2. Personal Data We Collect

2.1 Data You Provide Directly

When you interact with our services, we may collect:

• Full name and job title

• Business email address and, where provided, telephone number

• Organisation / employer name and country

• Payment and billing information (processed via third-party payment providers; we do not store raw card data)

• Correspondence and messages you send to our editorial or commercial team

• Account credentials if you register for a subscriber account

• Survey responses, event registrations, or research enquiries

2.2 Data Collected Automatically

When you visit arsenal.eu, our systems and third-party tools may automatically collect:

• IP address and approximate geolocation (country/city level)

• Browser type, version, and operating system

• Pages viewed, links clicked, and time spent on each page

• Referral source (how you arrived at our site)

• Device identifiers and screen resolution

• Cookie identifiers and similar tracking technologies (see Section 8)

2.3 Data From Third Parties

We may receive data about you from:

• Payment processors (transaction status and fraud-prevention signals)

• Analytics partners aggregating behavioural data

• Publicly available professional directories or social networks, where relevant to our editorial or commercial activities

3. Purposes and Legal Bases for Processing

We process personal data only where we have a valid legal basis under Article 6 GDPR. The table below sets out our primary processing activities:

4. Data Sharing and Disclosure

We may share data in the following circumstances:

4.1 Service Providers (Processors)

We engage trusted third-party processors who act on our instructions, including:

• Email delivery and newsletter platforms

• Payment processors (e.g. Stripe or equivalent — governed by their own GDPR-compliant policies)

• Website hosting and content delivery network (CDN) providers

• Analytics platforms (with data minimisation and IP anonymisation applied where possible)

• Customer relationship management (CRM) tools

4.2 Professional or Editorial Partners

We may share aggregated, anonymised readership statistics with commercial partners or sponsors. No individually identifiable data is disclosed in this context.

4.3 Legal and Regulatory Disclosure

We will disclose personal data where required by applicable law, court order, or competent regulatory authority. We will notify affected individuals where legally permissible before doing so.

4.4 Business Transfers

In the event of a merger, acquisition, or sale of all or part of our assets, personal data may be transferred to the successor entity. We will notify subscribers and provide options where feasible.

4.5 Commercial Data Partnerships

We may share personal data with selected third-party partners for commercial purposes, including sponsored research, market intelligence, and audience insight products. We will ensure an appropriate legal basis exists for any such sharing.

You may opt out of such sharing at any time — see Section 5.2

5. International Data Transfers

The Arsenal is operated by The Counteroffensive Media Worldwide LLC, which is incorporated and operates in the United States. This means that when you provide personal data to us or we collect it through your use of arsenal.eu, that data is transferred to and processed in the United States.

Where we transfer personal data to the United States, we take steps to ensure appropriate safeguards are in place in accordance with applicable law. Except as specified below, the data privacy laws of the United States may not necessarily provide equivalent legal protection to the laws of the jurisdiction where you reside. We apply the same data protection standards described in this Policy regardless of where your data is processed.

5.1 Our Participation in the Data Privacy Framework

To safeguard the import of personal information from the European Economic Area (EEA), and the United Kingdom, The Counteroffensive Media Worldwide LLC (operating as The Arsenal) has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework Program, and to view our certification, please visit the Data Privacy Framework website at https://www.dataprivacyframework.gov/s/participant-search.

5.2 Commitment to Principles & FTC Jurisdiction

We have certified to the U.S. Department of Commerce that we adhere to the DPF Principles with regard to the processing of personal information received from the EEA and UK, in reliance on the relevant DPF. Our compliance with the DPFs is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

In line with the DPF Principles, you can opt out of us (i) disclosing your personal data to third parties (other than service providers acting on our instructions), or (ii) using your personal data for a purpose materially different from the one it was collected for. To opt out at any time, email [email protected] with the subject line “Opt-Out Request.” Opting out is free, and we will honor your request promptly.

We do not intentionally collect sensitive personal data. If we ever needed to process such data, we would first obtain your express opt-in consent before disclosing it to a third party or using it for a new purpose.

