Legal

ARENACX PRIVACY POLICY

Last Updated: September 16, 2026

ArenaCX, Inc. (“ArenaCX,” “we,” “us,” or “our”) respects your privacy. This Privacy Policy (the “Policy”) explains how ArenaCX collects, uses, discloses, retains, and otherwise processes personal information in connection with ArenaCX-controlled websites, website forms, provider and partner applications, authenticated website functions, and related activities described below.

This Policy also describes privacy choices and rights that may be available to you under applicable law.

1. Scope of This Policy

1.1 Covered Sites and Activities.

This Policy applies to personal information that ArenaCX processes in connection with:

(a) arenacx.com;

(b) the ArenaCX Provider Network website, including providers.arenacx.com when made available at that domain and ArenaCX-controlled Provider Network pages that link to this Policy;

(c) the ArenaCX Channel Partner website, including channel.arenacx.com when made available at that domain and ArenaCX-controlled Channel Partner pages that link to this Policy, including applicable inquiry, sign-in, and authenticated portal functions;

(d) other ArenaCX-controlled websites or webpages that expressly link to this Policy;

(e) customer, supplier, provider, Channel Partner, public-sector, and similar business inquiries or applications submitted through the foregoing websites; and

(f) other ArenaCX-controlled website functions or workflows that expressly link to this Policy.

The websites, webpages, forms, portal functions, and related activities described above are collectively referred to in this Policy as the “Sites.”

1.2 Separate Commercial and Platform Relationships.

ArenaCX also operates a broader commercial and Marketplace ecosystem and may process personal information in connection with customer agreements, Talent Partner Agreements, Channel Partner Agreements, Marketplace participation, customer or provider transactions, sourcing activities, payment or billing processes, data processing agreements, and other commercial relationships.

To the extent personal information is processed under a separate written agreement, that agreement and any applicable data-processing terms may establish additional or different rights and obligations.

This Policy does not amend, supersede, or modify any separate agreement.

Where ArenaCX processes personal information solely on behalf of another organization as a processor, service provider, or contractor, the organization that determines the purposes and means of the processing may be responsible for responding to requests concerning that information.

1.3 External Portals and Workflows.

Certain Sites may direct you to another ArenaCX platform or to a third-party service. For example, the Provider Network Site currently provides links through which an existing provider may continue onboarding through Moxo and may access the ArenaCX Provider Portal.

The current Provider Network Site does not automatically transmit Provider Application information, form values, or other Site-submitted information to Moxo or the ArenaCX Provider Portal when you select those links. Instead, you leave the Provider Network Site and interact with the destination environment separately.

Where another ArenaCX platform is governed by a separate agreement or privacy notice, that agreement or notice may apply to processing occurring within that environment. Where an independent third party processes personal information for its own purposes, that third party’s privacy notice governs its independent processing.

1.4 ArenaCX as Controller.

For personal information covered by this Policy for which ArenaCX determines the purposes and means of processing, the controller or business responsible for the information is:

ArenaCX, Inc.
5540 Centerview Drive
Suite 200 PMB262
Raleigh, NC 27606
United States

Privacy Contact: legal@arenacx.com

2. Personal Information We Collect

The personal information ArenaCX collects depends on the Site you use and how you interact with ArenaCX.

2.1 Contact Information.

ArenaCX may collect information such as your first and last name, business email address, telephone number, and similar business contact information.

2.2 Business and Professional Information.

ArenaCX may collect your company or organization name, job title or professional role, business affiliation, company website, industry, services, business capabilities, and information concerning the capacity in which you are contacting ArenaCX.

2.3 Customer, Supplier, and Public-Sector Inquiry Information.

If you submit an inquiry through the ArenaCX corporate website, ArenaCX may collect information such as:

(a) your name;

(b) company or organization;

(d) telephone number, if provided;

(e) the type of organization or capacity in which you are contacting ArenaCX;

(f) information concerning the business objective, need, product, or service about which you are contacting ArenaCX;

(g) free-text information you voluntarily provide;

(h) solicitation or RFP information and deadlines, where applicable; and

(i) a website or other business link, where applicable.

2.4 Provider Network Application Information.

If you submit a Provider Network Application, ArenaCX may collect information such as:

(a) your first and last name;

(b) work email address;

(d) company name and company website;

(e) primary services;

(f) supported languages;

(g) countries of service;

(h) approximate global delivery workforce;

(i) enterprise certifications or compliance capabilities;

(j) information describing how your company differentiates itself; and

(k) other business information you voluntarily provide.

2.5 Channel Partner Inquiry Information.

If you submit a Channel Partner inquiry, ArenaCX may collect information such as:

(a) your name;

(b) company or organization;

(d) telephone number, if provided;

(e) organization or partner type;

(f) information concerning how you would like to work with ArenaCX; and

(g) information concerning a relationship, opportunity, or current business opportunity that you voluntarily provide.

