Legal · version 1.2 · effective 1 November 2026
Privacy
Policy.
What we collect when you visit the site, order a development kit, use the app or contact us — and what we do with it.
Development Kit Evaluation Agreement Shipping Policy Contact
Document record
Version
1.2
Effective
1 November 2026
Controller
The company that supplied your development kit — by delivery country
Privacy contact
Replaces Privacy Policy v1.1 (effective 14 September 2026, sections corrected 19, 24 and 26 September 2026).
The policy
Version 1.2 · effective 1 November 2026 · controller: for a development kit, the company that supplied it, by delivery country; for website visits, the contact form, accounts, Find my order and riding someone else's Kit, ARKINEMATICS LIMITED if you are in the EU or EEA and ARK Dynamics Global everywhere else · privacy contact: devsupport@ark-dynamics.com
This policy explains what personal data ARK collects when you visit ark-dynamics.com, order a development kit, create an account, use the ARK companion app, or contact us — and what we do with it. We supply development kits to professional recipients (Agreement Section 1.3); most of the personal data we hold is about the people who order, pay, receive and ride for them.
1. Who is responsible for your data
| Role | Company |
|---|---|
| Your data controller, if your development kit is delivered in the USA or the rest of the world | ARK Dynamics Global, a Wyoming corporation, 762 E Browning Ave, Salt Lake City, Utah 84105, USA |
| Your data controller, if your development kit is delivered in the EU | ARKINEMATICS LIMITED, trading as ARK Dynamics, Korinthou 33, Agioi Trimithias 2671, Nicosia, Cyprus (company no. HE 436275) |
| Our representative in the EU, appointed under Article 27 of the GDPR, if you are in the EU | ARKINEMATICS LIMITED, trading as ARK Dynamics, Korinthou 33, Agioi Trimithias 2671, Nicosia, Cyprus (company no. HE 436275). You may contact it about anything to do with your data instead of contacting us. |
Privacy contact for both: devsupport@ark-dynamics.com. The company that supplied your development kit decides how your data is used and is the company you have rights against: ARK Dynamics Global for development kits delivered in the USA and the rest of the world, ARKINEMATICS LIMITED for development kits delivered in the EU. Where ARK Dynamics Global is the controller, ARKINEMATICS is its point of contact in the EU under Article 27, not a second controller. Each company handles the personal data of its own recipients only, with one exception: your account's sign-in record (your email address, password hash, sign-in codes and the cookies in Section 2) is kept by ARKINEMATICS LIMITED, which runs the account system for both companies and, for recipients of ARK Dynamics Global, does so as its processor under a written agreement. Your requests stay with the company that supplied them.
2. What we collect
| Category | Details |
|---|---|
| Request and account data | Name, company or organisation, VAT or company registration number (or, where a business has none yet, the one line you give about what it does, and our record of the business document we checked before shipping: what it was, whether we accepted it and who decided; kept with the request, like the rest of its business details), delivery and billing address, email, phone, order number, which development kit you requested, price paid, payment status, delivery details, and — for grid-position and early-reservation holders — your reservation and grid-position code. Card payments are processed by our payment processor; we never see or store your full card number. |
| Business details | Where we supply businesses only (Agreement Section 1.3A): your company or trading name, its VAT, company or business registration number, its business address and your declaration that you are buying for your business. |
| Your acceptance record | Which version of the Development Kit Evaluation Agreement you accepted, each box you ticked at checkout (the Development Kit box, the professional-recipient and safety box, the clauses you specifically approved, the release where it applies, the import-VAT box) and when, kept with your order. |
| Your account | If you open an account — on its own page, or by ticking “Also create my ARK account” when you order: your email address; your password, if you set one, stored only as a one-way scrypt hash that cannot be turned back into it; when you proved your email address and when you confirmed you are 18 or over and accepted the Terms (for an account opened at the order, that is the confirmation you gave with the order); the orders linked to your account, including orders you placed earlier with the same email address without an account, once you have proved that address; and, if you sign in with Google, the identifier and email address Google gives us for your Google account. Signing in sets cookies that only do that job, are never readable by a script and are never sent to another site: ark_s keeps you signed in until you close the browser, or for 30 days if you tick “Keep me signed in”; ark_pre ties an emailed sign-in code to the browser that asked for it and expires with the code; ark_dev is set only if you tick “Remember this browser”, so this browser is not asked for a code again for the period stated beside that box; ark_oauth lasts at most 15 minutes, only while you sign in with Google. |
