Data policy

Adjust cookie settings


Who we are

(as of July 2026)

The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is:

Arrow Global Germany GmbH
Europaring 60
40878 Ratingen
Germany

+49 (0) 2102 – 91 94-0
compliance@arrow-deutschland.net

 

Contacting the data protection officer

The data protection officer of the controller is:

DataCo GmbH
Sandstrasse 33
80335 Munich
Germany

+49 (0) 89 7400 45840
www.dataguard.de

 

General information on data processing

On this page, we provide information about the processing of your personal data on the website.
How we collect and use your personal data depends on how you interact with us or which services you use. We only collect, use or share your personal data if we have a legitimate purpose and legal basis for doing so.

What do we mean by legal basis?

Consent (Art. 6(1)(a) GDPR) – You have given us your consent to process your personal data for the specific purpose we have explained to you. You have the right to withdraw your consent at any time. For more information on how to withdraw your consent, please refer to the subsections entitled ‘Exercising your rights’ in the following sections of this privacy policy.

Contract (Art. 6(1)(b) GDPR) – We need to use your data to fulfil a contract you have with us. Alternatively, it is necessary to use your data because we have asked you to do so or you have taken certain steps yourself before entering into this contract.

Legal obligation (Art. 6(1)(c) GDPR) – We need to use your data to comply with the law.

Vital interests (Art. 6(1)(d) GDPR) – The processing of your data is necessary to protect your vital interests or those of another person. For example, to protect you from serious physical harm.

Public task (Art. 6(1)(e) GDPR) – The processing of your data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us, e.g. for a statutory function.

Legitimate interests (Art. 6(1)(f) GDPR) – The processing of your data is necessary to support a legitimate interest that we or another party have, only if your own interests do not outweigh this.

Please note that we may not be able to provide you with our website services if your data is processed for the performance of a contract or a legal obligation and you do not provide the requested data.

Disclosure of your personal data and transfer to third countries

As explained in this privacy policy, we use various service providers to help us provide our services and ensure the security of your data. When we use these service providers, it is necessary for us to disclose your personal data to them.

We have entered into agreements with all service providers to whom we disclose your data, obliging them to protect your data.

If your personal data is disclosed outside the EU, we ensure that your personal data receives an equivalent level of protection, either because the country to which your data is transferred has an ‘adequate’ data protection standard according to the European Commission, or by applying another protective measure, such as an enhanced contractual agreement, i.e. the Standard Contractual Clauses (SCCs) adopted by the European Commission.

For example, when we use US service providers, we rely on either the SCCs or the EU-US Data Privacy Framework, depending on the provider. You can request a copy of the SCCs we have concluded with our service providers by sending an email to the email address provided in this privacy policy.

Your rights

If your personal data is processed, you are a data subject within the meaning of the GDPR and you have the following rights vis-à-vis the controller:

1. The right to information (Art. 15 GDPR)
You have the right to request confirmation from us as to whether personal data concerning you is being processed. If this is the case, you have the right to obtain access to this data and the following information:

  • Purposes of processing
  • Categories of personal data
  • Recipients or categories of recipients
  • Planned storage period or criteria for determining this period
  • The existence of rights to rectification, erasure or restriction or objection
  • Right to lodge a complaint with the competent supervisory authority
  • Where applicable, the origin of the data (if collected from a third party)
  • Where applicable, the existence of automated decision-making, including profiling, with meaningful information about the logic involved, the scope and the expected effects
  • Where applicable, the transfer of personal data to a third country or international organisation

2. Right to rectification (Art. 16 GDPR)
If your personal data is inaccurate or incomplete, you have the right to request that it be corrected or supplemented without delay.