2.6 Channel Partner Account and Authentication Information.

Where you use ArenaCX’s Channel Partner sign-in or authenticated portal functions, ArenaCX may process:

(a) your work email address;

(b) authentication and session identifiers;

(d) authorized-contact information;

(e) account, invitation, activation, and access status;

(f) user or account identifiers;

(g) administrative authorization information; and

(h) other information reasonably necessary to authenticate authorized users, administer portal access, and maintain the applicable Channel Partner relationship.

2.7 Communications and Submissions.

ArenaCX may collect messages, questions, comments, feedback, and other information you voluntarily provide when communicating with ArenaCX.

2.8 Device, Browser, and Request Information.

When you access a Site, ArenaCX and its hosting or infrastructure providers may process technical information associated with delivering and securing the Site, such as:

(a) Internet Protocol address;

(b) browser type;

(d) device type;

(e) referring URL or webpage;

(f) requested page or route;

(g) date and time of access; and

(h) standard request, security, and network information.

ArenaCX does not use the current Site application code to request GPS coordinates or browser-based precise geolocation.

2.9 Site Interaction and Analytics Information.

Where optional analytics are activated and you have provided the required consent, ArenaCX may process information concerning Site interactions, such as pages viewed, navigation paths, calls-to-action selected, form interaction events, outbound links, and similar Site-performance information.

As described in Section 4, optional Google Analytics measurement is not currently active on the Sites.

2.10 Privacy Preference Information.

ArenaCX stores information concerning choices made through the Privacy Choices mechanism, including whether optional analytics have been accepted or rejected and the date on which the applicable preference was recorded.

2.11 Information From Other Sources.

ArenaCX may receive personal information from:

(a) your employer or organization;

(b) customers, providers, partners, suppliers, and other business contacts;

(d) service providers acting on ArenaCX’s behalf;

(e) publicly available professional or business sources; and

(f) other persons where you have authorized or directed the disclosure.

3. Sensitive and Regulated Information

3.1 Public Website Forms Are Not Intended for Sensitive Data.

The public Sites are not designed to serve as secure data rooms or as collection mechanisms for highly sensitive or specially regulated information.

Unless ArenaCX expressly requests information through a secure method intended for that purpose, please do not submit through a public Site form:

(a) Social Security numbers or comparable national identification numbers;

(b) passport or driver's-license numbers;

(d) passwords, authentication credentials, or security codes;

(e) medical records or protected health information;

(f) biometric templates or genetic information;

(g) classified government information;

(h) Controlled Unclassified Information;

(i) export-controlled technical information requiring specialized handling;

(j) information concerning criminal convictions or offences;

(k) special-category personal data under Article 9 of the GDPR; or

(l) another person's confidential information that you are not authorized to disclose.

3.2 Sensitive Personal Information.

ArenaCX does not intentionally collect sensitive personal information through ordinary public Site forms for the purpose of inferring characteristics about individuals.

If ArenaCX later establishes a process that intentionally collects sensitive information, ArenaCX will provide any additional notice or obtain any consent required by applicable law.

4. Cookies, Local Storage, Analytics, and Privacy Choices

This Section describes cookies, local storage, analytics, and similar technologies used in connection with the Sites.

4.1 Storage and Access Technologies.

The Sites may use cookies, browser or web storage, scripts, tags, and similar technologies for purposes such as:

(a) delivering and operating the Sites;

(b) maintaining security;

(d) remembering privacy preferences;

(e) preventing abuse;

(f) managing Site functionality; and

(g) performing optional analytics if and when those analytics are activated and you provide the required consent.

Not all such technologies are technically “cookies.” For example, ArenaCX uses first-party localStorage to remember Privacy Choices selections.

4.2 Privacy Choices Mechanism.

ArenaCX provides an on-site Privacy Choices mechanism through which visitors may select:

Accept All. This records permission for necessary technologies and any optional analytics technologies that ArenaCX has activated consistent with this Policy.

Reject Non-Essential. Necessary technologies remain available, but optional analytics are not permitted to activate.

Manage Preferences. This permits you to review and select among available optional technology categories.

Unless and until you affirmatively permit optional analytics, the Sites treat optional analytics as disabled.

4.3 Necessary and Operational Technologies.

Certain technologies operate independently of an optional analytics choice where reasonably necessary to deliver, secure, authenticate, or operate a Site.

Depending upon the particular Site, these may include:

(a) hosting or deployment-routing technologies;

(b) security or bot-management technologies;

(d) technologies used to remember your Privacy Choices selection;

(e) anti-abuse and rate-limiting functions; and

(f) other technologies necessary to provide requested Site functionality.

Selecting Reject Non-Essential does not disable technologies reasonably necessary for these operational purposes.

4.4 Third-Party Resources.

Certain Sites may retrieve fonts, content, security resources, or other technical assets from third-party service providers. When your browser requests a resource directly from a third-party host, that provider may receive technical information ordinarily associated with an Internet request, such as your IP address, browser or user-agent information, requested resource, and referring-page information.

These operational requests are separate from ArenaCX’s optional analytics functionality and may occur regardless of your analytics selection.

