Privacy & data

What we collect when you register a company here, why we hold it, how long for, and how to get it back or get it deleted.

Applies to market.arcmarketing.xyz · Last updated 14 August 2026

1. Who holds your data

Arc Marketing is the controller of the personal data described here. We operate from offices in Ukraine, Canada, Nepal; the contact points for each are on our About page, and data questions reach us at the contact address on our About page.

This is a business-to-business marketplace. Almost everything we hold is company information — a registration certificate, a rate, a route. The personal data in it is mostly business contact details of people acting for a company: a name, a work email, a WhatsApp number, a job title.

2. What we collect, and why

What	Why we need it	Basis
Company name, legal name, country, website, social profiles	To know who we would be contracting with, and to do basic diligence before letting an account trade	Legitimate interest — counterparty diligence
Login email, password (hashed, never stored in the clear)	To give you an account and keep other people out of it	Contract
Contact people and channels — name, role, WhatsApp, Teams, Telegram, phone	We broker by talking to both sides directly. A supplier we cannot reach cannot be sold	Contract / legitimate interest
Company documents — registration, tax, licence	To verify a company is real before granting the verified badge or contracting	Legitimate interest, and legal obligation where it applies
Route listings, rates, capacity, delivery test results	The product. This is what the marketplace exists to carry	Contract
Deal and request messages	To broker a deal, and to have a record of what was agreed	Contract
Sign-up IP, login times and IPs, listing audit events	Security, fraud and abuse handling, and the audit trail behind the no-circumvention clause in the terms	Legitimate interest — security and contract enforcement

We do not run advertising trackers, we do not sell data to anyone, and we do not profile you for anything other than operating the marketplace. The only cookie the site sets is the one that keeps you signed in.

3. Message content

Messages inside a deal or a request are relayed by us. Text you write is automatically stripped of email addresses, phone numbers, URLs and @handles before it is stored, because buyers and suppliers are not introduced to one another. That scrubbing protects both sides' identity — it is not a security control, and you should not put anything confidential into a message field that is not about the trade.

4. Who else processes it

We keep the list short on purpose. Each of these acts on our instructions only:

Our hosting and database provider — the servers this site and its data run on.
Our email provider — delivers verification codes, notifications and quotes.
Our WhatsApp messaging provider — delivers verification codes and notices where you chose WhatsApp.
Our document storage — holds the company documents you upload.

We operate from Ukraine, Canada, Nepal, so your data is accessible to our staff in those countries. Where that involves moving data out of the UK or the EEA, we rely on the UK/EU standard contractual clauses. We will name the specific processors on request — write to the contact address on our About page and we will send you the current list.

5. How long we keep it

An open account — for as long as it is open.
A closed account — 12 months, then deleted, unless a contract or a legal obligation requires longer.
Company documents — deleted when the account is deleted, or on request while it is open, unless the verified badge currently rests on the document.
Deals, invoices and their messages — 6 years, because they are commercial records and because the no-circumvention clause runs on them.
Security logs (IPs, login times) — 12 months.

6. Your rights

You can ask us for a copy of what we hold about you, to correct it, to delete it, to restrict what we do with it, or to object to us relying on legitimate interest. Write to the contact address on our About page and we will answer within 30 days.

Two honest limits. Deleting an account does not delete the commercial record of deals already done — we are required to keep those. And deleting an account frees the email address, so it is a deletion, not a block.

If you are in the UK or the EEA and you think we have got this wrong, you can complain to your national data protection authority. We would rather you told us first.

7. Security

Passwords are stored as scrypt hashes with a per-account salt. Nobody here can read yours, and a reset link is stored only as a hash of itself.
The marketplace runs as its own process with its own session cookie, separate from our other systems.
Supplier rates and identities are held behind a serializer that publishes only an explicit list of fields — the protection is structural, not a matter of remembering.
Document downloads are authenticated on every request; there are no public links to them.

If you find a security problem, please tell us at the contact address on our About page before telling anyone else. We will not take legal action against anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it.

8. Changes

If we change this in a way that matters, we will email the address on your account before it takes effect. The date at the top always reflects the current version.