Proprietary Service Privacy Policy

Effective Date: April 1, 2021

Arena, a PTC business (“Arena”) is committed to safeguarding your privacy online. We have implemented numerous technical and administrative measures to ensure that your personal information and data remain protected and secure.

This Proprietary Service Privacy Policy (this “Privacy Policy”) describes how Arena collects and uses the personal information, data, and other information (“Information”) you provide in connection with your use of the Arena proprietary services and other Arena products and services that link to this policy (collectively, “Arena Service”). “Personal Information” is data that identifies or could be used to identify, locate, track, or contact an individual.

Our customers determine the persons who may submit Information in connection with the Arena Service purchased by such customer from Arena under a separate agreement.

Arena processes “Customer Data” for its customers. Arena also uses certain personal information and other “Administrative Data” to provide and operate the Arena Service.

This policy describes the choices available to you regarding our use of your personal information and how you can access and update this information. We will share with third parties your Information collected through the Arena Service only in the ways that are described in this Privacy Policy.

By using the Arena Service, you are agreeing to the collection and use of information in the manner described below.

This Privacy Policy does not apply to information and data collected through the Arena public corporate website. To view our privacy commitments for the Arena corporate website, please see our Website Privacy Policy located at https://www.arenasolutions.com/privacy/website-privacy/.

Arena participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. Arena is committed to subjecting all personal data received from European Union (EU) member countries and Switzerland, respectively, in reliance on each Privacy Shield Framework, to the Framework’s applicable Principles. To learn more about the Privacy Shield Frameworks, and to view our certification, visit the U.S. Department of Commerce’s Privacy Shield List.

Arena is responsible for the processing of personal data it receives, under each Privacy Shield Framework, and subsequently transfers to a third party acting as an agent on its behalf. Arena complies with the Privacy Shield Principles for all onward transfers of personal data from the EU and Switzerland, including the onward transfer liability provisions.

With respect to personal data received or transferred pursuant to the Privacy Shield Frameworks, Arena is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission [AND/OR the U.S. Department of Transportation]. In certain situations, Arena may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If you have an unresolved privacy or data use concern that Arena has not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

Under certain conditions, more fully described on the Privacy Shield website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.

Information Provided by You

The Arena Service allows Arena customers to store, modify, and share their Customer Data within their organization and with third parties they select. Users of the Arena Service will provide and modify Customer Data for or on behalf of the applicable customer. Users will be asked by Arena to provide Administrative Data to allow us to provide and operate the Arena Service.

“Customer Data” is Information, other than Administrative Data, placed into the Arena Service directly by you or indirectly through third parties you authorize to access and modify your Customer Data.

• Each of our customers controls its own Customer Data. Arena processes Customer Data in order to provide its customers the Arena Service and perform its contractual obligations to its customers.
• We partner with third parties (for example, integration service providers) who provide products and services within, or related to, the Arena Service. These third parties may provide us your Customer Data. We treat this information in the same manner as we treat Customer Data that you provide directly to us.
• Arena views and accesses Customer Data only to resolve a problem or support issue, to update or enhance the Arena Service, to investigate a suspected violation of the related customer agreement, to provide professional services, or as may be required by law.
• Except as provided in this Privacy Policy, Arena will not review, share, distribute, print, or reference any Customer Data.

“Administrative Data” is Information Arena asks that you provide us during sign-up, in order to purchase services, or to enable Arena to administer the Arena Service. This includes company name, address, email, and phone number, and individual users’ names, email, phone numbers, billing information, credit references, and other financial data. Administrative Data does not include data provided to Arena by a customer to enable the setup or configuration of the Arena Service for such customer. If you do not wish to provide requested Administrative Data you may not be able to use Arena Service.

• We use Administrative Data to administer your account, provide customer support and professional services, improve the Arena Service, and to keep a record of our dealings with you.
• We use Administrative Data related to a customer’s financial qualifications and billing information to perform credit analysis, to process purchases, for accounting, and to detect and prevent fraud. We do not use this financial information for marketing or promotional purposes.
• Arena may use personal information you provide to us to notify you of new product offerings by Arena, to ask you about your experience using the Arena Service, conduct research, and plan and host events. You can elect to not receive these mailings as described below in the Marketing Choices section of this Privacy Policy.
• We also may use the personal information you provide us to send you important notices about changes, updates, and availability of the Arena Service or changes to our policies. Because this information is important to your interaction with Arena, you may not opt out of receiving these communications.
• If a user elects to invite a third party to review and provide input on Information entered as part of the Arena Service, then the user will need to provide us the name and email address of each such third party. Arena will automatically send the third party an email inviting him or her to become a user in order to review and provide input on the requesting user’s Customer Data. Though we retain this information to determine whether a user accepts the invitation, we will not otherwise use this information unless and until the third party signs up to become a user of the Arena Service. The third party may also contact us at [email protected] to request that we remove this information from our database.