4.5 Remembering Your Privacy Selection.

When you make a selection through Privacy Choices, the applicable Site stores a first-party localStorage record containing the analytics choice and the date on which the choice was made.

The Sites are configured to treat the preference as valid for up to twelve (12) months. The expiration period is enforced by application logic rather than by assuming that localStorage automatically expires.

After the applicable twelve-month period expires, the preference is treated as undecided and the Site may request a new selection.

Your selection may need to be made again sooner if:

(a) you change your preference;

(b) you delete localStorage, cookies, or Site data;

(d) you use a private, incognito, or similar browsing mode;

(e) you use another browser, browser profile, device, or Site origin; or

(f) ArenaCX makes a technical or substantive change requiring a new selection.

Privacy Choices are stored separately in the applicable browser environment and are not necessarily shared among arenacx.com, the Provider Network Site, the Channel Partner Site, different browsers, or different devices.

4.6 Changing or Withdrawing Your Choice.

You may reopen the Privacy Choices interface at any time by selecting the “Privacy Choices” control in the applicable Site footer.

You may then change or withdraw your prior analytics selection.

Where processing is based upon consent, withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

If ArenaCX materially changes the purposes for which optional analytics or similar technologies are used, ArenaCX will request a new choice where required by applicable law rather than relying upon consent provided for a materially different purpose.

4.7 Google Analytics and Google Tag Manager.

ArenaCX has implemented technical functionality capable of supporting Google Tag Manager (“GTM”) and Google Analytics 4 (“GA4”) subject to the Privacy Choices mechanism.

As of the Last Updated date of this Policy, optional GTM/GA4 measurement is not active on the Sites. Accordingly, optional GTM/GA4 measurement does not currently load even if a visitor selects Accept All.

If ArenaCX activates optional GTM/GA4 analytics in the future, the Site configuration will require affirmative analytics permission through Privacy Choices before optional analytics are permitted to load.

ArenaCX does not intend to configure analytics events to transmit names, business email addresses, telephone numbers, company names, free-text inquiry or application content, RFP or solicitation text, or other Site form values to GA4.

ArenaCX will update this Policy where required if its analytics practices materially change.

4.8 Advertising and Retargeting Technologies.

The Sites do not currently use Meta Pixel, LinkedIn Insight Tag, Google Ads remarketing tags, DoubleClick, or comparable advertising, retargeting, session-replay, or cross-site behavioral tracking technologies.

ArenaCX does not currently use the Sites to create cross-site behavioral advertising audiences.

If ArenaCX materially changes these practices, ArenaCX will provide any notice, consent, or opt-out mechanism required by applicable law before implementing the changed processing.

4.9 Global Privacy Control and Other Browser Signals.

Global Privacy Control (“GPC”) and similar universal opt-out mechanisms generally relate to statutory rights to opt out of activities such as the sale of personal information or targeted or cross-context behavioral advertising.

ArenaCX does not currently use GPC as a signal for granting or withdrawing optional analytics consent, and the current Sites do not contain sale or targeted-advertising functionality for a GPC signal to disable.

Optional analytics remain disabled unless affirmatively permitted through Privacy Choices, regardless of whether a browser transmits a GPC signal.

If ArenaCX’s practices change such that recognition of a universal opt-out mechanism becomes applicable, ArenaCX will implement the required controls and update this Policy as appropriate.

A traditional browser “Do Not Track” setting is not necessarily equivalent to GPC or another legally recognized universal opt-out mechanism.

5. How ArenaCX Uses Personal Information

ArenaCX may use personal information for the following purposes.

5.1 Responding to Inquiries.

ArenaCX may use personal information to respond to questions, contact requests, customer inquiries, provider inquiries, supplier inquiries, and public-sector inquiries and to route those inquiries to appropriate ArenaCX personnel.

5.2 Evaluating Business Relationships.

ArenaCX may use personal information to evaluate, establish, administer, and communicate concerning potential or existing customer, provider, supplier, channel, referral, or other business relationships.

5.3 Facilitating Requested Introductions.

Where you ask or authorize ArenaCX to facilitate an introduction, sourcing activity, provider discussion, or other business interaction, ArenaCX may use information reasonably necessary to facilitate that request.

Submission of a general website inquiry does not, by itself, mean that your personal information will automatically be distributed to members of ArenaCX's provider network.

5.4 Operating and Improving the Sites.

ArenaCX may use information to operate, maintain, troubleshoot, test, secure, and improve the Sites.

5.5 Analytics and Measurement.

Where optional analytics are enabled as described in Section 4, ArenaCX may use Site interaction information to measure Site usage, understand navigation patterns, evaluate form performance, identify technical issues, and improve user experience.

5.6 Communications and Marketing.

ArenaCX may communicate with you concerning:

(a) your inquiry;

(b) requested information;

(d) existing or potential business relationships;

(e) events; and

(f) other relevant business communications.

Where applicable law requires consent for a particular marketing communication, ArenaCX will request that consent separately.

