Arm Privacy Policy

We are committed to safeguarding the privacy of users of Arm products, services and websites operated by or on behalf of ARM Limited (“Arm”).

This policy explains how we collect, use and safeguard Personal Data that you provide or which is generated by us when you use any Arm product, service or website.

In this Privacy Policy, “Personal Data” is any personal information which on its own or when combined with other information relates to and identifies a living individual. "Data Protection Legislation" means the EU Data Protection Directive 95/46/EC, the Electronic Communications Data Protection Directive 2002/58/EC, the Privacy and Electronic Communications (EC Directive) Regulations 2003 in each case, as amended, revised or replaced from time to time (in particular, by operation of the Directive 2009/136/EC, and the General Data Protection Regulation (EU) 2016/679 ("GDPR")) and all applicable national implementing legislation and guidelines (including in the UK if the UK leaves the EU), in each case, as amended, revised or replaced from time to time.

This policy applies to Arm and its subsidiaries, for which Arm is a data controller. Arm is a company registered in England and Wales with company number 2557590. If you have any questions about this Privacy Policy, please contact us at our registered address: Arm Limited, Attn Legal Department, 110 Fulbourn Road, Cambridge CB1 9NJ, United Kingdom. Alternatively, you may email us at privacy@arm.com.

 

Contents

  1. Personal Data we collect
  2. Where we process or store Personal Data
  3. Links to other websites
  4. How we use Personal Data
  5. Disclosure to third parties
  6. Security
  7. Data retention
  8. Your rights
  9. Children
  10. Changes to this Privacy Policy

 

1 - Personal Data we collect

Information provided by you

If you sign up for any of our products or services, or visit a website operated by or on behalf of Arm (an “Arm Website”), you provide certain information to us in order to set up and maintain an account with us (“Account Data”). This may include information such as your name, title, company, mailing address, email address, phone numbers, fax numbers, age range and payment information.

You may also provide information to us when you report a problem with one of our products or services, or with an Arm Website, when you contact us with an account management question, a technical problem, to comment on an Arm Website, or when you ask for information about our products or services. You may choose not to provide certain types of Personal Data to us, but please be aware that in that case some functionality may not be available to you. We will let you know prior to collection of the information whether the provision of Personal Data we are requesting is compulsory or voluntary, and the consequences of not providing that information.

We may collect additional information in relation to specific products or services:

1.1 Mbed Cloud

Mbed Cloud provides the cloud services and tools to make the creation and deployment of commercial, standards-based IoT solutions possible at scale. You can find out more about Mbed Cloud and how it works here.

Mbed Cloud Account Data includes your login information, IP address, choices that you make such as accepting terms of use or other legal agreements and actions you take on our customer portal relating to your account or your devices, and time and length of access.

In addition to Account Data, we also process Personal Data that you provide to Arm via the Mbed Cloud services in connection with your Mbed Cloud account (“Customer Data”), as well as Personal Data that Arm captures from providing the Mbed Cloud services to you (“Metadata”). Customer Data includes device IDs, time stamps, authentication records, location information, carrier service used, signal strength, the origin, destination, type and quantity of traffic passed and other operational data. Metadata includes log data relating to date and time of Customer Data being transmitted from an IoT device to Mbed Cloud and then to your software application, or vice versa. The logs also include the size of Customer Data transmitted.

Arm’s role under Data Protection Legislation depends on the nature of the data processing. In each case, Arm will either be a data controller or data processor. The terms data controller and data processor are defined in Data Protection Legislation, but put simply, a “data controller” is a person who either alone or with other persons determines the purposes for which and the manner in which Personal Data is processed. In contrast, a “data processor” processes Personal Data on behalf of a data controller. Although a final determination will depend on the facts, it may be helpful to consider that generally speaking, Arm acts as a data controller in respect of Account Data, and Arm is a data processor in relation to Customer Data and Metadata.

1.2 Arm University Program

The Arm University Program facilitates the use of Arm technology for education and research. You can find out more about the Arm University Program here.

