Privacy Policy

ARC Ratings Privacy Policy.

This Site, images, Products and Services are Copyright ©2021 ARC Ratings and ARC Hub collectively “ARC”. All rights reserved.

Last updated: 23 September 2021

 

  1. Introduction
  2. Personal Information (PI) ARC may collect about you
  3. ARC may collect PI in relation to you
  4. Purpose and legal basis for processing your personal information
  5. To whom ARC disclose your PI
  6. ARC cookies policy
  7. Marketing and exercising your right to opt-out of marketing
  8. Third-party marketing/sale of PI
  9. PI retention
  10. PI security
  11. Your rights
  12. Contacting ARC
  13. Linked websites
  14. Change to this Privacy Policy

ARC request you take time to carefully read through this information. The information contained within this Privacy Policy is applicable to any person or entity who accesses, uses, relies on, interacts or engages with our Sites, Products and Services.

1 – Introduction

If there are any terms in this Privacy Policy that you do not agree with, please discontinue use of our Sites, Products and Services immediately. This Privacy Policy applies to all information collected through our Sites, Products and Services, as well as any related services, sales, marketing, products and events. Please also read each Website Terms of Use (“Terms”) which govern each ARC website.

ARC are committed to safeguarding your Personal Information (“PI”), your right to privacy and where applicable processing PI in line with applicable privacy and data protection laws as applicable in each jurisdiction we operate in. ARC may use third-party providers to collect and process information, including financial information (for example relating to debit and credit card details to process payments via a third-party) to provide the Sites, Products and Services to you. If you have any questions or concerns about this Privacy Policy, or our practices with regards to your personal information, please contact ARC at communications@arcratings.com.

When you visit the ARC’s websites and, more generally, use any of the ARC’s websites (the Sites and/or our Products and Services (the “Services”), ARC may request certain information from you. References to “you” or “your” refers to individuals whose PI is processed by ARC, including by clients with direct or indirect relationships (such as employees, contingent workers, consultants, officers, agents (together “Representatives” of ARC).

This Privacy Policy sets out the purposes for which ARC may collect, use and disclose (collectively “processing”) PI and how it is treated and protected. Furthermore, it sets out an individuals’ rights in relation to the processing of their PI.

2 – Personal Information ARC or our Service Providers may collect about you

For information purposes only and not advice, please always seek independent advice. PI is information relating to an individual, which can be used either alone or with other sources of information to identify that individual. PI does not include information where the identity of the individual or the specific detail of the information has been removed and is therefore anonymous. Sensitive personal information (SPI) is a sub-category of PI that includes PI relating to race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about health and genetic and biometric data, none of which ARC collects.

The nature of the information that ARC or our Service Providers may collect will depend on the Products and Services ARC provide and ARC’s relationship with you. PI that may be processed by ARC is categorised as follows (the PI listed for each category is non-exhaustive examples):

  • Identification data – Full name, title, date of birth
  • Contact data – Personal address, telephone number, email address
  • Electronic Monitoring data – To the extent permitted by law, ARC my record and monitor your electronic communications with ARC
  • Financial data – Bank account number and details; credit card number and details
  • Marketing and Communications data – Marketing and communication preferences; tracking data relating to whether you have read marketing communications from ARC (please also see our cookies policy – Section 6)
  • Professional Information data – Position/job title, work address; telephone number; email address, sector and area
  • Profile data – Username and password for our online services that you have access to; Services requested; marketing communications responded to; survey responses
  • Services data – Payment details to and from you; details of services you have provided to ARC and ARC have provided to you
  • Product data – details about products you have used, purchased, interacted with and the ways you may interact with our Products
  • Site data – any interaction and data usage or upload onto or with our Sites.
  • Technical data – Your use of and interaction with our Sites, Products and Services including your IP address, browser type, browser type, browser plug in types and versions, operating system, data and technical data inputs and outputs, information you provide onto the platform or download from the platform.
  • Sensitive Personal Information (SPI) – ARC will never collect Sensitive Personal Information.