5.7 Security and Fraud Prevention.

ArenaCX may process information to detect, investigate, prevent, and respond to fraud, abuse, malicious activity, unauthorized access, cybersecurity threats, and violations of ArenaCX policies or applicable law.

5.8 Legal and Compliance Purposes.

ArenaCX may process information to:

(a) comply with applicable law;

(b) respond to valid legal process;

(d) maintain required records;

(e) establish, exercise, or defend legal claims; and

(f) protect ArenaCX, its personnel, customers, providers, partners, systems, and other persons.

5.9 Corporate Transactions.

ArenaCX may process information in connection with evaluating or completing an actual or proposed merger, acquisition, financing, reorganization, sale of assets, insolvency proceeding, or similar corporate transaction.

5.10 Aggregated and De-Identified Information.

ArenaCX may create and use aggregated or de-identified information for analytics, research, business planning, Site improvement, and other lawful purposes.

Where information qualifies as de-identified information under applicable law, ArenaCX will not attempt to reidentify it except as permitted by law.

5.11 Channel Partner Authentication and Account Administration.

ArenaCX may process personal information to authenticate authorized Channel Partner users, send or administer sign-in links, establish and maintain authenticated sessions, determine whether a user is authorized to access a partner account, administer partner-company and authorized-contact records, enforce access permissions, manage account or invitation status, and secure authenticated Channel Partner functions.

6. How ArenaCX Discloses Personal Information

ArenaCX may disclose personal information in the circumstances described below.

6.1 Hosting, Infrastructure, Security, and Technology Providers.

ArenaCX may disclose or make personal information available to service providers that host, deliver, secure, maintain, support, or otherwise provide technology used in connection with the Sites.

Depending upon the service, these providers may process technical information such as IP addresses, browser and device information, request metadata, timestamps, authentication or session information, security information, and other information reasonably necessary to provide the applicable service.

6.2 Communications, Collaboration, and Workflow Providers.

ArenaCX may use third-party communications, collaboration, workflow, or business-productivity services to receive, route, review, and administer website inquiries, applications, and other business submissions.

Depending upon the applicable submission, these providers may process the contact, professional, company, business, and free-text information described in Section 2.

6.3 Authentication and Data-Service Providers.

ArenaCX may use third-party authentication, database, cloud, and data-service providers to support authenticated Site functions.

These providers may process information such as work email addresses, authentication or session identifiers, user or account identifiers, partner-company records, authorized-contact information, account or invitation status, access permissions, and related information necessary to authenticate users and administer protected Site functions.

Authentication and session technologies used for these purposes are operationally necessary and are not controlled by the optional analytics preference.

6.4 Website Resource and Analytics Providers.

ArenaCX may disclose technical request information to providers that deliver fonts, content, Site resources, or similar functionality. If ArenaCX activates optional analytics as described in Section 4, applicable analytics providers may also process Site-interaction information after the required privacy choice has been obtained.

6.5 External Portals and Services.

A Site may link to another ArenaCX environment or to a third-party onboarding, workflow, authentication, or portal service.

Selecting an ordinary outbound link does not, by itself, mean that ArenaCX automatically transmits the information you previously submitted through a Site to the destination service. Information you subsequently provide directly through another environment is processed according to the privacy terms applicable to that environment.

6.6 Providers and Business Counterparties at Your Request.

Where you ask or authorize ArenaCX to facilitate an introduction, sourcing activity, provider discussion, or other business interaction, ArenaCX may disclose information reasonably necessary to carry out that request.

ArenaCX does not automatically distribute an ordinary Site inquiry to all members of its provider network merely because the inquiry was submitted.

6.7 Professional Advisors.

ArenaCX may disclose personal information to attorneys, accountants, auditors, insurers, consultants, and other professional advisors where reasonably necessary for their services.

6.8 Legal and Safety Purposes.

ArenaCX may disclose personal information where reasonably necessary to:

(a) comply with applicable law or valid legal process;

(b) respond to governmental or regulatory requests;

(d) enforce ArenaCX’s rights or agreements; or

(e) protect the rights, property, safety, or security of ArenaCX or another person.

6.9 Corporate Transactions.

Personal information may be disclosed to actual or prospective purchasers, investors, lenders, advisors, or other transaction participants in connection with a financing, merger, acquisition, restructuring, sale of assets, insolvency proceeding, or similar transaction, subject to applicable confidentiality and legal requirements.

6.10 At Your Direction or With Your Consent.

ArenaCX may disclose personal information to another person where you request, direct, authorize, or consent to the disclosure.

7. Sale, Sharing, Targeted Advertising, Profiling, and Artificial Intelligence

7.1 Sale of Personal Information.

ArenaCX does not sell personal information for monetary or other valuable consideration. Additional disclosures concerning California’s definitions of “sale” and “sharing” are provided in Section 13.

7.2 Sharing and Targeted Advertising.

The current Sites do not use advertising or retargeting technologies designed to share personal information for cross-context behavioral advertising or to process personal data for targeted advertising as those terms are defined by applicable U.S. state privacy laws.

