Privacy Policy

1. Who We Are

Arduredu ("we", "us", "our") is a real-time compliance monitoring platform helping organisations monitor compliance with GDPR, NIS2, NCA, SDAIA PDPL, ISO 27001, DORA, SAMA, UAE-IA and SOC 2.

2. Data We Collect

2.1 Account Data

• Full name and job title
• Business email address
• Organisation name
• Hashed password (never stored in plain text)

2.2 Usage Data

• Login timestamps and IP addresses
• Compliance scan results and scores
• Framework and control selections
• Report generation history

2.3 Evidence Data

2.4 Data We Do NOT Collect

• Payment card details (handled by payment processor)
• Personal data of your customers or employees
• Contents of your policy documents
• Biometric or special category data

3. Lawful Basis for Processing

4. How We Use Your Data

• Creating and managing your Arduredu account
• Providing real-time compliance monitoring services
• Sending scheduled compliance reports you have configured
• Generating PDF audit reports on your request
• Enabling auditor portal access you have authorised
• Responding to your support requests
• Improving our platform features and security

5. Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We share data only with:

6. Data Retention

7. Security Measures

• TLS 1.3: Enforced on all endpoints — HTTPS mandatory
• AES-256 encryption: All connector credentials encrypted before storage
• bcrypt hashing: Cost factor 12 — plain text passwords never stored
• Role-based access: Organisation-level data isolation on all endpoints
• Firewall: UFW active, fail2ban intrusion prevention
• Audit logging: All access events logged via auditd

8. Your Rights

We respond to all requests within 30 calendar days. Supervisory authority: Integritetsskyddsmyndigheten (IMY) — imy.se

9. Cookies

We use only strictly necessary cookies — no advertising or tracking cookies:

10. Jurisdiction and International Transfers

Arduredu operates globally from Sweden, with servers in Germany. We comply with data protection laws in all jurisdictions where we operate:

10.1 Data Storage

All personal data is stored on servers located in Germany, within the European Economic Area (EEA). This means EU data protection standards apply to all customer data regardless of the customer's location.

10.2 Saudi Arabia — SDAIA PDPL Compliance

For customers based in the Kingdom of Saudi Arabia, Arduredu processes personal data in accordance with the Personal Data Protection Law (PDPL) issued by the Saudi Data and Artificial Intelligence Authority (SDAIA). You have the right to access, correct, and request deletion of your personal data. To exercise these rights, contact admin@arduredu.com.

10.3 UAE Compliance

For customers based in the United Arab Emirates, we comply with UAE Federal Decree-Law No. 45 of 2021 on Personal Data Protection. Data subjects in the UAE have the right to access their data, request corrections, and request deletion.

10.4 Cross-Border Transfers

We do not transfer personal data outside the EEA except where the transfer is to a country with an EU adequacy decision, appropriate Standard Contractual Clauses (SCCs) are in place, or you have explicitly consented to the transfer.

11. Changes to This Policy

We will notify registered users of material changes by email at least 30 days before changes take effect. The version number and effective date are shown at the top of this page.

12. Contact Us