Information Automatically Collected by Us

In addition to the Information you affirmatively provide to us, we collect from you and generate other Information:

Log Data. As is true of most websites, we gather certain information automatically and store it in log files. This information includes internet protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and clickstream data. Such information does not include Customer Data or other personal information. We may use this statistical information for product improvement. We may combine this automatically collected log information with other information we collect about you, including personal information. We combine this information to improve the services we offer you, as well as for analytics and site operations purposes.

• We also use IP addresses and other log data to enhance security and to optimize the performance of the Arena Service, so users may not opt out of providing such information. Each customer’s administrator may review the list of IP addresses from which its Customer Data has been accessed. Tracking Technologies: Arena and its partners use tracking technologies such as cookies, beacons, tags, and scripts.

The only cookies that we use are essential for the proper operation of the Arena Service as well as for website and product development and improvements. As a result, you are not allowed to opt out of any of the cookies and still access the Arena Service.

Anonymous Data: We also use aggregated and anonymous log data and analytics information, such as usage patterns and frequency, and transaction volumes for training, quality assurance, product development, marketing, promotion, statistical analysis, market analysis, financial analysis, benchmarking, and other business purposes.

Sharing of Information

Arena may share Information in the following situations:

Authorized Third-Party Access. When a customer authorizes third-party access to the Arena Service, such customer is directing Arena to allow such third party to access such customer’s Customer Data. Such disclosure is under the particular customer’s direction and control.

External Service Providers. The Arena Service allows our customers to use services provided by third parties contracted by such customer, such as component parts aggregators, implementers, or application providers. If a customer subscribes to any of these services, Arena will disclose to the third-party service provider such Customer Data and Administrative Data as is needed for such service provider to enable its services to such customer. That use, and further disclosure of that Information, will be governed by the respective third-party provider’s privacy policy and service terms.

Internal Service Providers. Arena may contract with other companies to provide services or functionality on our behalf. If we do so, we may share Customer Data and/or Administrative Data with such providers to the extent necessary for their engagement. In all such cases, service providers’ use of your Information will be contractually limited to uses consistent with this Privacy Policy. Examples of such internal service providers are:

• Payment processors and other third parties which are provided billing information to complete our transactions with you and to detect and prevent fraud or for collections.
• Data storage providers where we may store copies of our database backups. These third parties do not have the right to access such data.

Legal Requirements. We reserve the right to disclose your personally identifiable information and other Information as required by law such as to comply with a subpoena, or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request. Unless we are prohibited by law, we will attempt to notify you of any request to disclose your Customer Data to the authorities or any other party and, where appropriate, refer such requests directly to you.

Anonymized Information. Arena may use anonymous demographic information with partners and advertisers and in connection with marketing our services to third parties.

Successors. If Arena is involved in a merger, acquisition, or sale of all or a portion of its assets, your Information, including personal information, may be disclosed and transferred in connection with that transaction. Such transfer would enable due diligence and/or allow the transferee to operate the business. You will be notified via email and/or a prominent notice on our website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your Information.

Access to Personal Information Included in Administrative Data

The following terms describe how Arena will respond (unless such response is not required by applicable local law) to the indicated requests regarding your personal information included in Administrative Data:

Access and Deletion. Upon request we will provide you with information about whether we hold any of your personal information as Administrative Data.

• If you wish to receive a copy of your personal information or to correct, update, or request the deletion (assuming that this does not impact services we are providing to you) of personal information provided to us as Administrative Data, you may use your email address and password to access your account or contact us using the information below in the Contact Us section of this Privacy Policy. Please note that an email address associated with a user or an account cannot be changed. We must delete the account and create a new user or account.
• You may request that we restrict or cease the processing of your personal information in Administrative Data while we make any corrections which you request.
• If we no longer need your personal information in Administrative Data to provide services or for other legitimate purposes, you may request that we retain but not otherwise process such personal data to the extent needed in order for you to establish, exercise, or defend legal claims.
• We will respond to your request to access, update, or delete your personal information within thirty (30) days. We may reject requests which risk the privacy of others or are unreasonable or repetitive or would require disproportionate effort.

Transfer of Information. You may receive a copy of your personal information which you provided to Arena as Administrative Data in a structured and commonly used machine-readable format and you may transfer that information to another data controller. If it is technically feasible, you may request that we transfer such data directly to another controller. We will comply with your request subject to verifying your identity and provided that it is technically feasible.

