider, e.g. Hostinger]. As part of a data processing agreement under Art. 28 GDPR, this provider processes on our behalf all data collected through the use of this website. [Add the provider’s location/server location, and, if servers are outside the EU/EEA, a note on the transfer mechanism, e.g. Standard Contractual Clauses.]
If you send us an inquiry via the contact form on our website, the details you provide in the form — including the contact information you supply (e.g. first name, last name, email address, grade level, country, requested service, and your message) — will be stored by us for the purpose of processing your inquiry and in case of follow-up questions.
The legal basis for this processing is Art. 6(1)(b) GDPR where your inquiry relates to the performance of a contract or is necessary for pre-contractual measures. In all other cases, processing is based on our legitimate interest in efficiently handling inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), where such consent has been requested.
Data submitted via the contact form remains with us until you ask us to delete it, you withdraw your consent to its storage, or the purpose for storing it no longer applies. Statutory retention periods remain unaffected.
Our website offers a link for contacting us via WhatsApp (provider: WhatsApp Ireland Limited / Meta Platforms Ireland Limited). If you use this link, the WhatsApp application opens and a direct connection is established with our WhatsApp Business number. Messages exchanged and your phone number are processed by WhatsApp, which may involve a transfer of data to the US or other third countries. WhatsApp/Meta’s privacy notice applies: https://www.whatsapp.com/legal/privacy-policy
The legal basis is your consent, given by actively clicking the link (Art. 6(1)(a) GDPR). [Consider whether a separate, informed consent step should be added before redirecting, since the use of WhatsApp Business raises unresolved data-protection questions under German/European law.]
Our website uses cookies. Cookies are small text files stored on your device. Strictly necessary cookies are stored on the basis of Art. 6(1)(f) GDPR; our legitimate interest lies in the technically error-free provision of our website. Where cookies are used for analytics or marketing purposes, this only occurs on the basis of your consent (Art. 6(1)(a) GDPR), which you can grant or withdraw via our cookie consent banner.
We use Google Tag Manager (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google Tag Manager is a service that allows website tags to be managed through one interface. The Tag Manager itself does not set cookies or collect personal data; it only triggers other tags (e.g. analytics or marketing tags), which may themselves collect data. [Add which specific tags are actually fired via GTM-W4BRF3SF — e.g. Google Analytics, Meta Pixel, conversion tracking — and complete or remove the corresponding sections below. Any consent-requiring tags must only fire after consent has been given.]
[If Google Analytics is used, add here: purpose, legal basis (consent), IP anonymization, data processing agreement with Google, opt-out option, storage period.]
[If a Meta or LinkedIn tracking pixel is used, add here: purpose, transfer of data to the US, legal basis (consent), opt-out option.]
Our website contains links to our profiles on Instagram (instagram.com/arcconsultancy_ek) and LinkedIn (linkedin.com/company/arc-consultancy-e-k). These are plain hyperlinks (not embedded social plugins); no automatic data exchange with these providers occurs when you visit our page. Only if you actively click one of these links will you be redirected to the respective platform, where that provider’s privacy policy applies:
Our consultations take place online via Zoom, Google Meet, and/or Microsoft Teams. If you take part in a session, your data (e.g. name, email address, and possibly video/audio data during the call) is processed by the relevant provider. The respective provider’s privacy notice applies in addition to this policy:
The legal basis is the performance or initiation of a consulting agreement with you (Art. 6(1)(b) GDPR).
This site uses SSL/TLS encryption for security reasons. You can recognize an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock icon in your browser bar.
As a data subject, you have the following rights regarding your personal data:
To exercise these rights, you can contact us at any time using the contact details provided above.
We reserve the right to amend this privacy policy so that it always complies with current legal requirements, or to reflect changes to our services in the policy. Your renewed visit to the site will then be governed by the updated policy.
Important note: This is a draft, not legal advice. The items marked in [brackets] (address, hosting provider, actual tracking tools used, competent supervisory authority) must be filled in with real details before publishing. Since ARC Consultancy addresses minors (school students) and processes application-related data, I’d recommend having this draft reviewed by a lawyer specializing in IT/data protection law before going live — particularly regarding consent from minors or their guardians (Art. 8 GDPR) and a compliant cookie-consent tool.