3 – ARC may collect PI in relation to you in the following ways:

  • when you provide it to ARC in connection with interaction with the ARC Sites, Products or Services, such as a completed account application, system interaction and usage, order, download or purchase
  • throughout the course of the relationship with you, including where you change your details, provide additional PI, or where the services ARC are providing to you change
  • from public sources where you have manifestly chosen to make your PI public, including via public profiles on social media, articles, marketing and through any other platforms or mediums
  • from visits to the ARC Sites or through logging into any of ARC Services or password protected areas and usage or purchase of ARC Products.

ARC may also create or derive PI such as creating records of your interactions with ARC, subject to and to the extent allowed by applicable law.

Unless ARC otherwise indicate that the provision of specific PI is optional, any PI requested is necessary for ARC to provide you or your organisation or entity with the Sites, Products and Services utilised and/or requested. If you do not provide the PI requested, ARC may not be able to provide access to the Sites and usage or the Products and Services and ARC reserves the right not to do so.

4 – Purpose and legal basis for processing your PI

The below table sets out the purposes and basis for which ARC and our third-party service providers may process PI.

Processing purpose Category of PI Basis of Processing
To consider opening an account and purchasing Sites, Products and Services ·        Identification data

·        Contact data

·        Financial data

·        Profile data

·        Services data

 

 ·    Performance of a contract

·    Legal or regulatory obligation

·    Legitimate interests: ensuring ARC do not accept or assist or further any fraudulent or any unlawful activities, such as terrorism or money laundering
To deliver the Sites, Products and Services you have requested ·        Identification data

·        Contact data

·        Financial data

·        Profile data

·        Services data

·        Technical data

·        Marketing & Communications data

 

 ·    Performance of a contract

·    Legal or regulatory obligation

·    Legitimate interests: ensuring that you are provided with the best client services and visitor services ARC can offer, and securing a prompt payment of any fees, costs and debts in respect of our Services
To manage payments, fees and charges and to collect and recover money owed ·    Identification data

·    Contact data

·    Financial data

·    Services data

 

 ·    Performance of a contract

·    Legitimate interests: ensuring ARC can manage payments, fees and charges and to collect and recover money owed
To manage the relationship with you which will include notifying you about changes to ARC terms of business or this Privacy Policy ·    Identification data

·    Contact data

·    Profile data

·    Marketing and Communications data

 

 ·    Performance of a contract

·    Legal or regulatory obligation

·    Legitimate interests: ensuring ARC can notify you about changes to ARC terms of business or this Privacy Policy
(Where applicable) To interact with governmental or regulatory bodies or other competent national authorities ·    Identification data

·    Contact data

·    Financial data

·    Services data

 

 ·    Legal or regulatory obligation

·    Public interest
To detect or prevent fraud and/or other criminal activity and to protect the company and company assets ·    Identification data

·    Contact data

·    Electronic Monitoring data

·    Financial data

·    Profile data

·    Services data

·    Technical data

 

 ·    Legal or regulatory obligation

·    Public interest

·    Legitimate interests: protecting ARC detecting, and protecting against breaches of ARC’s policies and applicable laws

·    Review and update to ensure the systems and Services are adequate
To manage and protect ARC business, including improving data security, troubleshooting data and systems, system maintenance and testing, data hosting, managing our offices and other facilities ·    Identification data

·    Contact data

·    Profile data

·    Technical data

·    Marketing & Communications data

 

 ·    Legal or regulatory obligation

·    Legitimate interests: ensuring the efficient and secure running of ARC business, including through office and facilities administration, maintaining information technology services, network and data security and fraud prevention
To invite you to take part in market insight or other events or similar events, and to manage your participation in them ·    Identification data

·    Contact data

·    Profile data

·    Technical data

·    Marketing & Communications data

 

