How we handle your personal data — plainly, in keeping with the EU General Data Protection Regulation (GDPR / DSGVO). Last updated: 13 July 2026.
ArriveWell is a brand of R Square S Square (sole proprietorship).
Controller: Ranjana Raveesh, Im Apfelgarten 6, 65760 Eschborn, Germany.
Contact for all data protection matters: contact@arrivewell.eu
We use no analytics, no advertising trackers, and no marketing cookies. Fonts are served from our own server — visiting this website sends no data to Google or social networks. We never sell personal data.
Our website is hosted by Netlify, Inc. (USA). When you visit, Netlify technically processes your IP address and standard request data (server logs) to deliver the pages and defend against abuse. Legal basis: legitimate interest, Art. 6(1)(f) GDPR. Transfers to the USA are covered by the EU Standard Contractual Clauses and Netlify's Data Processing Agreement.
If you request a consultation, we process the details you provide (name, email, phone, country, study plans, your message) to respond and prepare your consultation. Submissions are processed by Netlify Forms and delivered to our mailbox. Legal basis: steps prior to entering a contract, Art. 6(1)(b) GDPR. We delete inquiry data when it is no longer needed, at the latest 12 months after our last contact, unless a client relationship follows.
If you create a portal account, we process your name, email address, country, chosen role, and account status. Authentication (including password storage as a salted hash and email verification) is provided by Google Firebase Authentication (Google Ireland Ltd.). Your browser stores a session token locally (technically necessary; no tracking). Legal basis: contract performance, Art. 6(1)(b) GDPR.
Documents you upload in the portal (e.g. passport copy, transcripts, certificates, statement of purpose, financial confirmations) are stored in Google Cloud Firestore, region europe-west3 (Frankfurt, Germany). They are used solely to deliver our consulting services (application preparation, review, visa file preparation). Access is technically restricted to you and authorized ArriveWell officials; buddies never see your documents. Legal basis: contract performance, Art. 6(1)(b) GDPR. Documents are deleted upon completion of the engagement or on your request, unless retention is legally required.
If your plan includes the Buddy Program, we share your assigned buddy's contact card (name, city, email, phone/WhatsApp, short introduction) with you, and your name, email, country, and journey stage with your buddy — both only to deliver the program. Buddies provide their contact details themselves for this purpose. Legal basis: contract performance, Art. 6(1)(b) GDPR.
Our website offers an optional AI chat assistant for general questions. Messages you type into the chat are transmitted to Anthropic PBC (USA) to generate a response, via our own server function; we do not send your name, account data, or any identifiers alongside them. Do not enter passport numbers, documents, or other sensitive data in the chat. Chat use is entirely voluntary. Legal basis: consent by actively using the chat, Art. 6(1)(a) GDPR. Transfers to the USA are safeguarded by EU Standard Contractual Clauses.
We use the following processors under data processing agreements: Netlify, Inc. (website hosting and forms; USA — EU Standard Contractual Clauses), Google Ireland Ltd. / Google Cloud (Firebase Authentication and Firestore; data stored in Frankfurt, Germany; any transfers covered by SCCs), Squarespace (domain and email forwarding), and Anthropic PBC (AI chat responses; only for messages you voluntarily type into the chat). We do not use any other third-party services on this website.
All connections are TLS-encrypted. Portal access requires a verified email address; access to client data is restricted by server-side security rules based on account role. We retain personal data only as long as needed for the purposes above or as required by law, then delete it.
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21), as well as the right to withdraw any consent with future effect. To exercise any right, email contact@arrivewell.eu — we respond within one month. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).
We will update this policy when our services or processors change. The current version is always available at arrivewell.eu/privacy.html.