We collect Personal Data provided by you when you contact us, take part in online surveys, giveaways or other competitions, or subscribe to our newsletter. The information we collect may include your name, email address, occupation, employment details, institution details, and residential address.

1.3 Arm Education Media

Arm Education Media is a business division of Arm providing interactive online courses, textbooks and e-textbooks. You can find out more about Arm Education Media here.

If you are registered to take a course on Arm Education Media’s digital content hub in your individual capacity, you may be invited to complete survey questions on your learning experience and capability self-assessment. If you are registered to take a course on Arm Education Media’s digital content hub via an institution, you may be invited to complete survey questions (either during or on completion of the course) on the climate at your institution, your learning experiences and capability self-assessments. In each case participation in surveys is voluntary.

1.4 Arm Community

Arm Community hosts discussions, blogs and information which help to deliver an Arm-based design efficiently through collaboration with Arm engineers, our ecosystem of partners and tech enthusiasts. You can find out more about the Arm Community here.

In order to use the Arm Community site, you are asked to register an account or provide your existing Arm Community account. You may be asked to input certain fields of Personal Data including your email address, display names, user names, a profile picture and any profile information you choose to contribute to the Arm Community site which may include your job title, your phone number, your expertise, your company, your biography, your location, your interests, any social media links you may have, or a link to a blog or a website you may have. You may also choose to include your fields of interest, your profession and the length of your experience in that profession.

1.5 Arm Websites

Our web server logs, browser cookies and local shared objects may collect details of your domain name, operating system, browser type, IP address, a unique identifier for your computer, or other access device and details of your visits to an Arm Website including, but not limited to, traffic data, location data, weblogs and other communication data, the services and resources that you access and your use of such resources.

We collect and store information about your visit to Arm Websites automatically using browser cookies (files which are sent by us to your computer) or similar technology which we can access when you visit an Arm Website in future. To read more about cookies and local shared objects please read our Cookie Policy.

2. Where we process or store Personal Data

Arm stores data on servers in the European Economic Area (“EEA”) and also transfers and stores Personal Data outside the EEA.

Please note that privacy laws in countries outside of the EEA may not be the same as, and in some cases may be less protective than, privacy laws in your country. We transfer data relying on adequate mechanism under EU privacy laws, including EU standard Model Clauses and Privacy Shield.

When we transfer Personal Data to servers controlled by a third-party data hosting company either within the EEA or operating outside of the EEA, we conduct security checks on these companies to ensure adequate safeguards are in place to protect the transfer of Personal Data. We take steps reasonably necessary to ensure that Personal Data is transferred securely. Unfortunately, the transmission of information via the internet, server, database, network or email transmission is never fully secure or error free. Although we do our best to protect Personal Data, we cannot guarantee the security of the Personal Data you transmit to us, and you accept the inherent risk associated with such transmission.

2.1 Mbed Cloud

The two main suppliers for Mbed Cloud are based in the US and Canada respectively. The US-based supplier is Privacy Shield certified. In relation to the Canada-based supplier, the European Commission has found that Canada provides an adequate level of protection for personal data.

Arm also shares Personal Data with Arm subsidiaries in Israel and Finland, as essential parts of Mbed Cloud services are processed from these locations.

 3. Links to other websites

Arm Websites may contain links to third-party websites. These sites are owned and operated independently from us, and have their own separate privacy and data collection practices. Any Personal Data that you provide to these websites will be governed under the terms of the privacy policy of that website. We cannot accept liability for the actions or policies of these independent sites, and are not responsible for the content or privacy practices of such sites.

4. How we use Personal Data

We use Personal Data for our legitimate business interests, with your consent, or in order to comply with our legal obligations.

We process Personal Data for the following purposes:

4.1 Operating, maintaining and improving our products and services – we use your Personal Data to operate our business. This means we use your data to provide a product or service to you, to provide you with technical support, to respond to your questions, to provide further information in respect of products and services you have purchased from us, to determine trends and measure site usage which aids in the design of new products and services, to protect against wrongdoing, and to enforce our website terms and conditions of use and other agreements.

