Privacy & GDPR
Last updated: 14 October 2026
Who we are
Arbelyn is an HR platform run by Daniel Yan from Lisbon, Portugal. For any privacy question, write to contact@arbelyn.io.
Roles under GDPR
Each company that uses Arbelyn is the data controller for its employees' data. Arbelyn acts as a data processor and only processes that data to provide the service.
What data we keep
Account data (name, email), work data entered by the company (role, manager, team, job description, time off, goals, reviews, assets) and personal details a person chooses to add (addresses, phones, family and payroll details).
Who can see it
HR sees all data of its own company. Managers see their own data and their direct reports' work data. Employees see only their own data. Other companies never see it. 360 review results hide peer names.
Platform staff access
Arbelyn staff have no routine access to company data. Access requires a request approved by a second administrator, is read-only or read-write, lasts at most 2 hours and is recorded.
Audit and deletion
Every change is recorded with who made it and when. Deleted items are hidden rather than erased, so mistakes can be undone. Payroll fields are masked in the audit log. To have data permanently erased, the company or the person can ask us at contact@arbelyn.io.
Your rights
You can ask for access, correction, erasure, restriction, portability or object to processing. Contact your employer's HR first, or us at contact@arbelyn.io. You may also complain to the Portuguese data protection authority (CNPD).
Emails and forms
The feedback and pricing forms send your message to contact@arbelyn.io. We use your email only to reply.