| Saved name and address | Only if you tick “Save my name and address to my account” when you order: the name and delivery address from that order, kept in your account so that “Auto fill details” can fill in your next order. They are kept by the company that sells where they are delivered: ARKINEMATICS LIMITED for the EU, ARK Dynamics Global for the USA and the rest of the world (the French overseas departments, Saint-Martin and Åland are supplied as the rest of the world). You can see, change or remove them in your account settings at any time. |
| Saved business details | If you are signed in when you order a development kit and name a company or organisation: that name, its VAT, tax or registration number with the result of our format check, and the delivery country, kept in your account so your next request is filled in. Your next request that names a company replaces them. They are kept by the company that sells where your development kit is delivered, as your saved name and address are. You can see, change or remove them in your account settings at any time. |
| Bank-transfer payments | If you pay by bank transfer: the amount, date and reference of your payment, and the name and account number of the account it came from, as our bank reports them to us. If you tell us you have paid, the name you give for that account. We never ask for your bank login. |
| Find my order | If you use Find my order: the order number you type, a one-way hash of the email address you type (never the address itself), the one-time code we email you (stored only as a one-way hash) and how many times it was tried. Each record is deleted 24 hours after its code expires. Your IP address is used only in memory, to limit how often codes can be asked for, and is not stored. |
| A card payment notice | If card payment fails and you ask us to tell you when it works again: your email address and the region you were ordering from, and, unless your browser sends Global Privacy Control, the build you had chosen and how the payment failed. Kept by ARKINEMATICS LIMITED (EU) or ARK Dynamics Global (USA and the rest of the world). If you tick “Send me ARK offers and news”, you join our list once you open the link we email you. |
| Development Kit data you send us | What the Kit or its software records and you choose to send us, for example with a support claim or an incident report: usage hours, session counts, actuator load and temperature, fault and error logs, emergency-stop events, firmware version, crash reports, the first-run checklist and Rider confirmations (Agreement Annex B.2 and B.3). Nothing is sent to us automatically. |
| Support and safety correspondence | Emails, photos, videos and fault descriptions you send us; incident reports; support claims. |
| Website data | IP address, browser and device type, pages visited and the time of visit, from server logs, which are deleted when the server's routine log rotation overwrites them, unless needed longer to investigate a specific attack on our systems. This site sets no advertising or analytics cookies, and there is nothing to consent to. It stores these things on your device, each only because you asked for something that needs it: when you open a checkout we set one cookie, ark_order, holding a single random reference and nothing else, so that if you close the payment tab we can offer you the same checkout again rather than a dead end — it cannot be read by any script, is never sent to another site, and expires with the checkout, at most 24 hours; and if you choose where you are ordering from, that choice is remembered in your browser so the right prices and currency are shown on the next page. If you order by bank transfer without signing in, or find an order with Find my order, we set ark_ord, holding a single random reference that lets this browser open that one order’s payment page, for 120 minutes; it cannot be read by any script and is never sent to another site. If you use Find my order we also set ark_fpre, which ties the code we email you to the browser that asked for it and expires with the code, after 10 minutes. If you sign in, the account cookies above are set too. None is used to profile you, follow you between sites, or measure your visit. If you press Order we also record where you arrived from — the campaign tag in the link you followed, or the website that linked to us — against that order alone. We read it from the link you followed and store nothing on your device for it; the tag names a campaign, never a person, and you may object. When a page you open carries such a tag, we also add one to that day’s total for the campaign and the page; the total holds no address, no identifier and no time finer than the day. On the order page we also add one to that day’s total for each step of an order that a visit reaches — opening the order form, choosing where you are ordering from, filling it in, continuing to payment, placing the order and paying — counted by region; the totals hold no address, no identifier, nothing you type and no time finer than the day, nothing is stored on your device for them, and we send none if your browser asks sites not to track it (Global Privacy Control). Our payment processor’s checkout page, on its own website, sets its own cookies; see its privacy policy. |