3. Right to restriction of processing (Art. 18 GDPR)
If one of the following conditions is met, you have the right to request a restriction on the processing of your personal data:

  • You contest the accuracy of your personal data, for a period enabling us to verify the accuracy of the personal data.
  • In the context of unlawful processing, you refuse to have the personal data deleted and instead request the restriction of the use of the personal data.
  • We no longer need your personal data for the purposes of processing, but you need your personal data to assert, exercise or defend your legal claims or
  • after you have objected to the processing, for the duration of the review of whether our legitimate reasons outweigh your reasons.

4. Right to erasure (‘right to be forgotten’) (Art. 17 GDPR)
If one of the following reasons applies, you have the right to request the immediate erasure of your personal data:

  • Your data is no longer necessary for the processing purposes for which it was originally collected.
  • You withdraw your consent and there is no other legal basis for processing.
  • You object to the processing and there are no overriding legitimate grounds for the processing, or you object in accordance with Article 21(2) of the GDPR.
  • Your personal data is being processed unlawfully.
  • The erasure is necessary to comply with a legal obligation under Union law or the law of the Member State to which we are subject.
  • The personal data has been collected in relation to information society services offered in accordance with Article 8(1) of the GDPR.

Please note that the above reasons do not apply if processing is necessary:

  • To exercise the right of freedom of expression and information;
  • To comply with a legal obligation or to perform a task carried out in the public interest and to which we are subject.
  • For reasons of public interest in the area of public health.
  • For archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.
  • For the establishment, exercise or defence of legal claims.

5. Right to data portability (Art. 20 GDPR)
You have the right to receive your personal data in a structured, commonly used and machine-readable format or to request its transfer to another controller.

6. Right to object to certain data processing (Art. 21 GDPR)
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.

If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing.

7. Right to revoke the declaration of consent under data protection law (Art. 7(3) GDPR)
If you have consented to processing by the controller by means of a corresponding declaration, you can revoke your consent at any time for the future. The lawfulness of the data processing carried out on the basis of the consent until revocation is not affected by the revocation of consent.

8. Right to lodge a complaint with a supervisory authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 of the GDPR.

The data protection authority responsible for us is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia:

Postfach 20 04 44
40102 Düsseldorf
Telephone: +49 (0) 211 - 384 24-0
Email: poststelle@ldi.nrw.de
Homepage: www.ldi.nrw.de

 

Provision of the website and creation of log files

1. Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected:

  • Information about the browser type and version used
  • The user's operating system
  • The user's internet service provider
  • Date and time of access
  • Websites from which the user's system accesses our website
  • Websites accessed by the user's system via our website
  • This data is stored in our system's log files.

This does not affect the user's IP addresses or other data that enables the data to be assigned to a user. This data is not stored together with other personal data of the user.

2. Purpose of data processing
The data is stored in log files to ensure the functionality of the website. We also use the data to optimise the website and to ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.

3. Legal basis for data processing
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 sentence 1 lit. f GDPR.

4. Duration of storage
The data is deleted as soon as it is no longer necessary for the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended.

In the case of data storage in log files, this is the case after seven days at the latest. Storage beyond this period is possible. In this case, the IP addresses of users are deleted or anonymised so that it is no longer possible to identify the accessing client.

5. Exercising your rights
The collection of data for the provision of the website and the storage of data in log files is essential for the operation of the website. The user may object to this. Whether the objection is successful must be determined by weighing up the interests involved.

 

Use of cookies

1. Description and scope of data processing
When you visit our website, we use technical tools for various functions, in particular cookies, which may be stored on your device. When you visit our website and at any time thereafter, you have the choice of whether to generally allow cookies to be set or which individual additional functions you wish to select. You can make changes on our data protection page.

Cookies are text files or pieces of information in a database that are stored on your hard drive and assigned to the browser you are using, so that certain information can be sent to the entity that sets the cookie. Below, we describe the types of cookies we use:

We use technically necessary cookies that are required for the technical structure of the website. Without these cookies, our website cannot be displayed (completely correctly) or the support functions are not possible.

