Privacy Policy
What personal data ArlenTrade processes, on what basis, who we share it with, and the rights you have.
Last updated:
1. Who processes your data
The data controller is ARLEN TRADE Ltd (company number 204754890, VAT BG204754890), registered at ул. „Смилица“ № 16, вх. А, ет. 1, ап. 1, р-н Красно село, гр. София 1612, Bulgaria, operating the ArlenTrade platform at https://arlentrade.com.
For any question about this policy, or to exercise your rights, write to info@arlentrade.com.
2. What we collect
This is a B2B platform — we process data about company representatives, not consumers.
| Category | Specific data |
|---|---|
| Account | name, email, phone, company name, address, VAT number, preferred language, account role and status |
| Access | hashed password (bcrypt — the original is never stored), password reset tokens |
| Inquiries and orders | products, quantities, specifications, notes, uploaded documents, quoted prices and accepted orders |
| Technical log | IP address, user agent, action taken, affected record, date and time — recorded for failed sign-ins and registrations too |
| Conversations with the AI consultant | see the “Ari, the AI consultant” section below |
| Notifications | in-platform messages and emails sent to you |
We do not process special categories of data, and we do not carry out profiling that produces legal effects for you.
3. Ari, the AI consultant
The platform offers an AI consultant called Ari. It is an automated system, not a person. We disclose this explicitly because it is the most sensitive processing on the platform.
- We store the full text of your conversations with Ari — both your messages and its replies.
- Ari infers and stores facts about you and your business — for example number of rooms, property type, payment behaviour, preferences, and who referred you. These inferences are kept separately from the conversation and reused in later conversations.
- Inferred facts are an automated system's judgement and may be wrong. You may ask to see them, correct them, or have them deleted.
- A conversation may be escalated to a human — automatically or at your request. An administrator then sees the whole conversation.
- Message content is sent to Anthropic, PBC (United States), which generates the replies.
- On escalation we send a Telegram alert containing your name, company, phone and email.
Ari does not make automated decisions producing legal effects for you. Quotes and orders are reviewed and confirmed by a person.
4. Why we process it, and on what basis
| Purpose | Legal basis |
|---|---|
| Creating and maintaining an account; handling inquiries, quotes and orders | performance of a contract (Art. 6(1)(b) GDPR) |
| Issuing and retaining accounting records | legal obligation (Art. 6(1)(c) GDPR) |
| Platform security, technical logging, abuse prevention | legitimate interest (Art. 6(1)(f) GDPR) |
| The AI consultant and the facts it infers, for more accurate quotes and service | legitimate interest (Art. 6(1)(f) GDPR); you may object |
5. Who we share it with
| Recipient | What they receive, and why |
|---|---|
| IDATEX (Denizli, Türkiye) — manufacturer | the contents of your inquiry, so it can be quoted; contact details only where needed to fulfil an order |
| Anthropic, PBC (USA) — AI | the text of your messages to Ari, so a reply can be generated |
| Cloudflare, Inc. (USA) — network protection | technical request data passing through the platform |
| Google Ireland Limited — web analytics | only with your consent: truncated IP address, pages viewed, browser technical characteristics. Not loaded if you decline. |
| Email service provider | your email address and the content of messages sent to you |
| Telegram — administrator alerts | on escalation of an AI conversation: name, company, phone and email |
We do not sell personal data and do not make it available for third-party marketing.
6. Transfers outside the European Union
Some recipients are outside the EU. Türkiye and the United States are not covered by a European Commission adequacy decision for all of these recipients, so transfers rely on appropriate safeguards — standard contractual clauses under Art. 46 GDPR.
TODO (for legal review): confirm that standard contractual clauses are signed with IDATEX, and state the current transfer mechanism for Anthropic and Cloudflare.
The platform itself is hosted on our own server in България — inside the European Union, so storage alone does not constitute a transfer to a third country. Only the data sent to the recipients listed above leaves the EU.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and contact details | while the account is active, plus 12 months |
| Inquiries, quotes and orders | 10 years (Bulgarian Accountancy Act) |
| Technical log | 12 months |
| Ari conversations and inferred facts | 24 months |
8. Your rights
- Access to the data we hold about you, and a copy of it.
- Rectification of inaccurate data — including the facts Ari has inferred.
- Erasure, where no legal ground requires us to keep it.
- Restriction of processing, and data portability.
- Objection to processing based on legitimate interest, including the AI consultant.
- Withdrawal of consent, where processing is based on consent.
Write to info@arlentrade.com. We respond within one month. If you believe your rights have been infringed, you may lodge a complaint with the Commission for Personal Data Protection (Bulgaria) — https://www.cpdp.bg.
Some data is tied to accounting records and cannot be deleted before the statutory period expires. In that case we restrict it rather than erase it.
9. Security
- Passwords are stored only as bcrypt hashes.
- All traffic to the site runs over HTTPS.
- Inquiry documents are stored outside the public directory and served only to authorised users.
- Access to data is logged.
10. Changes to this policy
We will notify you by email or in-platform message of any material change. The date of the last revision is shown at the top of this page.