 ·    Legitimate interests: ensuring ARC client records are up-to-date; promoting ARC’s client services; receiving feedback; improving ARC’s services; identifying ways to expand ARC business
To send you marketing (including by paper and electronic channels) communications and service updates. ·    Identification data

·    Contact data

·    Profile data

·    Technical data

·    Marketing & Communications data

 ·    Legitimate interests: reviewing how clients use, and what they think of, ARC services; identifying ways to improve and expand ARC business

In relation to vendor services (as applicable):

Purpose and/or activity Type of data Legal basis for processing
To engage you or the organisation or entity you work for as a new supplier, including performing background checks ·    Identification data

·    Profile data

·    Contact data

·    Financial data

·    Services data

 ·    Performance of a contract

·    Legal or regulatory obligation

·    Legitimate interests: ensuring ARC do not deal with proceeds of criminal activities or assist in any other unlawful or fraudulent activities for example money laundering or terrorism

·    Public interest

5 – To whom ARC disclose your PI

In connection with one or more of the purposes outlined in the section ‘Purpose and Legal basis for processing your PI’ above, ARC may disclose PI to:

  • professional advisors, third parties, agents or independent contractors that provide services to ARC (including, but not limited to: legal representatives, professional consultants, consultants, contractors, parts suppliers, services suppliers, third party agencies and individuals), which includes their professional advisors, third parties, agents, independent contractors that provide services to them (such as IT systems providers, payment services providers, platform providers, financial advisors, payment processors, brokers, consultants (including legal representatives and accountants));
  • goods and services providers (such as providers of marketing services where ARC is permitted to disclose your personal information to them); payment processors, intermediaries, brokers, and other individuals and entities that partner with ARC;
  • competent authorities (including any national and/or international regulatory or enforcement body, agency, court or other form of tribunal or tax authority) or their agents where ARC is required or allowed to do so under applicable law or regulation;
  • (where applicable) a potential buyer, transferee, merger partner or seller and their advisers in connection with an actual or potential transfer or merger of part or all of ARC’s business or assets, or any associated rights or interests, or to acquire a business or enter into a merger with it;
  • (where applicable) credit reference agencies (including professional and retail agencies) or other organisations that may help ARC to provide data, Products and Services and also to conduct anti-money laundering and anti-terrorist financing checks and to detect fraud and other potential criminal activity; or
  • any person to whom disclosure is allowed or required by local or foreign law, regulation or any other applicable instrument or agency.

6 – Arc Cookies Policy

a. Arc Cookies Policy

Cookies are small text files that are stored in your computer’s memory and hard drive, in your mobile device or tablet when you visit certain web pages. They are used to enable websites to function or to provide information to the owners of a website, or other third parties which receive data obtained from that website.

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it may give you a more personalised web experience.

b. Why do we use cookies?

Cookies help ARC to provide customised services and information. We use cookies on our websites to tell us, in general terms, how and when pages on our websites are visited, what our users’ technology preferences are – such as what type of video player they use – and whether our websites are functioning properly. Depending on their purpose, some cookies will only operate for the length of a single browsing session, whilst others have a longer life span to ensure that they fulfil their longer-term purposes (as explained in more detail below). Please note that, however long the cookies’ active life may be, you can delete cookies (and therefore stop any further data collection by them) as further described below.

When logging into any password-protected user area of our websites, the website may use cookies or other technology to help us authenticate you, store and recognise your configuration and user attributes, facilitate your navigation of the website, and customise its content so that the information made available is likely to be of more interest to you.