| Marketing preferences | Whether you have opted in to ARK offers and news. |
| Optional questions | Only if you answer them: how you heard of ARK, what you will mostly use it for, the sims you play and the gear you already have. Every question is optional. |
| Personal offers | An offer we send you: the build, the price, its code, when it ends, the reason you received it, and whether you used it. |
We do not knowingly collect data from anyone under 18. Our development kits and accounts are for adults.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Taking and fulfilling your development-kit request, delivering, invoicing and support | Performance of a contract with you |
| Your account: signing you in, keeping it secure and showing you your orders | Performance of a contract with you. The sign-in cookies are necessary for the sign-in you asked for (the exemption in Article 5(3) of the ePrivacy Directive and paragraph 4 of Schedule A1 to the UK PECR); “Remember this browser” is set only when you tick it. |
| Matching a bank transfer to your order, and refunding it to the account it came from | Performance of a contract with you; keeping the payment record is a legal obligation |
| Letting you pay for and find an order you placed without an account (Find my order, the payment page, the codes we email you) | Performance of a contract with you, or steps you asked for before one. The ark_ord and ark_fpre cookies are necessary for the service you asked for (the exemption in Article 5(3) of the ePrivacy Directive and paragraph 4 of Schedule A1 to the UK PECR). Limiting how often codes can be asked for and tried (your IP address is used in memory for this and not stored): our legitimate interest in keeping orders and payment details safe. |
| Telling you once that card payment works again, when you ask us to | Steps you asked for before a contract with you |
| The Development Kit data you send us, Safety Notices, recalls, incident handling | Our legitimate interest in the safety of our recipients and the Development Kit, and our legal product-safety duties (Terms 10.2). Where the GDPR or the UK GDPR applies, you may object; we then stop processing that data unless we can show compelling legitimate grounds that override your interests. |
| Tax, accounting and legal records; responding to authorities and courts | Legal obligation |
| Fraud prevention and securing our systems | Legitimate interest |
| Checking the names on an order — the requester, the recipient, the business and the name a payment comes from — against the official US (OFAC) and EU sanctions lists, when the order is placed and when it is paid | Legal obligation (EU sanctions law, for development kits supplied by ARKINEMATICS LIMITED); our legitimate interest in complying with US sanctions law (development kits supplied by ARK Dynamics Global). A possible match pauses the order until a person has checked it; nothing is decided by the system alone. The result of each check is kept with the order records. |
| Keeping your checkout open so you can finish it, and remembering the region you chose | Necessary to provide the service you asked for. No consent is required for storage of this kind, and none is asked for — it is the exemption in Article 5(3) of the ePrivacy Directive and paragraph 4 of Schedule A1 to the UK PECR. |
| Recording which campaign or website an order came from | Legitimate interest in knowing which of our own channels produces sales. It is read from the link you followed and nothing is stored on your device for it; it is never combined with anything from another site, and you may object. |
| ARK offers and news by email | Your consent — unsubscribe in any email |
| Personal offers by email | Your consent; or, after you have received a development kit from us, our legitimate interest in offering you our own similar products, where the law allows it without consent. You can refuse when you order and in every offer email. You may object at any time; once you do, we send you no more offers. In Canada we send offers only with your express consent, or with the implied consent Canada's anti-spam law allows for two years after your purchase. |
| Asking the optional questions | Legitimate interest in knowing which sims and set-ups to support first. Answering is your choice. |
| Using your answers to shape the offers we send you | Legitimate interest in sending offers that fit you, and only if we may send you offers at all. You may object to this at any time; objecting to offers also stops your answers being used for them. |
| Counting visits that arrive from our own campaigns | Legitimate interest in knowing which of our campaigns bring visitors. A daily total only: nothing is stored on your device and no person can be identified from it. |