4.2 Marketing – we use your Personal Data to provide, administer and communicate with you about products, services, events, surveys and promotions by Arm or our subsidiaries, to send you marketing communications, to display content and advertising that we believe might be of interest to you, and to serve advertising, including third-party advertising, through our websites.

You have the right to request us to not use your Personal Data for marketing communications. You can opt out of receiving electronic communications by clicking on the ‘unsubscribe’ link at the bottom of any such electronic communication or through following the opt-out instructions provided in any marketing communication, or by adjusting your subscription settings for your account.

In addition, we process your Personal Data for the following further purposes in relation to certain products and services:

4.3 Mbed Cloud

In the context of Mbed Cloud, we process your Personal Data 1) for forensics purposes, which includes investigating and preventing security incidents such as breaches, attacks and hacks; and 2) for audit purposes, which includes use for administrative purposes, such as billing and transaction logs.

4.4 Arm events

We use your Personal Data in order to administer any Arm events you register to attend, and may pass your Personal Data to our event partners for the purposes of effectively running such events. For example, our event partners may use your Personal Data to help organise the event or help us register attendees at the event, schedule meetings at the event and administrate an application for the event.

4.5 Social media

If you connect or integrate any social media services with services we provide, you may receive social notifications either from us or from third-party companies providing social media services. You can manage these social notifications by changing your privacy settings on the relevant social media site or by discontinuing any interaction with the third-party site. If you register and provide information to a forum or blog, the information you provide will be published for anyone to see. Where you create a connection between Arm services and third-party sites, we may collect, use, disclose, transfer and store or retain information relating to your account with such third-party services in accordance with this Privacy Policy.

4.6 Recruitment and careers site

We collect information when you submit online applications for jobs advertised on Arm Websites. We use your Personal Data to process your application including requesting you to complete psychometric and or technical testing and in order to review any profiles you make publically available on social media channels.

We may also pass your information to third parties to:

  1. help process your application;
  2. facilitate video interviews with yourself on our behalf;
  3. conduct further screening to process the application you submit; and
  4. to administer and initiate psychometric and or technical testing on our behalf.

4.7 Arm University Program

We use Personal Data that you have provided to us to provide you with information, products or services that you have requested. We also use Personal Data to provide you with marketing information in relation to the same or similar products or services that you have already requested from us, where you have indicated that you wish to receive such information. We use Personal Data to conduct market research and to inform you of the development of our future programs, products and services.

4.8 Arm Education Media

In respect of Arm Education Media’s digital content hub, we use Personal Data that you have provided to us to:

  1. Verify who you are - we use your Personal Data to enable us to verify that you are registered to take our course and to provide you with access to restricted areas of the Arm Education Media website for the purposes of completing our course.
  2. Track your progress - we may track your progress through the course and whether you have met the requirements for successful training by asking you to complete a quiz at the end of the course. We may share this information with your institution and we may also use it in an anonymized form to generate usage statistics.
  3. Comply with contractual obligations - we may use your information to carry out our obligations arising from the agreement between us and the institution with which you are registered (for example, disclosing to the course administrator at your institution the outcome of the quiz you take at the end of the course).
  4. Answer your questions – We request your Personal Data via the “contact us” page on the Arm Education Media website so that we can respond to you about your question. Personal Data submitted by you in this way will not be added to our customer databases. We may collate statistics regarding the types of questions submitted to us via the “contact us” page in aggregate form so that we can effectively monitor the website and improve levels of service.
  5. Send you newsletters – if you register with us, you will receive Arm Education Media newsletters, via the email address you have provided. You have the option to unsubscribe from these newsletters at any time.
  6. Send you surveys – If you are registered to take a course in your individual capacity and you choose to respond to surveys, Arm will gather data, process it and use it anonymously to improve our products and levels of service. We may aggregate survey data with data from other institutions participating in the same courses and use it as benchmark data for institutional comparison purposes.

