Data Controller / Responsible Party

1. Legal Basis for Processing

We process your personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). The processing depends on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): If you have given us your express consent to process personal data for specific purposes (e.g., newsletter, contact via form). You can withdraw this consent at any time.
• Contract Fulfillment (Art. 6(1)(b) GDPR): Processing for the performance of a contract to which you are a party or for pre-contractual measures.
• Legal Obligation (Art. 6(1)(c) GDPR): Processing required to comply with a legal obligation (e.g., tax and commercial retention periods).
• Legitimate Interests (Art. 6(1)(f) GDPR): Processing necessary to protect our legitimate interests or those of a third party, unless your interests or fundamental rights and freedoms prevail (e.g., ensuring IT security, marketing, tracking for website optimization).

2. General information on data processing

We take the protection of your personal data very seriously. In this privacy policy, we inform you about the processing of your data when using the website www.arryasys.com. This website is built using HTML and CSS, and we use a small PHP script specifically for the secure processing of contact form inquiries.

3. Collection and use of personal data

a) When visiting the website

When you visit our website, the web server automatically creates log files. These contain information such as your IP address, the time of access, the page or file accessed, the browser used, and the operating system (Derivative Data). This data is used for security purposes and to analyze website usage. The legal basis for processing this data is Article 6(1)(f) GDPR, based on our legitimate interest in ensuring the security and improving the website.

b) Contact form

When you contact us via the contact form on our website, the data you enter (e.g., name, email address, message) will be processed for the purpose of handling your inquiry and for any follow-up questions. The legal basis for processing this data is Article 6(1)(b) GDPR if your inquiry relates to the performance of a contract or is necessary for taking steps prior to entering into a contract. In all other cases, the processing is based on our legitimate interest pursuant to Article 6(1)(f) GDPR in responding to your inquiry.

Data Retention: The data you enter in the contact form will remain with us until you ask us to delete it, revoke your consent to store it, or the purpose for storing the data no longer applies (e.g. after your request has been fully processed). Mandatory statutory provisions - especially retention periods under German commercial and tax law (usually 6 to 10 years) - remain unaffected.

4. External Hosting

Our website is hosted by Hostinger (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus). The personal data collected on this website is stored on Hostinger's servers. This mainly includes IP addresses, contact requests, metadata and communication data, website access, and other data generated via a website.

The use of Hostinger is for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast, and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR). We have concluded a Data Processing Agreement (DPA) with the provider to ensure compliance with European data protection standards.

4.1 SSL or TLS Encryption

This site uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the site operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4.2 Google reCAPTCHA

We use "Google reCAPTCHA" (hereinafter "reCAPTCHA") on this website. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

The purpose of reCAPTCHA is to determine whether data entered on this website (e.g., in a contact form) is entered by a human or by an automated program. For this purpose, reCAPTCHA analyzes the behavior of the website visitor based on various characteristics. This analysis starts automatically as soon as the website visitor enters the website. For the analysis, reCAPTCHA evaluates various information (e.g., IP address, how long the visitor has been on the website, or mouse movements made by the user). The data collected during the analysis is forwarded to Google.

The reCAPTCHA analyses take place completely in the background. Website visitors are not advised that such an analysis is taking place.

The storage and analysis of the data is based on Art. 6(1)(f) GDPR. We have a legitimate interest in protecting our web offerings from abusive automated spying and SPAM. If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR; the consent can be revoked at any time.

For more information on Google reCAPTCHA and Google's privacy policy, please see the following links: https://policies.google.com/privacy?hl=en and https://policies.google.com/terms?hl=en.

5. Use of cookies

Our website uses "strictly necessary" cookies. These are small text files stored on your device to ensure the technical functionality and user-friendliness of the website.

Specifically, we use the following cookies:

• arryasys_cookie_consent: This cookie is part of our cookie consent manager. It is used to remember your selection (e.g., Accept or Reject) so that you are not asked on every page visit. Duration: 1 year.
• Google reCAPTCHA Security Cookies (_GRECAPTCHA, SID, HSID, APISID, etc.): These third-party cookies are set by Google to provide security for our contact forms. They help detect and prevent malicious bot activity and perform risk analysis. If you are logged into a Google account, these cookies may also be used for security across Google services.

Cookie Consent Manager: We utilize a cookie consent widget that allows you to manage or reject non-essential cookies. You can view or change your preferences at any time by clicking the cookie icon at the bottom left corner of your screen. Currently, we only use strictly necessary cookies for security and system functionality. If non-essential scripts (such as tracking or marketing) are added in the future, they will not be loaded until you explicitly click "Accept All".

You can also prevent the storage of cookies by adjusting your browser settings, though this may degrade website performance.

The legal basis for the processing of functional/necessary cookies is Art. 6 para. 1 lit. f GDPR (legitimate interest in providing a flawless, secure service).

6. Data transfer to third parties

Your data will only be transferred to third parties if this is necessary to fulfill our contractual or legal obligations, or if you have given us your prior consent (Art. 6(1)(a) GDPR). Furthermore, we will not disclose your data to third parties unless we are legally obligated to do so.

6.1 Data transfer to countries outside the EU (India Office)

Our company has a branch office in Ahmedabad, India. We may transfer your processed data to this branch office for the purpose of handling your inquiry or application. India is considered a "third country" under the GDPR. However, we ensure a high level of data protection by using EU Standard Contractual Clauses (SCCs) to govern the security of such transfers, ensuring that your data remains protected according to European standards.

6.2 Social Media Links

Our website contains links to social media networks (e.g., LinkedIn, WhatsApp, X). These are simple links and not "plugins." No data is transferred to these providers as long as you do not click on these links. Once you click and are redirected, you leave our website, and the privacy policies of the respective providers apply.

7. Your rights

As a data subject, you have the following rights under the GDPR regarding your personal data:

• Right of access (Art. 15 GDPR): You can request information about your personal data processed by us.
• Right to rectification (Art. 16 GDPR): You can request the correction of incorrect or completion of your personal data stored by us.
• Right to erasure (Art. 17 GDPR): You can request the deletion of your personal data, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise, or defense of legal claims.
• Right to restriction of processing (Art. 18 GDPR): You can request the restriction of the processing of your personal data.
• Right to data portability (Art. 20 GDPR): You can receive your personal data in a structured, commonly used, and machine-readable format or request transmission to another controller.
• Right to object (Art. 21 GDPR): You have the right to object to the processing of your data based on legitimate interests.
• Right to withdraw consent (Art. 7 para. 3 GDPR): You can withdraw your consent at any time.

To exercise these rights, please contact us using the contact details provided in the "Data Controller" section above.

Furthermore, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) if you believe that the processing of your personal data violates the GDPR.

8. International Compliance (US/CCPA)

While our primary focus is the European market, we strive to comply with international standards. If you are a resident of California, the California Consumer Privacy Act (CCPA) may grant you additional rights regarding your data. We do not sell personal information to third parties.

9. Data processing for job applications

When you apply for a position via our Career page or email, we process the data you provide (e.g., CV, contact details) exclusively for the assessment of your suitability for the position and for the recruitment process (Art. 88 GDPR in connection with § 26 BDSG). Your data will be stored for a maximum of 6 months after the end of the application process unless you give us explicit consent to keep it in our talent pool for longer.

10. Changes to the Privacy Policy

We reserve the right to amend this privacy policy as needed to comply with current legal requirements or to reflect changes to our services. The new privacy policy will then apply to your next visit.

Last updated: 7th April 2026