Privacy Policy

This Privacy Policy explains how ArNaFoundry collects, uses, stores, and protects personal data when you visit arnafoundry.com or interact with us through the website. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Dutch Implementation Act (UAVG).

1. Who we are

This website is operated by ArNaFoundry, a sole proprietorship registered in the Netherlands and trading in the name of Himanshu Bahl.

• Trading name: ArNaFoundry
• Owner: Himanshu Bahl
• Address: Amsterdam, Netherlands
• KVK (Chamber of Commerce) number: 42054847
• BTW (VAT) number: NL005459261B37
• Contact: contact@arnafoundry.com

For the purposes of the GDPR, ArNaFoundry is the data controller for any personal data you provide through this website.

2. What information we collect

We try to collect as little personal data as possible. The data we do collect falls into the following categories.

2.1 Information you give us directly

When you fill in the contact form on the site, you provide us with your name, email address, and the content of your message. The form sends these details to contact@arnafoundry.com and we receive them as an email; we do not write contact form submissions to a database.

When you submit feedback through the feedback widget, you provide the content of your feedback and, optionally, your email address if you would like a reply. Email is never required.

2.2 Information collected automatically

To keep the site secure and to prevent abuse, our server temporarily processes a one-way HMAC-hashed version of your IP address when you submit feedback. This pseudonymous fingerprint is used only for short-window rate-limiting and is automatically deleted within one hour. The original IP address is not retained.

When you click a download link on the Frameworks page, our server increments an anonymous counter for that document. The counter records only how many times each document has been downloaded; it does not record who downloaded it, when, or from where.

Our hosting provider, TransIP, generates standard web server access logs that include your IP address, the page requested, the time of the request, your browser user-agent, and the referring page. These logs exist for security, troubleshooting, and abuse prevention and are retained according to TransIP's standard retention period (typically up to 90 days).

2.3 Cookies and similar technologies

arnafoundry.com sets a single functional cookie, named lang, and only when you actively use the language switcher: it remembers whether you prefer to read the site in English or Dutch, for up to twelve months. It contains no identifier and is not used for tracking. Beyond that, the site does not set tracking cookies or use third-party analytics: no Google Analytics, Meta Pixel, advertising trackers, or similar technologies. See our Cookie Policy for more detail.

3. Why we use your information and the legal basis

We use the data described above for the following purposes, each with a corresponding lawful basis under Article 6 of the GDPR.

• To respond to your enquiry when you submit the contact form. Lawful basis: taking steps at your request prior to entering a contract (Art. 6(1)(b)) and our legitimate interest in conducting business correspondence (Art. 6(1)(f)).
• To consider your feedback when you use the feedback widget. Lawful basis: legitimate interest in improving the website (Art. 6(1)(f)).
• To prevent spam, brute-force submissions, and abuse through short-window rate limiting on the feedback widget. Lawful basis: legitimate interest in protecting the site (Art. 6(1)(f)).
• To measure aggregate interest in our published frameworks through anonymous download counters. Lawful basis: legitimate interest in understanding which materials are useful (Art. 6(1)(f)). No personal data is processed for this purpose.
• To operate, secure, and troubleshoot the website through standard server logs. Lawful basis: legitimate interest in keeping the service available and secure (Art. 6(1)(f)).

We do not use your personal data for advertising, profiling, or automated decision-making with legal effects.

4. How long we keep your information

• Contact form submissions received by email: retained in our mailbox for up to 24 months from last contact, after which they are deleted unless they relate to an active engagement or commercial relationship.
• Feedback submissions: retained for up to 24 months for the purpose of reviewing and acting on the feedback, then deleted.
• HMAC-hashed IP fingerprints used for rate limiting: automatically deleted within one hour of being created.
• Anonymous download counts: retained indefinitely; this data is aggregate and does not relate to any identifiable individual.
• Server access logs: retained according to TransIP's standard retention period, typically up to 90 days.

5. Who we share your information with

We do not sell your personal data and we do not share it with third parties for marketing. We rely on a small number of service providers (data processors) who help us operate the website. These are:

• TransIP B.V. — hosting, email delivery, and server logs. TransIP is a Dutch company; data is hosted within the European Union.
• Google LLC (Gmail) — the contact@arnafoundry.com mailbox forwards messages to a Gmail inbox we monitor. Email content may therefore be processed by Google on servers that include locations outside the European Economic Area; Google operates under EU Standard Contractual Clauses and the EU–US Data Privacy Framework.

If we engage additional processors in future (for example, an analytics provider or a CMP for cookie consent), we will update this Privacy Policy before doing so.

6. International transfers

Where personal data is transferred outside the European Economic Area — for example, when our contact mailbox forwards email to Gmail — we rely on the recipient's adherence to the EU–US Data Privacy Framework and on EU Standard Contractual Clauses as the legal mechanism for transfer, in line with Articles 45 and 46 of the GDPR.

7. Your rights

Under the GDPR you have the following rights with respect to your personal data:

• Right of access (Art. 15) — to obtain confirmation of whether we hold personal data about you and a copy of that data.
• Right to rectification (Art. 16) — to ask us to correct inaccurate or incomplete data.
• Right to erasure (Art. 17) — to ask us to delete your personal data, subject to limited exceptions.
• Right to restriction (Art. 18) — to ask us to limit the processing of your data.
• Right to data portability (Art. 20) — to receive your data in a structured, commonly used, machine-readable format.
• Right to object (Art. 21) — to object to processing based on our legitimate interests.
• Right to withdraw consent — where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email us at contact@arnafoundry.com. We will respond within one month, in line with Article 12 of the GDPR. There is no charge for exercising your rights.

8. Lodging a complaint

If you believe we have not handled your personal data lawfully, you have the right to lodge a complaint with the Dutch supervisory authority:

You may also lodge a complaint with the supervisory authority in your EU/EEA country of residence.

9. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. The website is served over HTTPS with HSTS-style canonical redirects, and submission endpoints validate input and reject malformed submissions. The feedback widget additionally enforces origin checks, honeypot, minimum-time, and IP-based rate limiting. Operational access to the mailbox and hosting account is protected by strong passwords and two-factor authentication.

No method of transmission over the internet is fully secure. If you become aware of a security issue, please contact us immediately at contact@arnafoundry.com.

10. Children

arnafoundry.com is a professional portfolio and consultancy site intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example when we change the way the website works or engage a new service provider. The "Effective date" at the top of this page reflects the most recent revision. Material changes will be highlighted on this page; we recommend you review the policy occasionally.

12. Contact

If you have any questions about this Privacy Policy or how we handle your personal data, please email contact@arnafoundry.com.