1. Controller and contact
Arranz Group Ltd is the controller of personal data processed for this waiting list.
Business ID: 3345062-2
Address: 25460 KISKO, Finland
For privacy questions, requests or withdrawal of consent, contact info@arranzgroup.com.
2. Personal data we process
When you join the waiting list, we process the information you submit: your name, email address, company, role or title, and any optional note you provide. We also keep your waiting-list and verification status, consent version and time, verification and communication events, and relevant timestamps.
For security, abuse prevention and verification, the waiting-list system also processes technical data. The application stores protected hashes derived from the requesting IP address and user agent, and stores cryptographic hashes of verification tokens rather than plaintext verification tokens.
Our web server separately records technical request logs. Depending on the request and server logging configuration, these can include the full IP address, date and time, requested path and query string, host, HTTP method and status, referrer, user agent, transfer sizes and request timing.
If you arrive through an AiR Suite Partner referral link, we also process the referral code and limited campaign context carried in the link so that a valid referral can be recorded when you join the waiting list. Referral information is revalidated server-side before it becomes canonical attribution and is kept separate from your communication-consent status.
3. Why we process the data and our legal bases
| Purpose | Legal basis |
|---|---|
| Register you for the private early-access waiting list, verify your email address and manage your place. | Your consent under Article 6(1)(a) GDPR. |
| Send AiR Suite product, launch and early-access updates you requested. | Your consent under Article 6(1)(a) GDPR. You can withdraw it at any time. |
| Protect the website and form, prevent abuse, enforce rate limits, investigate faults and maintain security records. | Our legitimate interests under Article 6(1)(f) GDPR in operating a secure and reliable website and protecting our systems and users. |
| Measure website and campaign performance using server-side analytics. | Our legitimate interests under Article 6(1)(f) GDPR in understanding whether the waiting-list site and our campaigns are working, while avoiding browser-side analytics tracking. |
| Record and administer a valid AiR Suite Partner referral when you choose to join through a partner link, including preserving the referral source for later partner-programme and customer-benefit administration. | Our legitimate interests under Article 6(1)(f) GDPR in operating an accountable referral programme, preventing attribution disputes and preserving a valid referral relationship you chose to use. |
| Comply with legal obligations and establish, exercise or defend legal claims where necessary. | Compliance with legal obligations under Article 6(1)(c) GDPR and, where applicable, our legitimate interests under Article 6(1)(f) GDPR. |
Where we rely on legitimate interests, we use the data only where those interests are not overridden by your rights and interests. You may object to processing based on legitimate interests as described below.
4. Server logs, analytics and cookies
No browser-side Matomo analytics script is used on this waiting-list site. Analytics is produced server-side from IIS web-server logs and imported into our self-hosted Matomo installation. This means Matomo does not need to place an analytics cookie or browser identifier on your device in order to count a visit.
The protected IIS logs remain the detailed server record and can contain the full request IP address and other technical request fields. Matomo is used as the reporting layer for website and campaign performance. We use the server data for security, troubleshooting and aggregate audience measurement, not to build advertising profiles.
Cookies: the AiR Suite waiting-list and verification pages do not set analytics, advertising, personalisation or partner-referral cookies, and they do not use local storage or similar browser-side identifiers for referral or analytics tracking. A partner referral is carried in the first-party link and in the active page submission only, then revalidated server-side before canonical attribution is recorded. If we later introduce non-essential cookies or similar storage, we will update this notice and introduce the required consent controls before using them.
5. Who receives the data
Access is limited to Arranz Group Ltd personnel who need the information to operate the waiting list, communicate with participants, secure the service or maintain the website.
We use service providers where necessary to operate the waiting list. In particular, Mailjet is used to send verification and waiting-list communications and therefore processes the recipient email address and technical message-delivery data needed to provide the email service. Hosting, infrastructure and technical-support providers may also process limited data when required to provide or secure the service.
We do not sell waiting-list personal data. We may disclose information where required by law, a competent authority, or where necessary to establish, exercise or defend legal claims.
International transfers
If a service provider processes personal data outside the European Economic Area or another jurisdiction with an applicable adequacy decision, we use an available lawful transfer mechanism and appropriate safeguards, such as an adequacy decision or approved contractual safeguards, as required.
6. How long we keep the data
We keep personal data only for as long as necessary to operate the waiting list and send the AiR Suite information, early-access updates and launch communications you asked to receive.
- verification links expire after 24 hours; token records and related security events may be retained for a limited period afterwards for security, audit and abuse-prevention purposes;
- verified waiting-list information is kept while the waiting list and related AiR Suite communications remain active, or until you withdraw consent, subject to any limited retention required to record an opt-out, meet legal obligations or deal with legal claims;
- if you later become an AiR Suite customer, the ongoing customer relationship and product-related processing will be governed by the applicable customer or product privacy terms instead of this waiting-list notice, although we may keep a minimal record of the original waiting-list interaction where necessary for audit, legal or suppression purposes;
- unverified submissions are removed when they are no longer needed for verification, abuse prevention or troubleshooting;
- referral attribution and its audit history may be retained for as long as reasonably necessary to administer the Partner Programme, preserve any linked customer benefit, resolve attribution or commission disputes, and meet accounting or legal obligations;
- web-server logs and Matomo analytics data are retained according to operational, security and analytics retention schedules and are deleted, rotated, aggregated or anonymised when no longer needed.
7. Your data-protection rights
Depending on the circumstances and applicable law, you may have the right to:
- request access to your personal data;
- ask us to correct inaccurate or incomplete data;
- ask us to erase personal data;
- ask us to restrict processing;
- receive data you provided to us in a portable format where the legal conditions for portability apply;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- withdraw consent at any time without affecting processing that was lawful before withdrawal.
To exercise a right or withdraw consent, email info@arranzgroup.com. We may need reasonable information to verify that the request relates to you.
You also have the right to lodge a complaint with a competent data-protection supervisory authority. If you are in Finland, you can contact the Office of the Data Protection Ombudsman. You may also complain to the supervisory authority in the EU or EEA country where you live, work or believe an infringement occurred.
8. Your choices, required fields and automated decisions
Joining the waiting list is voluntary. Providing your name, email address, company, role or title and the waiting-list consent is required if you want to join and verify a place. The note field is optional. There is no statutory or contractual requirement to join the waiting list. If you do not provide the required information or consent, we cannot register or verify you for early access.
We do not use your waiting-list data for solely automated decisions that produce legal or similarly significant effects. Automated security controls, such as rate limits and bot-detection measures, may temporarily reject or suppress abusive or suspicious requests.
Changes to this notice
We may update this notice if the waiting-list service, providers or legal requirements change. The effective date at the top of the page shows the current version. If a change materially affects how we use data already collected on the basis of consent, we will provide additional notice or obtain new consent where required.