| Checking that an order in a business-only place comes from a business, and keeping the business details with the order | Performance of a contract with you; our legitimate interest in supplying only professional recipients; tax and accounting records are a legal obligation |
| Filling in your next request from your saved business details | Our legitimate interest in making your next request quicker and its invoice right. You can remove them at any time in your account settings. |
| Keeping the record of the version you accepted and the boxes you ticked | Our legitimate interest in being able to show what was agreed, and to establish or defend legal claims |
| Recording each Rider's safety confirmation and the first-run checklist | Our legitimate interest in the safety of Riders and the Development Kit, and our legal product-safety duties; in Canada, also the Rider's consent, given on the Rider screen, which says what is recorded (the Rider profile name, the confirmation and its time, the safety events; never a health condition) and that it is kept for 15 years in Canada; where the GDPR or the UK GDPR applies, you may object, and we then stop processing that data unless we can show compelling legitimate grounds that override your interests |
4. Who we share it with
| Recipient | Why |
|---|---|
| Payment processors | Payment processing and fraud prevention. For a card order we pass our payment processor the name, delivery address and email you enter on our order sheet, and your phone number if you give one there, so its payment page can take the payment. Our payment processors are in the USA. |
| Our banks | If you pay by bank transfer, the money goes to the seller’s account at its bank, which reports to us the name and account it came from, the amount and the reference. A refund is paid through the same bank. |
| Google, only if you sign in with Google | Google confirms your Google account’s email address to us and learns that you signed in to ARK Dynamics, under Google’s own privacy policy. Nothing is sent to Google if you sign in with a password. |
| Amazon Web Services (Amazon SES) | Delivers our order, reservation, newsletter, offer and support email. AWS receives the address and content of each email in order to deliver it, and is certified under the EU–US Data Privacy Framework. |
| Anthropic (Claude) | Helps us draft replies to ordinary messages you send us. Anthropic receives your message and what we need to reply to it, in the USA. |
| YouTube (Google) | Plays a video on our See it move page, only when you press play on it. From then on Google receives your IP address and what its player records, under Google's own privacy policy. Nothing is sent to Google before you press play. |
| Our hosting provider | Hosts this website and our order system on a server in Canada. |
| Freight carriers and forwarders | Delivering your Kit and returns |
| Our manufacturing and repair partners in China | Only what a build, repair or replacement needs: name, delivery address, order and serial numbers, fault data |
| Accountants and lawyers | Running the business and defending claims |
| Product-safety, customs and tax authorities, courts | Where the law requires |
| ARKINEMATICS LIMITED, for recipients of ARK Dynamics Global | Runs the account sign-in system as ARK Dynamics Global's processor (Section 1). |
We do not sell personal data.
5. International transfers
If your development kit is delivered in the EU, your controller is ARKINEMATICS LIMITED, established in Cyprus. Your data is still processed in the United States in part, because our email delivery, payment and AI providers are there. Our payment processor processes your payment, Amazon Web Services delivers our email and Anthropic’s Claude helps us draft replies, all in the USA; a repair reaches our partners in China. Where ARK Dynamics Global is the controller there is no EU establishment behind the supply, so we have appointed an EU representative under Article 27 (Section 1); for every transfer out of the EU/EEA we rely on the safeguards below. Where a recipient is certified under the EU–US Data Privacy Framework we rely on that; for every other regular transfer — our payment processor, email delivery and the provider that helps us draft replies — we use the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) under Article 46; with our manufacturing and repair partners in China we put them in place before any of your personal data is sent to them. We rely on Article 49(1) only for an occasional transfer that is not repetitive, such as a one-off transfer you ask us to make. You can ask us which one applies to your data and for a copy of the safeguards. The server that runs ark-dynamics.com and the order system behind it is in Canada, so visiting the site, writing to us or placing an order sends that data to Canada. For that transfer we do not rely on the routes above: the European Commission has decided that Canada provides an adequate level of protection for personal data transferred to an organization subject to Canada’s Personal Information Protection and Electronic Documents Act (Decision 2002/2/EC), and that is the decision we rely on for the hosting of this site. The United Kingdom keeps the same decision in its own law.
