Privacy Policy

This Privacy Policy explains how Aroneu processes personal data when you visit our website, contact us, book a call, or apply for a role. It also explains your rights under applicable data protection law.

This policy applies to the public Aroneu website and related website forms. It does not replace any separate commercial agreement, data processing agreement, or client contract that may apply to a client engagement.

1. Who is responsible for your data

The controller responsible for this website is:

Aroneu GmbH
Spessartring 16
64287 Darmstadt
Germany
Email: sales@aroneu.com
Phone: +49 6196 9994 165

For general website enquiries, you may also contact us through the contact form on this website.

2. What this policy covers

We process personal data when you interact with Aroneu through this website. This may include data from:

• website visits,
• contact forms,
• call booking or scheduling tools,
• job applications,
• email communication,
• security and spam-prevention systems.

We only process personal data where there is a lawful reason to do so.

3. Data we process when you visit the website

When you visit the website, our hosting and security systems may process technical data automatically. This may include IP address, browser type and version, device information, pages visited, date and time of access, referring website, error logs, and security logs.

We use this data to operate the website, keep it secure, diagnose errors, prevent misuse, and improve performance.

Legal basis: our legitimate interest in operating a secure and reliable website, Art. 6(1)(f) GDPR.

4. Data we process when you contact us

When you submit a contact form or send us an enquiry, we process the information you provide. This may include full name, work email, phone, company, role, reason for contact, message, and communication history.

We use this data to respond to your enquiry, prepare next steps, and manage the business relationship.

Legal basis: pre-contractual or contractual necessity, Art. 6(1)(b) GDPR, where your enquiry relates to a potential business relationship; legitimate interest, Art. 6(1)(f) GDPR, where we respond to business enquiries and manage professional communication.

5. Data we process when you book a call

If you use a scheduling tool to book a call with Aroneu, we process the information needed to arrange and manage the meeting. This may include name, email address, company, meeting time, meeting notes, time zone, calendar metadata, and technical data collected by the scheduling provider.

Scheduling provider: Cal.eu — the European instance of Cal.com, on which booking data is stored and processed within the European Union.

Legal basis: pre-contractual or contractual necessity, Art. 6(1)(b) GDPR; legitimate interest in organising business meetings, Art. 6(1)(f) GDPR.

Where the scheduling provider nonetheless processes or accesses data outside the European Economic Area, we rely on appropriate safeguards, such as Standard Contractual Clauses or other legally recognised mechanisms.

6. Data we process when you apply for a role

If you apply for a role at Aroneu or join our talent network, we process the data needed to review and manage your application. This may include full name, email address, phone number, location, CV, role targeted, experience, application message, and communication history.

Legal basis: pre-contractual necessity, Art. 6(1)(b) GDPR; employment-related data processing under Art. 88 GDPR and applicable German employment data rules, including BDSG Section 26 where applicable; consent, Art. 6(1)(a) GDPR, if you agree to be considered for future roles or join a talent pool.

7. Cookies, consent, and similar technologies

We set no advertising or tracking cookies, and no analytics cookies. The information this website stores on your device is limited to your light or dark theme choice and the record of your consent decision, both kept in your browser’s local storage.

We do ask for your consent, because two things we would like to do are not necessary for the website to work: measuring how the site is used, and loading video players hosted by YouTube and Vimeo. A banner asks once, accepting and declining are offered as equal choices, and the Privacy settings link in the footer reopens it on any page so you can change your answer.

Declining costs you nothing: every page, every document and every form works identically either way.

You can find more detail in our Cookie Policy.

8. Audience measurement

If you accept the “Audience measurement” category, we use Plausible Analytics to understand, in aggregate, which pages people visit and where they arrive from. Plausible is a privacy-first, cookieless analytics service: it sets no cookies, stores nothing on your device, does not track you across websites or over time, and does not collect or retain personal data. It produces only aggregate counts — page views, referrers, country, device type — from which you cannot be identified. No visitor profile is built, and no data is sold or shared for advertising.

Plausible is operated by Plausible Insights OÜ (Estonia), and the analytics data for this website is hosted on servers within the European Union.

Because Plausible stores and reads nothing on your device, we would be entitled to run it without asking. We ask anyway, and nothing loads unless you accept.

Legal basis: your consent, Art. 6(1)(a) GDPR. You may withdraw it at any time with effect for the future.

8a. Layout and usability measurement

If you accept the “Layout and usability” category, we record where visitors click and how far down a page they scroll, so we can find parts of a page that do not work.

This runs on our own server; no third party is involved and no cookie is used. For each interaction we store the page address, the position of the click within the page and within the element clicked, the size of the browser window, and the time. We classify the window size into “mobile”, “tablet” or “desktop”.

We deliberately do not store your IP address, your browser’s user-agent string, any cookie, any session or visitor identifier, or anything else that links one interaction to another or to you. The records are anonymous in the strict sense: we hold nothing that would let us pick yours out of the set. That also limits what we can do for you — a request to access or erase these particular records cannot be fulfilled, because there is no identifier to search by. Records are deleted automatically 90 days after they are made.

