Privacy policy
Last updated 27 October 2026
This policy explains what personal data Arisoft HSM (hsm.arisoft.nl) processes, why, and what you can ask of us. In short: you can use the site without an account and without cookies, and the only personal data you can give us today is an email address for the alerts waitlist.
Who is responsible
Arisoft, Van Embdenstraat 820, 2628 ZP Delft, the Netherlands, KvK 42057545, is the controller under the GDPR. Contact: info@arisoft.nl.
When you visit the site
- No cookies, no ads, no third parties. The public site sets no cookies, stores nothing in your browser and loads no tracking or advertising scripts from other companies.
- Visit statistics. To see which pages and jobs are useful, our own server counts page views and clicks to employers' sites. For each we store the page, the website or campaign you came from, the kind of device (desktop, mobile, tablet), the search and filters on the jobs and companies lists, and a visitor code. That code is a one-way hash of your IP address and browser with a random key that is replaced every day and then forgotten, so we can count unique visitors per day but cannot recognise you on another day or work back to your IP address. Your IP address itself is not stored for this. The legal basis is our legitimate interest in improving the site; nothing is shared with anyone. The counts are kept for 13 months.
- Server logs. Our web server records each request: IP address, time, page and browser. We use these to keep the site secure and to stop abuse, which is our legitimate interest. They are deleted after at most 14 days.
- Abuse limits. Forms count attempts per IP address in the server's memory for up to an hour; this count is never stored.
The job alerts waitlist
If you join the waitlist, we store:
- your email address,
- on which page you signed up, the date, and which version of the consent text you agreed to.
We use it for one thing: a single email when job alerts open. The legal basis is your consent. We delete your address after that email, or earlier when you ask. You can withdraw your consent at any time by emailing info@arisoft.nl.
Employers and job postings
The directory lists employers from the IND public register of recognised sponsors (name and KvK number) with their website and careers page. Jobs are read from those public careers pages; we keep the title, place, date, employment type, salary if stated and the description, and remove email addresses and phone numbers before anything is stored. We process this on the basis of our legitimate interest in helping people find sponsored jobs.
Some sponsors are sole traders whose business name is a person's name, which makes it personal data. If that is you and you want to be removed, email us. Employers can also block or limit our reader; see HSMBot.
Who else processes data
- Amazon Web Services hosts the site and its database in Frankfurt, Germany, and sends our emails. AWS acts as our processor. It is part of a US group; transfers outside the EU are covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
- OpenAI helps us set up the reading of an employer's careers page: our tools send it the text of those public pages, with email addresses and phone numbers removed first. No visitor or waitlist data is sent to OpenAI. It acts as our processor; transfers to the US are covered by the EU–US Data Privacy Framework and standard contractual clauses.
We do not sell personal data or share it for advertising.
How long we keep it
| Data | Kept |
|---|---|
| Server logs | At most 14 days |
| Waitlist email address | Until the alerts launch email, or until you ask us to delete it |
| Database backups | 8 weeks; deleted data disappears from backups within that time |
Your rights
You can ask for access to your data, correction, deletion, restriction, a copy in a portable format, or object to processing based on our legitimate interest. Email info@arisoft.nl; we answer within one month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Security
All traffic is encrypted (HTTPS). The database is not reachable from the internet, admin access needs a second factor, and every admin action is logged.
Changes
Accounts, job alerts and payments are not available yet. Before they open, this policy will be updated to cover the data they need. The date at the top shows the latest version.