6. How long we keep it
| Data | Retention |
|---|---|
| Orders, invoices, payment records | As long as tax and accounting law requires — up to 7 years after the order |
| Account data | While your account is open, then 2 years |
| Saved name and address | Until you remove them in your account settings or close your account; either deletes them at once. The name and address on each order you placed stay with that order (“Orders, invoices, payment records” above). |
| Saved business details | Until you remove them in your account settings or close your account (either deletes them at once), and never longer than 7 years after the request they came from: the same as the business details on each order, which stay with that order (“Orders, invoices, payment records” above). |
| Development Kit data you send us | 24 months — longer where needed for a support claim, a safety investigation, a legal claim or a regulatory duty |
| Safety incident and recall records | 10 years, matching product-liability limitation periods |
| Support correspondence | 3 years after the last message |
| An unfinished checkout | Deleted as soon as the checkout is paid, canceled or expires — at most 24 hours. Where a card order’s address is taken on our order sheet, the name, email, phone number, delivery address and any separate billing address you entered there are kept for 30 days after an unpaid checkout expires, then deleted. The ark_order cookie expires with it. |
| An unpaid bank-transfer order | If it is canceled before it is paid — by you, or because the money did not arrive by its date — the order and the details you gave with it are kept with our order records for 6 years after the cancellation, to establish or defend any claim about it, then deleted. |
| Find my order | A code works for 10 minutes; its record (stored as hashes) is deleted 24 hours after it expires. The ark_ord cookie ends after 120 minutes and its server record is deleted within 24 hours after that. |
| A card payment notice | Deleted as soon as we have sent you the one email; if we never send it, 12 months after you asked. |
| Marketing preferences | Until you unsubscribe, then a record of the unsubscribe |
| Answers to the optional questions | Until you close your account or ask us to delete them. An answer not linked to you keeps only the choice and the day, never your own words. |
| Personal offers | A record of each offer and whether it was used is kept with our sales records, up to 7 years. Closing your account cancels any offer you have not used. |
| Business details and your acceptance record | With the order: as long as tax and accounting law requires and at least until the time to bring a claim about the order has run out — up to 10 years after delivery, matching product-liability limitation periods |
| Rider confirmations and first-run records (the Rider profile name and the time each was completed; never an answer about anyone's health) | 10 years after the Rider's last session (15 years for a Development Kit in Canada, matching Ontario's 15-year ultimate limitation period, Limitations Act, 2002, s 15(2)), or longer while a claim, investigation or recall involving that Rider is open |
7. Your rights
If you are in the EU, EEA or UK you may ask us for access to your data, correction, deletion, restriction, portability, and to object to processing based on legitimate interest; you may object to offers, and to the use of your answers to shape them, at any time, and we then stop for good; you may withdraw consent at any time without affecting earlier processing. You may complain to the supervisory authority of the EU or EEA country where you live or work — that is your normal route, and our Article 27 representative in Cyprus does not change it. You may also complain to the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy), where our EU representative is established, or to the UK Information Commissioner's Office (ico.org.uk) if you are in the UK. If you are in the UK you may also complain to us under section 164A of the Data Protection Act 2018, by email to devsupport@ark-dynamics.com ; we acknowledge a UK data-protection complaint within 30 days of receiving it. If you are in Switzerland you may also complain to the Federal Data Protection and Information Commissioner (edoeb.admin.ch). To exercise a right the law gives you, email devsupport@ark-dynamics.com; we may ask you to verify your identity, and we respond within the time that law sets.