4.9 Your Arm Community account

We use the Personal Data that you have provided to us to:

  1. Create user profiles by running a report on professional fields of interests and other Personal Data that is provided as part of your profile. However, we only use this for internal marketing purposes.
  2. Conduct competitions – if you have registered for a competition on the Arm Community platform, we may use your contact details registered on your profile to contact you in respect of the relevant competition.
  3. Communicate with you about content you have contributed – if you engage in a conversation on the Arm Community site, we may use your Personal Data to respond to you in respect of this conversation.
  4. Integrate with other Arm Websites – we may integrate the Arm Community site with other Arm Websites in the future and use content you have posted on the Arm Community site on other Arm Websites. We only link to your display name when posting such content on other Arm Websites. The type of content that may appear on other Arm Websites is topical conversations in relation to specific products or services at Arm. We only use content in this way if the content is posted in an open forum.
  5. Contact you regarding any infringing content – we may use your contact details if we need to contact you in respect of content that you have contributed that may infringe third-party intellectual property rights.
  6. Update and improve our products and services – during your use of the Arm Community site, and during any subsequent changes, updates or attempts to resolve issues you bring to our attention, we may access and collect technical information from or about your use of the services including which devices are used in connection with your use of the Arm Community site. We may use this information for changes to the services or security or maintenance associated with your use of the Arm Community site.

We endeavour to keep private any conversations you may have on the Arm Community site and to make these conversations only accessible to administrators of the Arm Community site and any parties that you make these private conversations public to.

5. Disclosure to third parties

We consider your information to be a vital part of our relationship with you. We do not sell your Personal Data to third parties, including to third-party advertisers.

There are, however, certain circumstances in which we may disclose, transfer or share your Personal Data with certain third parties without further notice to you, as set forth below:

5.1 Business Transfer or Asset Sale

In the event that we sell or buy any business or assets, or if Arm, or substantially all of its assets are acquired by a third party, the relevant Personal Data held by us will be one of the transferred assets.

5.2 Legal Requirement

We may use or disclose your Personal Data in order to comply with a legal obligation, to prevent loss of life or injury, or to protect the rights or property of Arm. Where possible we will tell you in advance of such disclosure.

5.3 Suppliers, consultants and other third parties

We disclose Personal Data in the ordinary course of business when we engage suppliers to help provide products and services to you. For example, we may engage marketing agencies, database service providers, backup and disaster recovery service providers, email service providers and others. We provide Personal Data to third parties solely for the purposes of delivering our products and services.

We may share aggregated demographic data with our partners or third-party providers. This data is not linked to any information that can identify any individual person.

5.4 Social media connections

If you connect or integrate any social media services with services we provide, you may receive social notifications either from us or from third-party companies providing social media services. You can manage these social notifications by changing your privacy settings on the relevant social media site or by discontinuing your interaction with the third-party site. If you register and provide information to a forum or blog, the information you provide will be published for anyone to see. Where you create a connection between Arm services and third-party sites, we may collect, use, disclose, transfer and store or retain information relating to your account with such third-party services.

In addition, we may share Personal Data about you as described below in relation to certain products or services:

5.5 Mbed Cloud

Arm may share your Personal Data with your consent or as necessary to complete any transaction or to provide any product or service which you have requested or authorized. Arm engages suppliers to operate and maintain the security of Mbed Cloud, and to help prevent or stop an attack on our systems or networks.

Arm has engaged a UK-based supplier to provide a security operations center for Mbed Cloud. Arm has also engaged a US-based supplier with operations in India to support Mbed Cloud. Arm has put in place model clauses with the US-based supplier to govern the processing of Personal Data.

5.6 Developer.arm.com and Keil.com

If you request information regarding Arm’s development tools we may share your Personal Data with our approved distributors who cover distribution of Arm’s development tools in your country and they will supply you with the requested information.

