Privacy Policy

1. Scope

This Privacy Policy explains how we process your personal data when you interact with Arkko through its website and communications that refer to this policy.

The policy describes the processing associated with the features available at any given time. Currently, arkko.io lets you learn about Arkko, request updates and contact us. If we introduce services or purposes involving other processing, we will update this information before collecting or using data for them.

2. Data controller

Arkko is the brand used by the data controller identified below.

Controller

Ángel Luis Gallegos Martín

Address

Calle Cardenal Cisneros, 25, piso 2, puerta C 47010 Valladolid (Valladolid) Spain

Email

legal@arkko.io

3. Data we process and its sources

• Contact data: your email address and, if you choose to provide it, your name.
• Sign-up and consent data: language, request and confirmation dates, consent given, and whether your sign-up is confirmed or you have unsubscribed.
• Technical and security data: IP address, technical browser information, and codes derived from email and IP addresses used to limit repeated requests and prevent abuse.
• Communications and delivery data: the content of messages we receive from you and information about the emails we send you. For example, their identifiers and whether they have been delivered, rejected by the recipient’s mail server or marked as spam.
• Browsing and performance data: pages visited, traffic sources, general browser and device characteristics, loading times and other website performance metrics. We use this information to compile statistics on visits and website performance. We do not link this information to waitlist data.

We obtain this data from information you provide through forms or when contacting us directly, from your interactions with the website, and from our security, email and analytics providers. We do not need sensitive information to process a sign-up or enquiry; please avoid including it unless necessary.

Your email address is required to process your waitlist sign-up and send you the updates you request. Without it, we cannot manage your sign-up or send you the confirmation link. Your name is optional and allows us to personalise our messages. You can visit the website without joining the waitlist.

4. Purposes and lawful bases

The legitimate interests described above are limited to managing requests, maintaining the security and reliability of the service, improving website performance, and handling enquiries or claims. You can object to this processing as explained in the section on your rights.

5. Arkko communications

Requesting to join the waitlist does not activate your subscription to updates. We send you a confirmation link that expires after seven days; you can receive the requested updates only after using it to confirm your request. Link expiry and data deletion are separate operations.

You can withdraw your consent through the unsubscribe link in update communications or by emailing us at legal@arkko.io. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Unsubscribing stops the updates. You can also request erasure of your data. When handling that request, we distinguish between data that can be deleted and the minimum information needed to honour your unsubscribe request or comply with legal obligations. A new subscription requires a new confirmation.

6. Data retention

Data retention depends on the purpose of the processing and the status of each request. We apply the following criteria:

• Confirmed waitlist sign-ups: while the stated purpose continues to apply and you have not withdrawn your consent. If that purpose ends or you unsubscribe, we stop using the data to send you updates.
• Pending requests and confirmation links: links are valid for seven days. At the next cleanup after use, revocation or expiry, we delete the link and the associated data needed to confirm the sign-up. We delete the email address associated with the request when no valid link remains. If you have confirmed your sign-up, we retain your email address on the waitlist in accordance with the first criterion. Security and delivery data follow the periods set out below.
• Security and delivery: codes derived from IP addresses are used to limit requests for ten minutes and those derived from email addresses for twenty-four hours. They are deleted at the next automatic cleanup. Arkko’s internal sending records are retained for seven days after sending is completed. If no completion time is recorded, the period runs from the start of sending or, if no start time is recorded either, from the creation of the record. An incident may justify extending this last period to a specific date, subject to a review of whether retention remains necessary.
• Enquiries: for as long as needed to respond to and resolve the matter. Afterwards, only where a legal retention obligation exists or the data is needed to address potential liabilities.
• Consent and unsubscribe evidence: for as long as needed to demonstrate the consent given, record its withdrawal and address any resulting liabilities.
• Blocked data: where blocking is required under Article 32 of Spain's Organic Law on Data Protection and the Guarantee of Digital Rights (LOPDGDD), the data is kept out of ordinary use and reserved exclusively for disclosure to the competent authorities to address potential liabilities arising from the processing during the applicable limitation periods. Once those periods have elapsed, it is destroyed.