California residents: we do not currently meet the thresholds of the California Consumer Privacy Act, and we do not sell or share personal information as that law defines it.
Australia: where the Australian Privacy Principles apply to us, we handle personal information in line with them; it is disclosed to the recipients listed in Section 4, in the United States, Canada and China. Where those Principles apply to us, you may complain to us at devsupport@ark-dynamics.com and then to the Office of the Australian Information Commissioner (oaic.gov.au).
8. Your Development Kit data
If you are in the EU and the EU Data Act gives you the right, you may access the data your Kit generates from your use of it, and have it shared with a third party, as that Act sets out (Agreement Section 10.3). See the Development Kit Evaluation Agreement, data and telemetry section.
9. Security
Data is transmitted over encrypted connections and stored with access controls; we never see or store your full card number. If a breach affects your data, we notify you and the relevant authority where the law requires it.
10. Changes
We may change this policy; the version and date at the top of this page show which one applies. Where the law requires us to tell you before a change, we do.
11. Contact
devsupport@ark-dynamics.com · Controller for the USA and the rest of the world: ARK Dynamics Global, 762 E Browning Ave, Salt Lake City, Utah 84105, USA · Controller for the EU, and EU representative (GDPR Article 27): ARKINEMATICS LIMITED, Korinthou 33, Agioi Trimithias 2671, Nicosia, Cyprus.
Canada. The person in charge of the protection of personal information is the Privacy Officer, ARK Dynamics Global, 762 E Browning Ave, Salt Lake City, Utah 84105, USA, devsupport@ark-dynamics.com (subject: Privacy). We answer requests to see or correct your personal information within the time the law sets. Your personal information may be processed outside Canada, in the countries named in Section 5, where the courts, law enforcement and national security authorities of those countries may be able to access it. If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Canada. La personne responsable de la protection des renseignements personnels est le responsable de la protection de la vie privée d'ARK Dynamics Global, 762 E Browning Ave, Salt Lake City, Utah 84105, États-Unis, devsupport@ark-dynamics.com (objet : Confidentialité). Nous répondons aux demandes d'accès ou de rectification dans le délai prévu par la loi. Vos renseignements personnels peuvent être traités à l'extérieur du Canada et du Québec, dans les pays nommés à la section 5, où les tribunaux et les autorités de ces pays peuvent y avoir accès.
- Set from ARK_Dynamics_Privacy_Policy_v1.1.docx, effective 14 September 2026. The page differs from that document where listed below; elsewhere the headings, tables and lists carry the document's own wording.
- Sections 4 and 5 were corrected on 19 September 2026: this site runs on a server in Canada that ARK neither owns nor administers, and the recipients are stated accordingly. Email is delivered by Amazon SES. The hosting provider named in the reviewed draft is still not used. Sections 2, 3 and 6 were updated on 24 September 2026 for the order-continuity cookie. On 26 September 2026 orders delivered in Norway, Iceland and Liechtenstein moved to ARK Dynamics Global as seller and controller — they are outside the EU; ARKINEMATICS remains the Article 27 representative for the EEA.
- The server’s country is stated in Section 5: Canada. The transfer rests on the European Commission’s adequacy decision for Canada (Decision 2002/2/EC), not on Standard Contractual Clauses.
- Audit of this document against the site: ARK legal audit, 9 September 2026
- Section 7 gained a UK complaint route on 30 September 2026 (Data Protection Act 2018 section 164A, in force 19 June 2026). The v1.1 document the page was set from does not contain it.
- Sections 2, 3 and 6 gained the card payment notice on 12 October 2026.
- Sections 2, 3 and 6 were updated on 12 October 2026: the card payment notice needs no code, and a tick sends you ARK offers and news.
- Sections 4 and 5 were updated on 16 October 2026: Anthropic’s Claude helps us draft replies to the messages you send us.
Development Kit Evaluation AgreementShipping PolicyAccessibility