We partner with other embedded tool companies and semi-conductor manufacturers to provide you with important or interesting information about products or services that you may find beneficial. We may provide your Personal Data to these third parties to enable them to provide you with such information.

If you purchase a licence for a Keil software tool, in order to activate such licence you will be asked to provide us with certain Personal Data including your name, email address and organisation. We may share this information with individuals employed by your organisation who have registered Keil software licences with us using the same domain name as you, solely for the purposes of monitoring and administering licence registrations and assisting your organisation in complying with licensing mechanisms.

If you wish to update or change any information we hold about you regarding the Keil pages of an Arm Website you may complete our Keil customer information maintenance form. If you wish to remove your email address from our Keil product update mailing list, you may do so here.

5.7 Arm University Program

In order to respond to an enquiry or request for information from you, or to fulfill an order received from you, we may share your contact details, your enquiry and/or your order (as the case may be) with an approved local representative for the country in which you are resident. This representative may not be located in the country in which you are resident.

5.8 Arm Education Media

In order to respond to an enquiry or request for information from you, or to fulfill an order received from you, we may share your contact details, your enquiry and/or your order (as the case may be) with an approved local representative for the country in which you are resident. This representative may not be located in the country in which you are resident.

If you are registered on Arm Education Media’s digital content hub to take a course via an institution and you choose to answer surveys, Arm will collect data from your responses and pass such data back to your institution in a way that does not allow your institution to identify you, to assist your institution to assess the effectiveness of their training schemes. You should note that certain survey questions may allow for open or free text responses. We do not review, edit or moderate such responses before submission to your institution so you should not identify yourself expressly or by including comments which would allow your institution to be able to identify you. We do not accept any responsibility or liability if you are identified as a result of comments you have made in a survey. If we believe that the information you submit is unlawful or potentially damaging to others, we reserve the right to disclose your identity to third parties to the extent that it is reasonably necessary in our opinion to prevent, remedy or take action in relation to such conduct.  

6. Security

We have appropriate security measures in place to protect against loss, misuse or alteration of information that we have collected. We use industry-standard encryption technologies when transferring and receiving Personal Data, we use network access control technology to limit access to the systems on which Personal Data is stored, and we monitor for possible vulnerabilities and attacks. Unfortunately, we cannot guarantee that the technical, physical and organizational measures we take will prevent every security threat, nor can we guarantee that your Personal Data will not be improperly accessed, used, altered or destroyed.

6.1 Mbed Cloud

By collecting or storing your Personal Data, we do not undertake to be bound by any additional information security measures that may apply to you or your Personal Data under other laws, or additional protection that applies to the processing of sensitive personal data, unless we have agreed in a separate services agreement to do so.

If we become aware that there has been a breach in security of any of the Personal Data that we store or that is stored by our third-party service providers, we will promptly notify you as required by law and consistent with our need to determine the scope of the breach and to safeguard our systems.

7. Data retention

We keep Personal Data only for as long as necessary for the purposes for which it was collected, to provide you with products or services, for legitimate business interests including audit and forensics purposes, and where required or permitted by law. Please note that even if we delete your Personal Data it may persist on backup or archival media for an additional period of time.

8. Your rights

You have the right to access (review, correct, amend or delete) your Personal Data. You are responsible for providing Arm with accurate and complete Personal Data, and for contacting us if correction of such information is required.

9. Children

We do not knowingly collect Personal Data from children without insisting that they seek prior parental or legal guardian consent if required by applicable law. We encourage parents and legal guardians to monitor their children’s internet usage and not to allow children to provide Personal Data through Arm services without their permission. The definition of child is as defined under Data Protection Legislation.

10. Changes to this Privacy Policy

We may revise this Privacy Policy at any time by amending this page, and where appropriate, by notification on our homepage. You should check this page from time to time to review any changes we have made.

Effective date: October 20, 2017, SP-LES-PRE-20809 Version: 0.7, Copyright (c) 2017 ARM Limited