If ArenaCX materially changes these practices, ArenaCX will provide any notice or opt-out mechanism required by applicable law.

7.3 Profiling and Automated Decisions.

ArenaCX does not use personal information collected through the Sites to make solely automated decisions that produce legal or similarly significant effects concerning individuals.

7.4 Large Language Models and Artificial Intelligence.

ArenaCX does not currently use personal information obtained through the Sites to train ArenaCX large language models.

The current Sites do not contain an ArenaCX-operated chatbot, conversational AI feature, generative-AI integration, or other Site functionality that transmits website inquiries, applications, analytics information, or other Site-submitted personal information to an AI or large-language-model service for processing.

If ArenaCX materially changes these practices, ArenaCX will update this Policy and provide any additional notice, consent, or choice required by applicable law.

8. Data Retention

ArenaCX retains personal information only for as long as reasonably necessary for the purposes described in this Policy, taking into account:

(a) the nature and sensitivity of the information;

(b) the purposes for which the information was collected;

(d) operational, security, and fraud-prevention needs;

(e) contractual and business-record requirements;

(f) applicable legal, regulatory, and recordkeeping obligations;

(g) applicable statutes of limitations; and

(h) the need to establish, exercise, or defend legal claims.

8.1 Website Inquiries and Applications.

ArenaCX retains information submitted through website inquiries and applications for the period reasonably necessary to review and respond to the submission, evaluate or administer a potential or existing business relationship, maintain appropriate business records, satisfy legal or compliance obligations, resolve disputes, and protect ArenaCX’s legal rights.

If an inquiry or application results in an ongoing business relationship, relevant information may become part of the records applicable to that relationship and may be retained accordingly.

8.2 Account and Business-Relationship Records.

Information maintained in connection with authenticated Site functions, company or partner records, authorized contacts, account permissions, and account status may be retained for the period reasonably necessary to establish, administer, secure, and document the applicable account or business relationship and thereafter for legitimate legal, compliance, security, and recordkeeping purposes.

8.3 Technical, Security, and Hosting Records.

Technical, application, hosting, security, and error records may be retained according to ArenaCX’s operational and security needs, applicable service-provider settings, legal requirements, and the nature of the applicable record or security event.

8.4 Analytics Information.

Optional GTM/GA4 analytics are not currently active on the Sites. Before activating optional analytics, ArenaCX will establish applicable analytics-retention settings and update this Policy where necessary.

8.5 Privacy Choices.

The first-party localStorage record used to remember a Privacy Choices selection is treated as valid for up to twelve (12) months from the recorded decision date.

The record may cease to be recognized sooner if you change your selection, clear Site data, use private browsing, use another browser or device, or ArenaCX requires a new selection because of a technical or substantive change.

8.6 Authentication and Session Information.

Authentication and session information may remain available until sign-out, token expiration or refresh, account deactivation, or another event terminating the applicable authenticated session. Related account and business-relationship records are retained according to Section 8.2.

8.7 Privacy-Rights Request Records.

ArenaCX retains records reasonably necessary to document privacy-rights requests and ArenaCX’s responses for the period required by applicable law and for any additional period reasonably necessary to demonstrate compliance or resolve a related dispute.

8.8 Legal and Compliance Records.

ArenaCX may retain information for a longer period where reasonably necessary or required to comply with applicable law, satisfy legal or regulatory obligations, preserve evidence, investigate security or fraud matters, or establish, exercise, or defend legal claims.

9. Data Security

ArenaCX maintains administrative, organizational, physical, and technical measures designed to protect personal information against unauthorized access, acquisition, use, disclosure, alteration, or destruction.

Security measures are selected taking into account the nature of the information, the purposes of processing, and reasonably foreseeable risks.

No method of internet transmission or electronic storage can be guaranteed to be completely secure, and ArenaCX therefore cannot guarantee absolute security.

If ArenaCX becomes aware of a security incident involving personal information, ArenaCX will investigate the incident and provide legally required notices where applicable.

10. Marketing Communications

ArenaCX may send communications reasonably related to an inquiry, requested service, or existing business relationship.

ArenaCX may also send marketing or promotional communications where permitted by applicable law.

Where applicable law requires consent for marketing communications, ArenaCX will request that consent separately from:

(a) acceptance of the Website Terms of Use;

(b) acknowledgment of this Privacy Policy; and

You may unsubscribe from marketing email communications through the unsubscribe mechanism contained in the applicable email or by using the contact information provided in Section 18.

An unsubscribe request will not prevent ArenaCX from sending non-promotional communications reasonably necessary to respond to an inquiry, administer an existing relationship, provide requested information, or satisfy legal obligations.

11. Privacy Rights and Requests

Depending upon where you reside and the law applicable to ArenaCX's processing, you may have rights concerning your personal information.

11.1 Access and Confirmation.

You may have the right to confirm whether ArenaCX processes personal information about you and to obtain access to that information.

