← Back to sign in

Privacy Notice

Last updated: 26 August 2026 · Draft pending legal review

Who we are

Araneus is a logistics master-data platform operated by [LEGAL ENTITY / FULL NAME], [ADDRESS], Germany ("we"). For privacy matters contact privacy@araneus.net.

Two roles, two notices

Most data in Araneus is entered by the company you work for (our customer), which decides why it is processed. For that data your employer is the controller and we are its processor — questions about it belong to your employer first. This notice covers what we ourselves are controller of: your user account and the platform's public reference data.

What we process about you, and why

  • Your account: name, e-mail address, phone, position, department, an optional profile picture, and a password (stored only as a hash). Purpose: authenticating you and showing colleagues who you are. Legal basis: performance of the contract with your company (Art. 6(1)(b)) and our legitimate interest in secure operation (Art. 6(1)(f)).
  • Your last sign-in time, so your company's administrators can review unused accounts. Legal basis: legitimate interest (Art. 6(1)(f)).
  • Change history: edits to records carry who made them and the before/after values, because an auditable master-data trail is what the product is. Legal basis: legitimate interest (Art. 6(1)(f)).
  • Technical logs: each request is logged with identifiers only (never names, credentials or content), kept at most 90 days. Legal basis: legitimate interest in security (Art. 6(1)(f)).

Recipients

  • Hetzner Online GmbH (Germany) hosts the platform and its backups.
  • MapTiler AG (Switzerland, covered by an adequacy decision): when you open a map, your browser loads the map directly from MapTiler, which sees your IP address and the map area you view. For addresses outside the Netherlands, our server also sends the site address you typed to MapTiler to find its coordinates, when you ask it to.
  • Kadaster / PDOK (Netherlands): when you look up land-registry plots while drawing a site boundary, our server — not your browser — sends the coordinates near that site to the Kadaster's public parcel service. The same server sends a Dutch site address to PDOK's public address register when you ask it to find coordinates. Both happen only when you press the control.
  • IGN / DGFiP (France): the same land-registry lookup, for French sites. Our server sends the coordinates near the site to the French national mapping agency's public parcel service, and only when you press the control.
  • German state surveying authorities (Germany): Germany's land registry is run by each federal state, so the same lookup goes to the authority for the state the site is in — currently Geobasis NRW, Hamburg's Landesbetrieb Geoinformation und Vermessung, LVermGeo Rheinland-Pfalz, the Berlin Geoportal, LGL Baden-Württemberg, LGB Brandenburg, HLBG Hessen, LGLN Niedersachsen, or LVermGeo Sachsen-Anhalt. As above, our server sends only the coordinates near the site, and only when you press the control. Which public register is asked depends on where the site is; we add registers as European countries and regions open their cadastral data.
  • Dirección General del Catastro (Spain): the same land-registry lookup for Spanish sites, sent to the Spanish cadastre's public service.
  • Kartverket (Norway) and ČÚZK (Czechia): the same land-registry lookup for Norwegian and Czech sites, sent to those countries' public cadastral services.
  • Brevo (Sendinblue SAS, France) will deliver transactional e-mail (invitations, password resets) once e-mail features are enabled.

All processing takes place in the EU (or under an adequacy decision).

Cookies and tracking

None. We set no cookies and run no analytics or third-party scripts. Your sign-in token is kept in your browser's local storage, strictly to keep you signed in.

Retention

Your account lives as long as it is active anywhere on the platform. A retired company membership is kept for 3 years (the record that you worked there), then anonymised. Request logs rotate within 90 days. Change-history entries follow the record they describe; on erasure, your personal values in them are blanked while the entries survive (Art. 17(3)).

Your rights

Access, rectification, erasure, restriction, portability, objection (Arts. 15–21 GDPR): write to privacy@araneus.net. Where your employer is the controller we will refer the request to it, as the law requires of a processor. You may also complain to a supervisory authority — for us that is [COMPETENT STATE AUTHORITY, e.g. the LfDI of the operator's Bundesland].

No automated decision-making

Araneus makes no automated decisions with legal or similar effect about you.