The following data is stored and transmitted by technically necessary cookies:

  • Frequency of page views
  • Use of website functions

We use cookies on our website that are not technically necessary. Text files that do not solely serve the functionality of the website but also collect other data are considered technically unnecessary cookies.

The following data is processed by setting technically non-essential cookies:

  • Location of internet users
  • Date and time of the website visit
  • Tracking of surfing behaviour

2. Purpose of data processing
The purpose of using technically necessary cookies is to ensure the functionality of our website. Some functions of our website cannot be offered without the use of cookies. For these, it is necessary that the browser is recognised even after a page change.

The use of technically unnecessary cookies is for the purpose of improving the quality of our website, its content and thus our reach and profitability. By setting these cookies, we learn how the website is used and can thus continuously optimise our offering. In addition, they serve in particular to measure the success of advertising measures.

3. Legal basis for data processing
The legal basis for the processing of personal data using technically unnecessary cookies is Section 25 (1) TDDDG in conjunction with Art. 6 (1) lit. a GDPR.

The legal basis for the processing of personal data using technically necessary cookies is Section 25 (2) TDDDG in conjunction with Art. 6 (1) lit. f GDPR. Our legitimate interest here lies in the purposes of data processing mentioned under 2.

4. Exercising your rights
You can revoke your consent to the use of cookies at any time and manage your cookie settings at the following link: www.arrow-deutschland.net/datenschutz.

 

Email contact

1. Description and scope of data processing
You can contact us via the email address provided on our website. In this case, the user's personal data transmitted with the email will be stored.

The data will be used exclusively for processing the conversation.

2. Purpose of data processing
The purpose of processing your personal data is to deal with the matter raised in your communication and, if necessary, to contact you.

3. Legal basis for data processing
The legal basis for processing the data transmitted in the course of sending an email is Art. 6(1)(f) GDPR. Our legitimate interest is to respond to your enquiry sent by e-mail in the best possible way. If the e-mail contact is aimed at concluding a contract, the additional legal basis for processing is Art. 6 para. 1 lit. b GDPR.

4. Duration of storage
The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected. For personal data sent by e-mail, this is the case when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified.

5. Exercising your rights
If the user contacts us by e-mail, they can object to the storage of their personal data at any time by sending an e-mail to compliance@arrow-deutschland.net. In such a case, the conversation cannot be continued.

All personal data stored in the course of establishing contact will be deleted in this case.

Applying via our online application form

1. Scope of the processing of personal data

You can apply for a vacancy on our website via the online application form provided on the relevant job advertisement page. We do not accept applications by email. Should you nevertheless send us application documents by email, we will direct you to our careers page and the online application form there. Applications sent by email will not be processed as part of the recruitment process. Application documents received by email will generally be deleted as soon as you have been directed to the correct application method, provided there are no statutory retention obligations or other legitimate reasons to the contrary. When you use the online application form, we collect the personal data that you provide via the form and/or upload as part of your application documents, such as:

  • Title
  • First name
  • Surname
  • Address
  • Telephone / mobile number
  • Email address
  • Salary expectations
  • Details of training and education
  • Language skills
  • Curriculum vitae
  • References
  • Other personal data that you actively provide to us

Where individual fields in the form are marked as mandatory, we require this information in order to process your application. You are under no obligation to provide us with the personal data requested as part of the application process. However, without this information, we will be unable to process or consider your application.

Once you have submitted the online application form, you will receive confirmation of receipt of your application documents at the email address you have provided.

We use HR software provided by a contracted service provider to facilitate and manage the application process. The service provider is contractually obliged to process your data in accordance with our instructions and does not process your data for its own purposes. Your data will not be passed on to any other third parties.

2. Purpose of data processing

We process the personal data from the online application form solely for the purpose of processing your application.

3. Legal basis for data processing

The legal basis for the processing of your data is the initiation of a contract, which takes place at the request of the data subject, in accordance with Article 6(1), first sentence, point (b), alternative 1 of the GDPR and Section 26(1), first sentence of the BDSG.