In broad terms, we use cookies on our websites for the following purposes:

  • Analytical purposes
    Analytical cookies allow us to recognise, measure and track visitors to our websites and compile a record of this usage information. This helps us to improve and develop the way our websites work, for example, by determining whether site visitors can find information easily, or by identifying the aspects of websites that are of the most interest to them.
  • Usage preferences
    Some of the cookies on our websites are activated when visitors to our sites make a choice about their usage of the sites. Our websites then ‘remember’ the settings preferences of the user concerned. This allows us to tailor aspects of our sites to the individual user.
  • Terms and conditions
    We use cookies on our websites in order to record when a site visitor has seen a policy, such as this one, or provided consent, such as consent to the terms and conditions on our websites. This helps to improve the user’s experience of the sites – for example, it aids in avoiding a situation where a user is asked repeatedly to consent to the same terms. We also track whether a user has seen other similar documents (such as an online survey) before – again, to ensure that a user’s experience of our websites is a smooth one.
  • Functional purposes
    Functional purpose cookies store information that is needed by our applications to process and operate. For example, where transactions or requests within an application involve multiple workflow stages, cookies are used to store the information from each stage temporarily, in order to facilitate completion of the overall transaction or request.
  • Advertising
    Advertising cookies allow us (or third parties) to monitor the behaviour of users of our websites. This information is used to ensure that products and services highlighted to those individuals are targeted in a focused and relevant manner – e.g. through advertisements on the ARC websites or through advertisements on third party websites which are based on your experience with our websites; or to monitor the effectiveness of those digital marketing campaigns. We also monitor whether the adverts displayed on our websites are of interest to users and retain this information to ensure that adverts seen by users of our websites over a period of time are appropriate.

Please note that third parties may use cookies. The kind of cookies and the consequent data processing carried out by such third parties are regulated by their privacy policies. Please see below for more information about third party cookies.

c. Your cookie preferences

Cookies are necessary for you to be able to make full use of ARC’s websites. In addition, cookies help us provide you with personalised features on our websites. If you chose to disable cookies, some of ARC’s websites’ functionality might be impaired.

d. Local Flash Storage

On certain pages of our websites, we include content designed for display using Adobe Flash Player, such as animations, videos, and tools. Local flash storage (often referred to as “Flash cookies”) can be used to help improve your experience as a user. Flash storage is retained on your device in much the same way as standard cookies but is managed directly by your Flash software.

If you wish to disable or delete information stored locally in Flash, please see the documentation for your Flash software, located at www.adobe.com. Please note that, if you disable Flash cookies, some site functionality may not work.

e. Third party cookies

When you visit our websites, you may receive cookies that are set by third parties. These cookies are used for the purposes described in the “Why Do We Use Cookies?” section of this policy. We do not control the setting of these third-party cookies, so we suggest you might wish to check the third-party websites for more information about their use of cookies and how to manage them.

f. Amending cookie preferences

If you wish to remove cookies set by our websites from your browser in the future, you may delete them. The instructions for removing cookies from your computer or mobile device depend on the operating system and web browser you use. Please note, however, that withdrawing your agreement to the use of cookies on our sites will impair the functionality of the sites.

The site www.allaboutcookies.org includes instructions for managing cookies on many commonly used browsers, or you may consult the vendor documentation for your specific software.

g. Further information about cookies

If you would like to find out more about cookies in general and how to manage them, please visit www.allaboutcookies.org.

7 – Marketing and exercising your right to opt-out of marketing

ARC will not process your PI for marketing purposes if you have informed ARC that you do not wish to receive marketing materials. You can request that ARC stop processing your PI for marketing purposes at any time by clicking on marketing opt-out links in any electronic marketing materials ARC send you (unsubscribe) and/or by using the contact details set out in the “Contacting ARC” section of this Privacy Policy.

8 – Third-party marketing/sale of PI

ARC do not share or sell your PI to third parties for the third-party to use for their own marketing or other purposes.

9 – PI retention

ARC will process your PI for as long as is necessary to fulfil the purpose for which it was collected including to fulfil Site, Products and Services, until you opt-out or until Arc has met its obligations, for example to comply with legal, regulatory, accounting, auditing, reporting, internal policy requirements or for the establishment or defence of legal claims.

