2. Personal Data We Collect

2.1 Data You Provide Directly

When you interact with our services, we may collect:

• Full name and job title

• Business email address and, where provided, telephone number

• Organisation / employer name and country

• Payment and billing information (processed via third-party payment providers; we do not store raw card data)

• Correspondence and messages you send to our editorial or commercial team

• Account credentials if you register for a subscriber account

• Survey responses, event registrations, or research enquiries

2.2 Data Collected Automatically

When you visit arsenal.eu, our systems and third-party tools may automatically collect:

• IP address and approximate geolocation (country/city level)

• Browser type, version, and operating system

• Pages viewed, links clicked, and time spent on each page

• Referral source (how you arrived at our site)

• Device identifiers and screen resolution

• Cookie identifiers and similar tracking technologies (see Section 8)

2.3 Data From Third Parties

We may receive data about you from:

• Payment processors (transaction status and fraud-prevention signals)

• Analytics partners aggregating behavioural data

• Publicly available professional directories or social networks, where relevant to our editorial or commercial activities

3. Purposes and Legal Bases for Processing

We process personal data only where we have a valid legal basis under Article 6 GDPR. The table below sets out our primary processing activities:

4. Data Sharing and Disclosure

We may share data in the following circumstances:

4.1 Service Providers (Processors)

We engage trusted third-party processors who act on our instructions, including:

• Email delivery and newsletter platforms

• Payment processors (e.g. Stripe or equivalent — governed by their own GDPR-compliant policies)

• Website hosting and content delivery network (CDN) providers

• Analytics platforms (with data minimisation and IP anonymisation applied where possible)

• Customer relationship management (CRM) tools

4.2 Professional or Editorial Partners

We may share aggregated, anonymised readership statistics with commercial partners or sponsors. No individually identifiable data is disclosed in this context.

4.3 Legal and Regulatory Disclosure

We will disclose personal data where required by applicable law, court order, or competent regulatory authority. We will notify affected individuals where legally permissible before doing so.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our assets, personal data may be transferred to the successor entity. We will notify subscribers and provide options where feasible.

4.5 Commercial Data Partnerships

We may share personal data with selected third-party partners for commercial purposes, including sponsored research, market intelligence, and audience insight products. We will ensure an appropriate legal basis exists for any such sharing.

5. International Data Transfers

The Arsenal is incorporated and operates in the United States. This means that when you provide personal data to us or we collect it through your use of arsenal.eu, that data is transferred to and processed in the United States, which the European Commission has not recognised as providing an adequate level of data protection equivalent to the EEA.

Where we transfer personal data to the United States, we take steps to ensure appropriate safeguards are in place in accordance with applicable law.

We apply the same data protection standards described in this Policy regardless of where your data is processed.

Please be aware that US law (including national security laws such as FISA Section 702) may allow US authorities to access personal data held in the United States in circumstances broader than those permitted under GDPR. Our supplementary measures are designed to mitigate this risk, but cannot eliminate it entirely.

6. Data Retention

7. Your Rights Under the GDPR

You have the following rights in relation to your personal data. These rights may be subject to certain conditions and exemptions under applicable law:

• Right of access (Article 15): You may request a copy of the personal data we hold about you.

• Right to rectification (Article 16): You may ask us to correct inaccurate or incomplete data.

• Right to erasure (Article 17): You may ask us to delete your data in certain circumstances (‘right to be forgotten’).

• Right to restriction (Article 18): You may ask us to restrict processing of your data in certain circumstances.

• Right to data portability (Article 20): Where processing is based on consent or contract, you may receive your data in a structured, machine-readable format.

• Right to object (Article 21): You may object to processing based on legitimate interests or for direct marketing purposes. We will cease marketing processing upon receipt of your objection.

• Rights related to automated decision-making (Article 22): We do not make solely automated decisions producing significant legal or similar effects.

• Right to withdraw consent: Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month. We may ask you to verify your identity before fulfilling a request. There is no charge for exercising your rights.

You have the right to lodge a complaint with the data protection supervisory authority in your Member State.

8. Cookies and Tracking Technologies

We use cookies and similar technologies (including pixels and local storage) to operate and improve our website. Cookies are small text files placed on your device.

8.1 Categories of Cookies We Use

• Strictly necessary cookies: Essential for the website to function (e.g. session management, paywall access). These do not require your consent.

• Analytics cookies: Help us understand how visitors interact with our site (e.g. Google Analytics or equivalent). We apply IP anonymisation. These are set only with your consent.

• Preference cookies: Remember your settings and choices. Set with your consent.

• Marketing / targeting cookies: Used to deliver relevant content or measure campaign effectiveness. Set only with your explicit consent.

8.2 Managing Your Cookie Preferences

When you first visit arsenal.eu, you will be presented with a cookie consent banner allowing you to accept, reject, or customise non-essential cookies. You may change your preferences at any time via the “Cookie Settings” link in the website footer.

You may also manage cookies via your browser settings. Note that disabling certain cookies may affect website functionality.

For more information about cookies, visit allaboutcookies.org.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction, including:

• Transport Layer Security (TLS/HTTPS) encryption for all data in transit

• Access controls limiting data access to authorised personnel on a need-to-know basis

• Periodic review of our security practices.

• Secure deletion procedures for data no longer required

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Article 33 and 34 GDPR.

10. Children’s Data

11. Contact and Data Controller Details

11.1 Data Controller

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

11.2 EU Representative (Article 27 GDPR)

As a US-based controller subject to GDPR, we have designated an EU Representative. EEA residents may contact our EU Representative directly regarding data protection matters:

If your query relates to your rights under GDPR, please use the subject line “GDPR Request” to ensure prompt routing. We will respond within one calendar month.

12. Changes to This Policy