11.2 Correction.

You may have the right to request correction of inaccurate personal information.

11.3 Deletion.

You may have the right to request deletion of certain personal information, subject to applicable exceptions.

11.4 Portability.

You may have the right to receive certain personal information in a portable and, where technically feasible, readily usable format.

11.5 Sale, Sharing, and Targeted Advertising Opt-Outs.

Where applicable, you may have the right to opt out of:

(a) sale of personal information;

(b) sharing for cross-context behavioral advertising;

(d) certain profiling involving decisions that produce legal or similarly significant effects.

The current Sites are not intended to engage in these activities as described in Section 7.

11.6 Sensitive Personal Information.

Where applicable law provides a right to limit or withdraw consent to certain processing of sensitive information, you may exercise that right.

ArenaCX does not intentionally use sensitive information collected through the public Sites to infer characteristics about individuals.

11.7 Object to or Restrict Processing.

Where applicable, you may have the right to object to certain processing or request that processing be restricted.

11.8 Withdraw Consent.

Where ArenaCX relies upon your consent, you may withdraw that consent at any time.

For optional Site technologies, consent may be changed or withdrawn through the Privacy Choices link in the footer.

11.9 Non-Discrimination.

ArenaCX will not unlawfully discriminate against you for exercising an applicable privacy right.

12. Exercising U.S. Privacy Rights

12.1 Request Methods.

Where applicable law provides you with a privacy right, you may submit a request using the following methods:

Email: legal@arenacx.com

Telephone: (833) 273-6229

ArenaCX will respond within the time required by applicable law.

12.2 Verification.

ArenaCX may take reasonable steps to verify your identity before fulfilling a request.

The information requested for verification will depend upon the nature of the request, sensitivity of the relevant information, and risks associated with unauthorized disclosure or deletion.

If ArenaCX cannot reasonably verify a request, ArenaCX may deny or limit the request as permitted by applicable law and will provide an explanation where required.

12.3 Authorized Agents.

Where applicable law permits use of an authorized agent, the agent may submit an appropriate request on your behalf.

ArenaCX may request reasonable evidence of the agent's authority and may separately verify your identity where permitted by law.

12.4 Appeals.

If ArenaCX denies a privacy request and applicable law provides a right to appeal, you may submit an appeal to legal@arenacx.com with the subject line “Privacy Request Appeal.”

ArenaCX will review and respond to the appeal within the period required by applicable law.

Where required, ArenaCX’s response will provide information concerning how you may contact the applicable attorney general or other supervisory authority.

13. California Privacy Disclosures and Notice at Collection

This Section supplements the remainder of this Policy for California residents to the extent the California Consumer Privacy Act (“CCPA”) applies to ArenaCX.

For purposes of this Section, statutory terms such as “personal information,” “sell,” “share,” and “sensitive personal information” have the meanings provided by the CCPA.

13.1 Categories of Personal Information Collected.

Depending upon how you interact with ArenaCX, the Sites may collect the following categories of personal information:

Identifiers. Examples include name, business email address, telephone number, IP address, account or user identifiers, authentication/session identifiers, and Privacy Choices records.

Personal Information Described in California Civil Code § 1798.80(e). Examples may include name, telephone number, and similar contact information.

Commercial and Business Relationship Information. Examples include services requested, customer or supplier inquiries, Provider Network application information, partner-company information, business opportunities, relationship history, and information concerning an existing or proposed business relationship.

Internet or Other Electronic Network Activity Information. Examples may include requested pages, referring URLs, browser and device information, technical request information, Site interactions where optional analytics are enabled, and information associated with authenticated Site sessions.

Professional or Employment-Related Information. Examples include company affiliation, job title or professional role, business contact information, provider capabilities, Channel Partner relationship information, and other professional information submitted in connection with a Site interaction.

Sensitive Personal Information. ArenaCX does not intentionally request sensitive personal information through ordinary public Site forms. If sensitive personal information is submitted contrary to ArenaCX’s instructions, ArenaCX may process it only as reasonably necessary to address, secure, delete, or otherwise lawfully handle the submission.

The current Site application code does not request precise geolocation information.

13.2 Sources.

ArenaCX may obtain California personal information from:

(a) you;

(b) your browser or device;

(d) customers, providers, suppliers, referral sources, and other business contacts;

(e) service providers acting on ArenaCX's behalf; and

(f) publicly available professional or business sources.

13.3 Purposes.

ArenaCX uses these categories for the purposes described in Sections 4 and 5, including:

(a) responding to inquiries;

(b) evaluating business relationships;

(d) optional analytics where enabled;

(e) communications;

(f) fraud and security prevention;

(g) legal compliance; and

(h) other purposes described at or before collection.

13.4 Categories of Recipients.

ArenaCX may disclose applicable categories of personal information to:

(a) hosting, cloud, infrastructure, content-delivery, and security service providers;

(b) communications, collaboration, workflow, and business-productivity service providers;

(d) website-resource and analytics providers, where applicable;

(e) providers, partners, and other business counterparties to whom you direct or authorize ArenaCX to make an introduction or disclosure;

(f) professional advisors;

(g) governmental, regulatory, or legal recipients where disclosure is required or permitted by law; and

(h) transaction participants in connection with an applicable corporate transaction.