5.3 Law Enforcement Disclosures

The Counteroffensive Media Worldwide LLC may be required by law to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

5.4 Onward Transfers & Liability

We are accountable for the onward transfer of personal information received under a DPF, and only transfer this information under agreements providing the same protections as the DPF. The Counteroffensive Media Worldwide LLC remains liable under the DPF Principles if a third-party agent processes personal data covered by this Privacy Policy in a manner inconsistent with the Principles, except where we can prove we are not responsible for the event giving rise to the damage.

5.5 Dispute Resolution

If there is a dispute between you and us regarding our use of personal information under a DPF, we ask that you raise the dispute with us directly by emailing us at [email protected].

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, The Counteroffensive Media commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit: https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

5.6 Binding Arbitration

If you have a “residual claim” regarding our use of your personal information under a DPF that is unresolved after (i) direct contact with us; (ii) your use of the independent dispute resolution mechanism identified above; and (iii) your raising the issue with your data protection authority, you have the right to seek redress through binding arbitration in accordance with the applicable DPF.

6. Data Retention

7. Your Rights Under the GDPR

You have the following rights in relation to your personal data. These rights may be subject to certain conditions and exemptions under applicable law:

• Right of access (Article 15): You may request a copy of the personal data we hold about you.

• Right to rectification (Article 16): You may ask us to correct inaccurate or incomplete data.

• Right to erasure (Article 17): You may ask us to delete your data in certain circumstances (‘right to be forgotten’).

• Right to restriction (Article 18): You may ask us to restrict processing of your data in certain circumstances.

• Right to data portability (Article 20): Where processing is based on consent or contract, you may receive your data in a structured, machine-readable format.

• Right to object (Article 21): You may object to processing based on legitimate interests or for direct marketing purposes. We will cease marketing processing upon receipt of your objection.

• Rights related to automated decision-making (Article 22): We do not make solely automated decisions producing significant legal or similar effects.

• Right to withdraw consent: Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month. We may ask you to verify your identity before fulfilling a request. There is no charge for exercising your rights.

You have the right to lodge a complaint with the data protection supervisory authority in your Member State.

8. Cookies and Tracking Technologies

We use cookies and similar technologies (including pixels and local storage) to operate and improve our website. Cookies are small text files placed on your device.

8.1 Categories of Cookies We Use

• Strictly necessary cookies: Essential for the website to function (e.g. session management, paywall access). These do not require your consent.

• Analytics cookies: Help us understand how visitors interact with our site (e.g. Google Analytics or equivalent). We apply IP anonymisation. These are set only with your consent.

• Preference cookies: Remember your settings and choices. Set with your consent.

• Marketing / targeting cookies: Used to deliver relevant content or measure campaign effectiveness. Set only with your explicit consent.

8.2 Managing Your Cookie Preferences

When you first visit arsenal.eu, you will be presented with a cookie consent banner allowing you to accept, reject, or customise non-essential cookies. You may change your preferences at any time via the “Cookie Settings” link in the website footer.

You may also manage cookies via your browser settings. Note that disabling certain cookies may affect website functionality.

For more information about cookies, visit allaboutcookies.org.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction, including:

• Transport Layer Security (TLS/HTTPS) encryption for all data in transit

• Access controls limiting data access to authorised personnel on a need-to-know basis

• Periodic review of our security practices.

• Secure deletion procedures for data no longer required

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware, and affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Article 33 and 34 GDPR.

10. Children’s Data

11. Contact and Data Controller Details

11.1 Data Controller

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

11.2 EU Representative (Article 27 GDPR)

We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:

• European Union (EU)

Prighter gives you an easy way to exercise your privacy-related rights (e.g. requests to access or erase personal data). If you want to contact us via our representative, Prighter or make use of your data subject rights, please visit the following website: https://app.prighter.com/portal/14383929232

If your query relates to your rights under GDPR, please use the subject line “GDPR Request” to ensure prompt routing. We will respond within one calendar month.

12. Changes to This Policy