Legal basis: your consent, Art. 6(1)(a) GDPR, together with Section 25(1) TTDSG for reading information from your device. You may withdraw it at any time with effect for the future.

8b. Video embeds

Some Academy and article pages carry a YouTube or Vimeo player. Until you accept the “Video embeds” category, nothing is requested from those services — not the player, not a preview image — so they do not learn that you visited the page. We show a placeholder instead, and you can load a single video without changing your choice for the rest of the site.

Once a player loads, the provider receives your IP address and may set its own cookies under its own terms. We use the privacy-enhanced variants (youtube-nocookie.com; Vimeo with do-not-track set), which reduce but do not remove that.

YouTube is operated by Google Ireland Limited, Vimeo by Vimeo.com, Inc. (United States). A transfer to the United States is possible once a Vimeo player loads; see section 12.

Legal basis: your consent, Art. 6(1)(a) GDPR, and Art. 49(1)(a) GDPR for any resulting transfer.

9. Security and spam prevention

We use security measures to protect forms, prevent spam, and detect automated misuse. This may involve processing technical signals such as IP address, browser information, and interaction patterns. These protections run on our own infrastructure — for example, hidden form fields and request rate limiting; we do not currently use a third-party spam-prevention provider.

Legal basis: our legitimate interest in protecting the website, forms, and systems from misuse, Art. 6(1)(f) GDPR.

10. Business communication

When you contact Aroneu or apply for a role, your message and details are received and stored in our own email system so we can review your enquiry, keep business communication organised, and follow up on relevant conversations. We do not currently use a third-party CRM.

11. Processors and service providers

We keep external service providers to a minimum. We currently use:

• Cal.eu (the European instance of Cal.com) — booking and scheduling, hosted within the European Union, used only when you choose to book a call.
• Plausible Insights OÜ — cookieless website analytics, hosted in the European Union, used only if you accept the “Audience measurement” category.
• Google Ireland Limited (YouTube) and Vimeo.com, Inc. — video players, loaded only if you accept the “Video embeds” category and only on pages that carry a video.

Layout and usability measurement involves no processor at all: it runs on the same infrastructure that serves this website.

Website hosting and form email run on Aroneu’s own infrastructure within the European Economic Area, rather than through a third-party host, CRM, or email provider. If we add further processors (for example, a CRM), we will list them here and, where required, put appropriate contractual and data-protection safeguards in place.

12. International data transfers

The service providers we use for this website process data within the European Union. Authorised Aroneu personnel in India may, however, access personal data where needed for business communication, support, or recruitment.

Where personal data is processed or accessed outside the European Economic Area, Aroneu uses appropriate safeguards where required, such as contractual safeguards, access controls, and technical and organisational measures. See our Data Residency page for more detail.

13. Data we receive from others

In some cases, we may receive your business contact details from a colleague, partner, client, referral source, event contact, or public professional source. We use this data only where there is a lawful reason to do so.

Legal basis: legitimate interest, Art. 6(1)(f) GDPR, unless another legal basis applies. You may object to this processing at any time.

14. How long we keep personal data

Retention periods depend on the type of data and the reason for processing. Job application data is kept only for as long as needed for the recruitment process, unless a longer period is legally required or the applicant has separately agreed to future-role consideration. Layout and usability records (section 8a) are deleted automatically 90 days after they are made. Where data is no longer needed, we delete it or anonymise it where appropriate.

15. Your rights

Under applicable data protection law, you may have the right to:

• request access to your personal data,
• request correction of inaccurate data,
• request deletion of your data,
• request restriction of processing,
• object to processing based on legitimate interest,
• request data portability,
• withdraw consent at any time,
• lodge a complaint with a supervisory authority.

To exercise your rights, contact us at sales@aroneu.com. We may need to verify your identity before responding to a request. Withdrawing consent does not affect processing that took place before the withdrawal.

16. Right to object

Where we process personal data based on legitimate interest, you may object to that processing on grounds relating to your particular situation. You may also object to direct marketing at any time; after an objection, we will stop using your data for that purpose.

17. Security

We use technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, role-based permissions, secure hosting practices, encrypted transmission, internal confidentiality rules, and security monitoring.

No website or digital system can be guaranteed to be completely secure. We therefore review and improve safeguards as the website and systems develop.

18. External links

This website may contain links to external websites or third-party services. We are not responsible for how third-party websites process personal data. Please review the privacy policy of the relevant third-party service before submitting personal data there.

19. Children

This website is intended for business users, prospective clients, partners, applicants, and professional visitors. It is not directed at children.

20. Changes to this Privacy Policy

We may update this Privacy Policy when our website, technology stack, services, legal requirements, or processing activities change. The latest version will always be published on this page.

21. Contact

For privacy questions or data-protection requests, contact:

Aroneu GmbH
Email: sales@aroneu.com
Phone: +49 6196 9994 165