Access to Personal Information Included in Customer Data

We are a data processor of Customer Data, which is controlled by our customers. To the extent the Customer Data includes personal information, such customer is responsible for complying with all privacy laws and regulations applicable to such customer as a user of the Arena Service and controller of such Customer Data. Arena shall, to the extent legally permitted, promptly notify such customer if Arena receives a request from an individual to exercise data subject rights for such Customer Data. Arena agrees to use reasonable efforts to assist such customer for the fulfilment of such a request. To the extent legally permitted, the applicable customer shall be responsible for any costs arising from Arena’s provision of such assistance.

Marketing Choices

Whenever you submit requests for more information or services from us, you may opt out of entering certain fields. However, such decision may affect our ability to provide what you have requested. You can opt out from our marketing messages by clicking on the “unsubscribe” link included in them or by contacting your Arena account executive. Such opt out will not extend to transactional or relationship messages. You also may opt out from us sharing Administrative Data with third parties for marketing purposes by contacting Arena at [email protected].

Security

The security of your Information is important to us. We follow generally accepted standards and appropriate technical and organizational measures to protect the Information submitted to us, both during transmission and once we receive it. No method of transmission over the internet or method of electronic storage is 100% secure; therefore, we cannot guarantee its absolute security. Arena personnel with access to Information have been advised of the importance of maintaining the confidentiality of such Information and of using it only for the purposes described in this Privacy Policy. For a more detailed description of our security practices for the Arena Service, please review our Security Statement here. If you have any questions about security on our website, you can contact us at [email protected].

Minors

If you are under the age of 18, you do not have permission to use our website. We do not knowingly collect, use, or disclose personally identifiable information about users who are under the age of 18. If you are the parent or guardian of a minor under 18 years of age and believe they have disclosed personally identifiable information to this website, please contact us at [email protected] so that we may delete the minor’s information.

Do Not Track Signals

Some browsers contain features that signal that the user does not want to be tracked, known as “Do Not Track” or DNT. The Arena Service does not respond to such signals.

Data Retention

We retain Customer Data for the duration of the applicable customer’s subscription to the Arena Service. After your subscription expires, we retain Customer Data for at least thirty (30) days and may store it for up to an additional one hundred eighty (180) days. Customer Data may be retained beyond that period in data backups, which may be stored for up to two (2) years. We retain Customer Data as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Arena will not retain your Administrative Data longer than is necessary to fulfill the purposes for which it was collected or as required by applicable laws or regulations.

Changes to This Policy

We may update this policy to reflect changes to our privacy practices. If Arena is going to use your personal information in a manner different from that stated at the time of collection, we will notify you via email sent to the email address you have provided to us prior to the change becoming effective. You will have a choice as to whether or not we use your personal information in this different manner. If we make any material changes to how we handle Customer Data, we will notify you by email (sent to the primary contact of your Arena subscription representative on record with us) or by a notice posted in the Arena Service prior to the change becoming effective. We commit to not materially reduce the protections provided for your Customer Data as outlined in this Privacy Policy, without your consent. We encourage you to periodically review this page for the latest information about our privacy practices.

California Consumer Privacy Act

The California Consumer Privacy Act (“CCPA”) is a comprehensive privacy law for California consumers that went into effect on January 1, 2020. The CCPA creates several new rights for consumers to control access and use of their personal information. These include the right to access and delete personal information collected, as well as the right to opt out of a “sale” of their personal information. Transfers to “service providers” are permitted under the CCPA.

As stated within our Privacy Policies (Website Policy and App Policy), WE DO NOT SELL PERSONAL INFORMATION TO THIRD PARTIES. While we do share some data with trusted “service providers” to improve and market our services and to operate our websites, we do not allow any third parties to use the personal information we share with them for their own purposes.

With respect to our customers doing business in California, we are a “service provider,” as defined under the CCPA. As a “service provider,” we only use customer data and personal information, as permitted in our customer agreements, or Master Services Agreement (MSA), and in compliance with CCPA.

To learn more about how we can help you exercise your rights under the CCPA, visit our Privacy Policies at Website Policy and App Policy.

Contact Us

You may direct questions regarding this Privacy Policy to [email protected], or by telephone to Arena customer support staff at 866.341.4424, or via postal mail to PTC Inc., 121 Seaport Blvd., 13th Floor, Boston, MA 02210, USA.

If you are a resident of a European Union member state or Switzerland, you also have the right to seek assistance from the data protection authorities. Click here for EU Data Protection Authorities and click here for Swiss Federal Data Protection and Information Commissioner.