Cloudflare Web Analytics provides access to statistics from the previous six months. This access period does not necessarily correspond to the provider’s information deletion period.

Backup and recovery copies may retain earlier versions of data during their technical lifecycle. Before using a restored copy again, we keep sending paused and reapply and verify any subsequent withdrawals and erasures to prevent their effects from being reversed. When handling an erasure request, we also consider information retained by the email provider to manage bounces and complaints.

7. Recipients and providers

We use services needed to host and protect the website, store requests and manage email:

• Cloudflare: website infrastructure, function execution, D1 storage, form protection through Turnstile, and visit and performance statistics through Web Analytics.
• Amazon Web Services (SES): sending emails and managing delivery, bounce and complaint information.
• Zoho: email service for the enquiries and requests you send us.

These providers access the data needed for their functions. Processing on Arkko's behalf must be subject to the applicable data protection agreements. We do not share the waitlist with third parties so they can send their own advertising.

Cloudflare also carries out certain processing as an independent controller to improve Turnstile's bot detection. You can consult the signals it uses and its terms in the Turnstile privacy policy.

We may provide information to the authorities where there is a legal obligation or where necessary to handle legal proceedings and liabilities in accordance with applicable law.

8. International transfers

Infrastructure, security and email providers operate internationally. Their involvement may entail access or processing outside the European Economic Area. Storage or sending from a European region does not, by itself, rule out such access.

Cloudflare and AWS describe standard contractual clauses for certain international transfers in their data protection agreements. Our Zoho email is hosted in its European region. Zoho states that technical support may involve access from outside the European Economic Area, subject to the mechanisms described in its documentation. The specific safeguard depends on the provider, destination and the service we have contracted; we do not claim that all data remains exclusively in Europe.

• Cloudflare: data protection agreement and transfer mechanisms.
• AWS: data protection information and processing terms.
• Zoho: privacy policy and information on access and transfers from the European region.

To request information about the safeguards applicable to your data, email legal@arkko.io.

9. Your rights

• Access: find out whether we process your personal data, obtain information about the processing and receive a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data where applicable.
• Restriction: request that we restrict how we use your data in the circumstances provided for by law.
• Objection: object to processing based on legitimate interests on grounds relating to your situation. You can object to commercial communications at any time.
• Portability: receive the data you have provided and request its transmission where automated processing is based on consent or a contract and the legal requirements are met.
• Withdrawal of consent: withdraw it at any time, without affecting lawful processing carried out before withdrawal.

To exercise these rights, email legal@arkko.io and tell us what you are requesting. If we need to verify your identity, we will ask only for proportionate and relevant information. Exercising your rights is free of charge, subject to the exceptions provided for by law.

We will respond without undue delay and, as a general rule, within a maximum of one month of receiving your request. If an extension is necessary because of the complexity or number of requests, this period may be extended by up to two additional months; we will inform you of the reasons within the first month.

You can lodge a complaint with the Spanish Data Protection Agency if you consider that the processing infringes your rights.

10. Preferences and browser technologies

We use Cloudflare Web Analytics to measure visits and performance. According to Cloudflare, this service does not use cookies, local storage or browser fingerprinting. We exclude pages opened through personal confirmation or unsubscribe links from measurement.

We use first-party cookies to remember your theme and language preferences for one year. You can change these preferences at any time on our website or delete the cookies through your browser. These cookies are not used to track your activity.

The form uses Turnstile and request limits to prevent abusive use. These checks may reject a request; if you have difficulty using the form, you can contact us.

We use access controls, request validation and link protection to reduce the risks of unauthorised access or use.

11. Children's data

We do not ask your age when you visit the website or request to join the waitlist. Where we rely on consent and the person cannot give valid consent on their own under applicable law, someone with parental responsibility or a legal guardian must be involved. In Spain, this applies to children under the age of fourteen.

If you are responsible for a child and believe they have shared personal data with us without the necessary authorisation, email legal@arkko.io so that we can review the request and take appropriate action.

12. Changes to this policy

This policy will be updated when the processing or its conditions change. The last updated date appears at the beginning. If a new purpose requires consent, we will request it before using the data for that purpose.