10 – PI security

ARC may use a range of physical, electronic, and managerial measures to ensure a level of security appropriate to the risk of PI processing. These measures may include any or all the following:

  • education and training of relevant staff to ensure they are aware of ARC privacy obligations when processing PI as well as training around social engineering, phishing, spear phishing, and password risks;
  • the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
  • the ability to restore the availability and access to PI in a timely manner in the event of a physical or technical incident;
  • administrative and technical controls to restrict access to and process PI;
  • technological security measures, including firewalls, encryption, and anti-virus software;
  • segregation of networks and backup facilities;
  • application security;
  • endpoint security;
  • real-time monitoring of data leakage controls;
  • layered and comprehensive cybersecurity defences; and
  • security incident reporting and management.

The security of data transmitted over the internet (including by e-mail) cannot be guaranteed and carries a risk of access and interception by third parties. ARC endeavour to protect personal information but cannot guarantee the security of data transmitted to ARC or by ARC.

11 – Your rights

In certain circumstances you may have the following rights in relation to the processing of your PI:

  • Access: To request a copy of the PI ARC process in relation to you and to be informed about how ARC use and (where applicable) share your PI – subject to any legal and regulatory obligations.
  • Object: To object to the processing of your PI if (i) ARC are processing your PI on the grounds of legitimate interests or for the performance of a task in the public interest (including profiling); or (ii) if ARC are processing your PI for direct marketing purposes.
  • Correction: To request that ARC update the PI it processes in relation to you, or to correct PI that you think is incorrect or incomplete.
  • Erasure: To ask that ARC delete PI that ARC process in relation to you where ARC do not have a legal or regulatory obligation or other valid reason to continue to process or retain it.
  • Restriction: To request that ARC restrict the way in which ARC processes your PI, for example, if you dispute the accuracy of your PI or have raised an objection which is under consideration.
  • Portability: To request a copy of your PI that you have provided to ARC in a commonly used electronic format such as through the completion of an application form.
  • Automated decision making: To request manual intervention if you are subject to automated decisions where the decision results in a legal or similar effect to you.

You may exercise your rights at any time by using the details set out in the Contacting ARC section. To the extent permitted by applicable law or regulation ARC reserve the right to charge an appropriate fee in connection with you exercising your rights.

ARC may need to request specific information from you to help ARC confirm your identity and ensure your right to access to the PI requested, or to exercise any of your other rights. This is to ensure that PI is not disclosed to any person who does not have authority to receive it. ARC may also request further information in relation to your request to help ARC to locate the PI processed in relation to you, including, for example, the nature of your relationship with ARC.

ARC aim to respond to all legitimate requests within one calendar month. If ARC think it may take longer than one calendar month, (such as where your request is particularly complex or you have made a number of requests), ARC will notify you and keep you updated. You will not be disadvantaged in any way by exercising your rights in relation to the processing of your PI.

12 – Contacting ARC

If you wish to exercise any of your rights or have any questions concerning this policy, please contact:  communications@arcratings.com. You also have a right to complain to a data protection or other competent authority with jurisdiction over privacy and data protection law in the country you live or work, or in the country where you believe an issue in relation to the processing of your PI has arisen. Please contact communications@arcratings.com for further details.

13 – Linked websites

This Privacy Policy is not applicable to third-party websites that ARC do not own or control (including those that are linked, hyperlinked or otherwise to products, policies, terms, warranties, or any other information whatsoever), or to any third-party website where ARC advertisements and marketing are displayed.

14 – Changes to this Privacy Policy

ARC may modify or amend this Privacy Policy from time to time and you are advised to visit our website and Privacy Policy regularly to check for any amendments and updates. Any material changes will be communicated to you through an appropriate channel, depending on how ARC normally communicate with you. It is your responsibility to ensure that you remain informed of our policies when interacting with any ARC Sites, Products or Services.