4. Duration of storage

Once the application process has been completed, the data will be stored for up to six months. Your data will be deleted no later than the end of the six-month period. Where there is a legal obligation to do so, the data will be stored in accordance with the applicable provisions.

5. Exercising your rights

You may withdraw your application at any time. To do so, please contact us by email at bewerbung@arrow-deutschland.net. In such a case, your application can no longer be considered. All personal data stored in connection with the electronic application will be deleted in this instance.

Use of corporate profiles on social and professional networks

1. Use of corporate profiles
We make use of the option to maintain corporate profiles on social networks. We maintain corporate profiles on the following social networks:

Instagram & Facebook:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter referred to as ‘Instagram’)

LinkedIn:
LinkedIn Inc., Sunnyvale, USA, and its representative in the European Union, LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter referred to as ‘LinkedIn’)

On our corporate page, we provide information and offer Instagram and LinkedIn users the opportunity to communicate. If you carry out an action on our corporate page (e.g. comments, posts, likes, etc.), you may thereby make personal data (e.g. your real name or user profile photo) publicly available.

However, as we generally have little or no influence over the processing of your personal data by Instagram and LinkedIn, we are unable to provide binding information regarding the purpose and scope of the processing of your data. You can find further information in the relevant privacy policies of: Instagram: privacycenter.instagram.com/policy/

LinkedIn: www.linkedin.com/legal/privacy-policy

2. Purposes of data processing
Our company’s presence on social media is used for communication and the exchange of information with (potential) customers. In particular, we use our company’s presence for:

  • Disseminating company and press information
  • Promoting products
  • Recruitment and job applications
  • Disseminating company and press information / PR
  • Active sourcing
  • Branding and brand awareness
  • Direct customer interaction
  • Increasing reach
  • Analysing users and trends
  • Generating traffic and leads

Users are free to publish personal data through their own activities. The data generated by our company’s social media presence is not stored in our own systems.

3. Legal basis for data processing
Where we process your personal data to analyse your online behaviour, carry out advertising measures or run lead generation campaigns, this is done on the basis of your explicit declaration of consent, Article 6(1), first sentence, point (a), and Article 7 of the GDPR. The legal basis for the processing of personal data for the purpose of communicating with customers and prospective customers is Article 6(1), first sentence, point (f) of the GDPR. Our legitimate interest in this regard is to respond to your enquiry in the best possible way and to be able to provide the requested information. If the purpose of contacting you is to conclude a contract, the additional legal basis for the processing is Article 6(1)(b) of the GDPR.

4. Duration of storage
We store your activities and personal data published via our corporate Instagram account until you withdraw your consent. Furthermore, we comply with the statutory retention periods.

5. Right to object
You may object at any time to the processing of your personal data that we collect in connection with your use of our Instagram business profile and exercise your data subject rights. To do so, please send us an informal email to compliance@arrow-deutschland.net.

For further information on the processing of your personal data by Instagram and the relevant options for objecting, please see here:

Instagram: privacycenter.instagram.com/policy

LinkedIn: www.linkedin.com/legal/privacy-policy

Hosting

The website is hosted on servers by a service provider commissioned by us.

Our service provider is:

  • Host Europe GmbH, Hansestraße 111, 51149 Cologne, Germany

Further information about the processing of personal data by HostEurope can be found at: www.hosteurope.de/AGB/Datenschutzerklaerung/

The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The information stored is:

  • Information about the browser type and version used
  • The user's operating system
  • The user's internet service provider
  • Date and time of access
  • Websites from which the user's system accesses our website
  • Web pages accessed by the user's system via our website

This data is not merged with other data sources. This data is collected on the basis of Art. 6 (1) lit. f GDPR. Our legitimate interest in processing this data is to display our website without errors and to optimise its functions.

The website server is located in Germany.