Selecting an ordinary outbound link to an external service does not, by itself, constitute an automatic disclosure of information previously submitted through an ArenaCX Site to that destination.

13.5 Retention.

ArenaCX applies the retention periods and criteria described in Section 8.

In general:

(a) Identifiers, professional information, commercial or business-relationship information, and information submitted through website inquiries or applications are retained for the period reasonably necessary to respond to or evaluate the applicable submission, establish or administer a business relationship, maintain appropriate business records, comply with legal obligations, resolve disputes, and protect legal rights;

(b) account, authentication, and relationship information is retained for the period reasonably necessary to administer and secure the applicable account or relationship and thereafter as reasonably necessary for legal, security, compliance, and recordkeeping purposes;

(c) Internet, technical, security, and network-activity information is retained according to operational, security, service-provider, incident-response, and legal requirements;

(d) optional analytics information is not currently collected through active GTM/GA4 measurement on the Sites;

(e) Privacy Choices information is treated as valid for up to twelve (12) months from the recorded selection date unless changed, deleted, invalidated, or otherwise unavailable sooner; and

(f) sensitive personal information submitted contrary to ArenaCX’s instructions may be retained only for as long as reasonably necessary to secure, address, delete, or otherwise lawfully handle the information and satisfy applicable legal obligations.

13.6 Sale and Sharing.

ArenaCX does not sell personal information for monetary or other valuable consideration and has not sold personal information during the preceding twelve (12) months.

The current Sites do not use advertising or retargeting technologies designed to share personal information for cross-context behavioral advertising.

ArenaCX may disclose personal information to service providers, contractors, and other recipients for the business purposes described in this Policy, including website hosting, security, communications, collaboration, workflow management, authentication, business operations, and related technical services. These disclosures are not intended to constitute a sale of personal information.

ArenaCX does not have actual knowledge that it sells or shares the personal information of consumers under sixteen (16) years of age.

13.7 Sensitive Personal Information.

ArenaCX does not use or disclose sensitive personal information collected through the public Sites for purposes that require a right to limit under the CCPA.

13.8 California Rights.

Subject to applicable conditions and exceptions, California residents may have the right to:

(a) know categories and specific pieces of personal information collected;

(b) obtain information concerning sources, purposes, and recipients;

(d) request correction;

(e) opt out of sale or sharing;

(f) limit certain uses or disclosures of sensitive personal information where applicable; and

(g) exercise CCPA rights without unlawful discriminatory treatment.

Requests may be submitted through Section 12.

13.9 Financial Incentives.

ArenaCX does not currently offer a financial incentive, or a price or service difference, through the Sites in exchange for personal information.

14. EEA AND UNITED KINGDOM PRIVACY INFORMATION

This Section applies where the European Union General Data Protection Regulation (“EU GDPR”), United Kingdom General Data Protection Regulation (“UK GDPR”), or related EEA or UK law applies.

14.1 Controller.

For processing covered by this Policy where ArenaCX determines the purposes and means of processing, ArenaCX, Inc. is the controller.

ArenaCX's contact information appears in Sections 1.4 and 18.

14.2 Legal Bases for Processing.

Depending upon the processing activity, ArenaCX may rely upon the following legal bases.

Business Inquiries and Requested Communications. ArenaCX may rely upon its legitimate interests in responding to professional inquiries and developing business relationships. Where an individual is personally a party to a prospective agreement, ArenaCX may also process information as necessary to take steps at the individual's request before entering into a contract.

Provider, Supplier, and Partner Evaluation. ArenaCX may rely upon legitimate interests in evaluating and administering potential business relationships and, where applicable, contractual or pre-contractual necessity.

Site Operation and Security. ArenaCX may rely upon legitimate interests in operating, troubleshooting, securing, and protecting the Sites and ArenaCX systems.

Optional Analytics. Optional GTM/GA4 analytics are not currently active on the Sites. If ArenaCX activates optional analytics in the future, ArenaCX will rely upon consent where required by applicable electronic-communications or data-protection law, and the consent-controlled Site configuration will require affirmative analytics permission before optional analytics are permitted to load.

Requested Introductions. Depending upon the circumstances, ArenaCX may rely upon your request, consent, legitimate interests, or contractual necessity to facilitate an introduction or communication.

Marketing. ArenaCX may rely upon consent where consent is legally required. Where applicable law permits legitimate-interest-based business marketing, ArenaCX may rely upon legitimate interests subject to applicable direct-marketing and electronic-communications requirements.

Legal Compliance. ArenaCX may process information where necessary to comply with a legal obligation.

Legal Claims. ArenaCX may rely upon legitimate interests and other lawful bases in establishing, exercising, or defending legal claims.

Corporate Transactions. ArenaCX may rely upon legitimate interests in evaluating or carrying out legitimate corporate transactions.

