Privacy policy

1. Who is responsible

The controller of your personal data under the EU General Data Protection Regulation 2016/679 (“GDPR”) is Arambla Group Ltd., registry code 11545205 (Estonian Business Register), Tartu, Estonia (“Arambla”, “we”). Arambla is established only in Estonia, so the GDPR applies to the data of all members and visitors, wherever they live. For all privacy questions and requests use our contact form (topic “Privacy & my data”). We have not appointed a data protection officer because the law does not require it for our processing.

2. What data we process, why and on what legal basis

We do not ask for sensitive data (such as health, religion or political opinions). Please do not include it in public content. Providing data is voluntary, but without the account data you cannot use the member functions. Where we rely on legitimate interests (f), you may object (section 8). If necessary, we also use the data above to establish, exercise or defend legal claims (f).

3. What other members and visitors can see

• Public: your name, username, profile photo, about text, city/region/country, account type (and company name), member since, last visit and time online (only if you switch this on in Settings → Privacy), rating, feedback, active listings and requests, forum posts, public groups you belong to, your timeline (by default only your friends see it; you choose in Settings → Privacy). Public content can be viewed from any country. Listings, requests and profiles of companies can be found through search engines; profiles of private persons are hidden from search engines unless you allow it in Settings → Privacy.
• Only participants: private messages and offers are visible only to the two members involved. Arambla's moderators look at them only when this is needed to handle a report, a complaint or suspected fraud, or when the law requires it.
• Never public: e-mail address, phone, street address, postal code, password, IP address.

When you agree on a Deal you will often share contact or delivery details with the other member in messages; that member then also becomes responsible for handling them lawfully.

4. Who receives your data

We do not sell or rent personal data and do not share it with advertisers. We use these service providers (processors), bound by contract to process data only on our instructions:

• Hosting and database: Zone Media OÜ (Estonia, EU);
• E-mail delivery: Zone Media OÜ (Estonia, EU).

If you use Google sign-in, Google Ireland Limited learns that you log in to Arambla and acts as a separate controller under its own privacy policy. Fonts and scripts are served from our own servers — your browser does not contact third parties when you visit Arambla.

We disclose data to authorities, courts or injured parties only where the law requires it or where it is necessary to establish, exercise or defend legal claims. If the Service is transferred to another operator, your data passes to that operator for the same purposes; we will inform you in advance.

5. Transfers outside the EEA

We store and process your data within the European Economic Area (in Estonia). If a provider ever needs to process data outside the EEA, we will do so only with an adequacy decision of the European Commission or standard contractual clauses (GDPR art. 45–46), and update this policy.

Please keep in mind: what you publish is visible on the internet worldwide (section 3); when you deal with a member in another country, you decide yourself which contact and delivery details you give them; e-mails we send you are delivered to your e-mail provider wherever it is located; and if you use Google sign-in, Google may process your data outside the EEA under its own policy.

6. Cookies and browser storage

We use only what is strictly necessary for the Service, so no consent banner is required:

We do not use analytics, advertising or social-media tracking cookies. If this ever changes, we will ask for your consent first. Because we do not track you across websites, the Service does not react to “Do Not Track” or Global Privacy Control signals of your browser.

7. How long we keep data

• Account and profile: as long as your account exists.
• Closed account: hidden at once; after 30 days (time to handle open disputes and reports) your profile, photos, listings, requests, friendships, wishlist, received messages and other personal data are deleted, and your account is anonymised as “Deleted user”.
• What remains anonymised: messages you sent remain in the recipients' inboxes, offer history and feedback remain in the other member's records, and forum posts and answers remain in their threads — shown as “Deleted user”, because they are part of other members' records and conversations.
• Unused accounts: if you do not log in for 3 years, we send you an e-mail; if you still do not log in within 30 days, the account is deleted as above.
• Listings: expired listings stay in your account until you delete them or the account is deleted.
• Server logs: 14 days. Sessions: see cookies. Verification codes: until used or expired (24 hours). Password reset links: 60 minutes.
• Contact form, reports and complaints: up to 2 years after the case is closed, longer only if needed for legal claims.
• Newsletter consent: until you withdraw it.

8. Your rights

Under the GDPR you have the right to:

• access your data and receive a copy (art. 15);
• rectification of inaccurate data — most data you can edit yourself in Settings (art. 16);
• erasure — close your account in Settings or ask us (art. 17);
• restriction of processing (art. 18);
• data portability — receive the data you provided in a machine-readable format (art. 20);
• object, on grounds relating to your particular situation, to processing based on legitimate interests (art. 21);
• withdraw consent (newsletter) at any time, without affecting earlier processing;
• lodge a complaint with a supervisory authority — in Estonia the Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or the authority of the country where you live or work — and to go to court.

Send requests through the contact form (topic “Privacy & my data”). Exercising your rights is free of charge. We answer within one month (extendable by two months for complex requests, in which case we tell you why). We may ask you to confirm your identity, for example by writing from the e-mail address of your account.

9. Security

We use encrypted connections (HTTPS), store passwords only as salted hashes, protect forms against forgery, limit login and form attempts, keep access to the servers restricted to authorised persons and keep software up to date. No system is completely secure; we report personal data breaches to the supervisory authority as the law requires, and if a breach is likely to put you at high risk, we will inform you without undue delay.

10. Automated decisions and profiling

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Ratings, mutual matches and the hiding of listings of inactive members are calculated automatically according to the rules described in the Terms; moderation decisions are taken by people.

11. Children

Arambla is only for persons aged 18 or over and is not directed at children; we do not knowingly collect data of minors. If we learn that an account belongs to a minor, we close it and delete the data.

12. If you live outside the European Economic Area

Arambla can be used from many countries. Wherever you live, we protect your data under the GDPR and you have the rights listed in section 8. In addition:

• Your data is kept in the EEA. When you register or use Arambla from another country, you send your data directly to our servers in Estonia. We keep no servers or copies of the data in other countries, including countries whose law prefers local storage. Data protection law in Estonia and the EU may differ from the law of your country. If you do not agree to your data being processed in Estonia, please do not create an account.
• Rights under your local law. If the data protection law of your country applies to us and gives you rights that cannot be waived (for example the UK GDPR, the Brazilian LGPD, Canadian, Australian, New Zealand or South African privacy law, or the data protection laws of Latin American countries), you can exercise them through the same contact form, and you may also complain to the data protection authority of your country — for example the Information Commissioner's Office (ICO) in the United Kingdom or the ANPD in Brazil.
• United States. We do not sell personal information and do not share it for cross-context behavioural advertising.

13. Changes to this policy

We update this policy when our processing or the law changes. We inform members of material changes by e-mail or on the site before they take effect. The date at the top shows the current version.