Privacy Policy
How we process personal data on this website. Last updated: 2026-07-21.
Controller and contact
ARBA International B.V., operating as ARBA Agency, is the controller. Registration: KvK 67880657. Address: Van Heuven Goedhartlaan 13D, 1181 LE Amstelveen, The Netherlands.
For privacy questions or requests, email [email protected].
Data we process
Depending on how you use the website, we process:
- contact and business details you enter, such as name, work email, phone or Telegram, company or clinic, role and website
- the content of your inquiry, selected service or product, and any files or messages you choose to send
- form metadata such as IP address, browser user agent, page URL, referrer, UTM parameters, language and submission time
- Aptus demo identifiers, locale, activity timestamps, chat messages and demo events when you start or use the demo
- your separate marketing choice and the version and language of the notice shown with the form
Purposes and legal bases
- To answer an inquiry and take steps you request before a possible contract: Article 6(1)(b) GDPR; where you contact us on behalf of an organization, our legitimate interest in business communication under Article 6(1)(f)
- To protect forms, systems and users from spam, fraud and security incidents, maintain logs and diagnose faults: our legitimate interests under Article 6(1)(f)
- To route and prioritize business inquiries using rule-based lead scoring: our legitimate interest in handling requests efficiently under Article 6(1)(f). A person decides how to follow up; we do not make solely automated decisions that produce legal or similarly significant effects
- To provide the Aptus demo and preserve its session after you start it: taking the action you request and our legitimate interest in demonstrating the product under Article 6(1)(b) or 6(1)(f), as applicable
- To send ARBA news and offers by email: your consent under Article 6(1)(a), only when you tick the separate optional box. You may withdraw it at any time without affecting earlier processing
Required and optional information
Fields marked as required are needed for us to identify and answer your request; without them we cannot submit or respond to it. Other fields and the marketing checkbox are optional. Sending an inquiry is not conditional on marketing consent.
Do not send patient data, health information, passwords, trade secrets or other sensitive or confidential information through public forms or the Aptus demo.
Recipients and service providers
Access is limited to ARBA personnel who need the information. We also use providers acting for us for hosting, content delivery and security, database storage, CRM, operational notifications and messaging (including Telegram), and Aptus demo infrastructure. Professional advisers, public authorities or counterparties may receive data where required to establish, exercise or defend legal claims or comply with law.
Google Maps is not loaded until you click the map button. If you load it, Google receives technical connection data and processes it under its own terms and privacy policy.
We do not sell personal data.
International transfers
Some providers may process data outside the European Economic Area. Where required, we rely on an adequacy decision or appropriate safeguards such as the European Commission's Standard Contractual Clauses. Contact us to ask about the safeguard relevant to your data.
Retention
We keep an inquiry while it is active and afterwards only while follow-up can reasonably be expected or the record is needed for contractual, accounting, security or legal-claim obligations. Marketing contact data is kept until consent is withdrawn; a minimal suppression record may then be retained so we respect the withdrawal. Security logs are kept for the limited operational period needed to investigate abuse or an incident. The Aptus functional cookie expires 30 days after the latest activity; demo records are kept only for the operation, support and evaluation of the demo. Data is then deleted or anonymized, subject to backup replacement cycles and legal duties.
Your rights
Subject to applicable conditions, you may request access, correction, deletion, restriction and data portability, object to processing based on legitimate interests, and withdraw consent at any time. Email [email protected]. We normally respond within one month and may ask for information needed to verify your identity.
You may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority where you live or work.
Cookies and changes
The Cookie Policy explains browser storage and third-party content. We update this policy when our practices change and show the revision date above.