Where ArenaCX relies upon legitimate interests, ArenaCX considers the nature of the processing, the relationship with the affected individual, reasonable expectations, potential effects on the individual's rights, and available safeguards.

14.3 EEA and UK Cookie and Analytics Choices.

Where applicable law requires prior consent before information is stored on or accessed from your device for optional analytics purposes, ArenaCX will request that consent through Privacy Choices.

Optional analytics will remain disabled unless enabled by the visitor.

You may withdraw your choice through the Privacy Choices footer link.

ArenaCX's storage of the preference itself is used to remember and implement the choice you made, as described in Section 4.

14.4 EEA and UK Privacy Rights.

Subject to applicable conditions and exceptions, you may have rights to:

(a) obtain access to personal data;

(b) correct inaccurate personal data;

(d) request restriction of processing;

(e) object to processing based upon legitimate interests;

(f) object to direct marketing;

(g) receive certain personal data in a portable format;

(h) withdraw consent where processing is based upon consent; and

(i) lodge a complaint with an applicable supervisory authority.

If you object to processing for direct-marketing purposes, ArenaCX will stop the applicable direct marketing as required by law.

14.5 International Transfers.

ArenaCX is headquartered in the United States. Personal data relating to individuals in the EEA or United Kingdom may therefore be processed in the United States or other countries outside the jurisdiction in which the individual resides.

ArenaCX and service providers supporting the Sites may process personal data in jurisdictions that may have different data-protection laws from those applicable in the EEA or United Kingdom.

Where applicable law restricts an international transfer of personal data, ArenaCX will use a transfer mechanism permitted by applicable law. Depending upon the circumstances, these mechanisms may include:

(a) an applicable adequacy decision;

(b) approved standard contractual clauses or other approved contractual safeguards;

(d) an applicable Data Privacy Framework mechanism where the relevant recipient and transfer are covered by that mechanism; or

(e) another safeguard, exception, or transfer mechanism permitted by applicable law.

You may contact ArenaCX using the information in Section 18 for additional information concerning safeguards applicable to an international transfer where you are entitled to that information under applicable law.

14.6 European Union Representative.

Where ArenaCX is required under Article 27 of the EU GDPR to designate a representative in the European Economic Area, ArenaCX will designate an appropriate representative and make the representative’s contact information available through this Policy or another notice as required by applicable law.

14.7 United Kingdom Representative.

Where ArenaCX is required under Article 27 of the UK GDPR to designate a representative in the United Kingdom, ArenaCX will designate an appropriate representative and make the representative’s contact information available through this Policy or another notice as required by applicable law.

14.8 Supervisory Authority Complaints.

If the EU GDPR applies, you may lodge a complaint with the competent data protection authority in the EEA country where you reside, work, or believe an infringement occurred.

If the UK GDPR applies, you may lodge a complaint with the United Kingdom Information Commissioner's Office.

ArenaCX encourages you to contact us first so that we have an opportunity to address your concern.

15. Children's Privacy

The Sites are intended for business and professional audiences and are not directed to children.

ArenaCX does not knowingly collect personal information through the Sites from children under thirteen (13), and ArenaCX does not intentionally solicit Site submissions from individuals under eighteen (18).

If you believe that a child has provided personal information through a Site inappropriately, please contact ArenaCX using the information in Section 18.

16. Third-Party Websites and Services

The Sites may contain links to websites, portals, applications, onboarding environments, authentication services, or other services operated outside the particular Site you are using.

Selecting an ordinary outbound link does not, by itself, mean that ArenaCX automatically transmits information you previously submitted through an ArenaCX Site to the destination service.

Once you leave the applicable Site, information you provide directly to another environment may be subject to the privacy notice, agreement, or other terms applicable to that environment.

Where an independent third party acts for its own purposes, ArenaCX is not responsible for that third party’s independent privacy practices.

This Section does not limit ArenaCX’s obligations with respect to a service provider processing personal information on ArenaCX’s behalf.

17. Changes to This Privacy Policy

ArenaCX may update this Policy from time to time to reflect changes in:

(a) the Sites;

(b) ArenaCX's information practices;

(d) vendors;

(e) legal requirements; or

(f) business operations.

When ArenaCX updates this Policy, ArenaCX will revise the “Last Updated” date.

Where required by applicable law, ArenaCX will provide additional notice or obtain consent before applying a material change to personal information previously collected.

If ArenaCX materially changes its optional storage, analytics, or tracking practices, ArenaCX will also evaluate whether existing Privacy Choices remain valid or whether a new selection is required.

18. Contact ArenaCX

Questions regarding this Policy or ArenaCX's privacy practices may be directed to:

ArenaCX, Inc.
5540 Centerview Drive
Suite 200 PMB262
Raleigh, NC 27606
United States

Privacy Email: legal@arenacx.com

Telephone: (833) 273-6229

For matters governed by a separate ArenaCX agreement, you may also use the privacy, security, or notice contact identified in that agreement.