Privacy Policy.

This Privacy Policy sets out how Arena Talent Inc. (“we,” “our,” “us,” or “Arena”) collects, uses, discloses, and protects information from or about you that we receive through our website at arenatalent.com (the “Website”), our web and mobile applications (the “App”), our newsletter, and in connection with our related services and events. We will refer to our Website, App, newsletter, and related events and services together as the “Services.”

Who we serve. Arena operates a private, paid membership network for leaders across the sports, media, and entertainment industries. Our Services are offered to individuals who apply for or hold an Arena membership (each a “Member”), individuals who have applied for or joined the waitlist for membership (each an “Applicant”), and individuals who visit our Website, subscribe to our newsletter, or attend our events. Membership is available only to individuals living and working in the United States or Canada.

Where we operate. Our Services are directed only to residents of the United States and Canada. We do not target or offer our Services to individuals located in the European Economic Area, the United Kingdom, or Switzerland.

Curated Introductions. A central feature of the Services is Curated Introductions: we use information you provide to identify other Members whose experience, interests, goals, and preferences align with yours, and we present a limited number of suggested introductions to each of you. Introductions proceed only when both Members opt in. Section 3 explains the role of algorithms and artificial intelligence in this process, and the limits we place on it.

Direct Communications. The Services also support direct communications between Members (“Direct Communications”), including your acceptance of introductions, one-to-one messaging, and the scheduling of and participation in virtual or in-person meetings. Just as an email service provider like Gmail allows both the sender and receiver of a message to each keep and manage their own copy, Arena generally lets each Member keep and manage their own copy of any Direct Communications. This means that if you send a Direct Communication to another Member, that Member retains their copy even if you later delete yours or close your account.

PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND HOW WE HANDLE YOUR INFORMATION. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, YOU CANNOT USE THE SERVICES.

1. Information We Collect About You

Depending on which parts of the Services you use, we obtain different types of personal information from or about you. We collect only the information that is reasonably necessary and proportionate to provide and maintain the Services you have requested.

Information You Provide Directly to Us

We collect information about you when you voluntarily provide it. This includes information you give us when you:

• Apply for membership or join our waitlist;
• Register for and pay for a membership;
• Complete or update your Member profile;
• Set your introduction preferences;
• Send or receive Direct Communications through the Services;
• Connect a third-party calendar or video conferencing service to schedule or hold meetings (see Section 6);
• Register for, attend, or participate in our events, cohort orientation, or workshops;
• Subscribe to our newsletter, mailing lists, or other marketing communications;
• Correspond with us about or through the Services, including by phone, email, or in-app support;
• Respond to or participate in surveys, feedback requests, focus groups, sweepstakes, or contests; or
• Use some other feature of the Services as available from time to time.

Depending on how you use the Services, the information we collect from you may include:

• First and last name;
• Email address;
• Postal address;
• Telephone number;
• Log-in credentials to access your account on the Services;
• Professional and employment-related information, including your current and past employers, job title, seniority, work history, educational background, industry segment, and skills;
• Other identifying and biographical information, including your portfolio, personal and professional websites, social media handles, community and affinity group memberships, career goals, interests, personal hobbies, city or metropolitan area, and general demographic information;
• Your introduction preferences, including the kinds of Members you would like to meet and the kinds you would prefer not to be matched with;
• Your activity in the introduction process, including which introductions you accept, decline, or leave unanswered, your connection history, and follow-up reminders you set;
• The contents of Direct Communications you send or receive through the Services;
• Calendar and conferencing information from any third-party services you connect, as described in Section 6;
• Recordings or transcripts of calls and messages between you and Arena, where permitted by applicable law and with any notice or consent that law requires;
• Photographs, audio, and video of you captured at our events, as described below and in our Terms of Use;
• Payment and billing information, as described below; and
• Any other information you choose to provide while using the Services that identifies or can reasonably be associated with you.

If you choose not to provide certain information, we may not be able to provide the Services to you or respond to your requests. For example, we cannot generate Curated Introductions without professional background and preference information.

Membership Applications and Waitlist

Arena membership is by application. When you apply or join our waitlist, we collect the information described above, along with the information you submit in support of your application, such as your professional background, your reasons for wanting to join, how you heard about Arena, and any referral source. We use this information to evaluate whether you meet our membership criteria.

Applications are reviewed and decided by Arena personnel. We do not use automated processing alone to accept or reject an application. If we decline your application, we retain a limited record of the application as described in Section 7 so that we can administer future applications and our own records.

Sensitive Personal Information

Some of the information we collect is treated as “sensitive personal information,” “sensitive data,” or a similar category under applicable privacy laws. For Arena, this may include:

• Information about your racial or ethnic origin;
• Information about your sex life or sexual orientation;
• Information revealing that you are transgender or nonbinary;
• Information about a disability or accommodation need; and
• Your account log-in credentials.

Providing this information is entirely voluntary. We ask for it so that we can understand and serve the composition of our membership, support affinity and interest groups, and, where you ask us to, take your preferences into account in Curated Introductions. You can decline to provide it, and you can remove it from your profile at any time.

Where applicable law requires your consent before we collect or use this information, we will ask for it separately and clearly before collection, and we will not treat your continued use of the Services as consent.

Our commitments regarding this information. We do not sell it. We do not share or disclose it for cross-context behavioral advertising or targeted advertising. We do not disclose it to other Members except as part of your profile as you have chosen to complete it, or as you otherwise direct. We do not use it to develop, train, fine-tune, or improve any generalized or standalone artificial intelligence or machine learning model. We limit internal access to personnel with a need to know.

Payment and Billing Information

Arena membership is a paid subscription. When you purchase, renew, or change a membership, we and our third-party payment processors collect the information necessary to complete the transaction, which may include your name, billing address, email address, the last four digits and expiration date of your payment card, the card brand, transaction amount, transaction date, and subscription status.

We do not collect or store your full payment card number, card security code, or bank account credentials. These are collected and processed directly by our third-party payment processors on our behalf, under their own security standards and privacy practices. We receive only the limited transaction and subscription data described above.

We use payment and billing information to process your membership fee, manage renewals and cancellations, administer refunds under our satisfaction guarantee, issue receipts and invoices, detect and prevent fraudulent or unauthorized transactions, and satisfy our tax, accounting, and audit obligations.

Event Photography and Recordings

When you register for or attend our in-person or virtual events, including private dinners, gatherings, and workshops, we and our vendors may photograph, film, and record the event, including your name, image, likeness, voice, appearance, and statements. We use this content for the purposes described in Section 2, including to promote Arena and our events, and as described in the media release in our Terms of Use.

If you do not wish to be photographed or recorded at an in-person event, it is your responsibility to notify Arena staff and to remove yourself from the area being captured. For virtual events, we will indicate when a session is being recorded. You may contact us at the address in Section 15 to request that we remove a photograph or recording of you from our marketing materials, and we will make reasonable efforts to honor that request going forward.

Information We Collect Through Our Mobile Application

If you use our App, we collect the categories of information described in this Section, and in addition:

• Device and installation information, including device model, operating system and version, App version, language and region settings, mobile network, crash logs, and diagnostic data;
• Mobile identifiers, including a device or installation identifier used to associate your device with your account and to deliver notifications;
• Push notification tokens, if you enable notifications, so we can alert you to new introductions, messages, meeting reminders, and event announcements. You can turn push notifications off at any time in your device settings or in the App;
• Permissions you grant, which may include calendar access (to create and manage meetings you schedule through the Services) and notification access. We request the narrowest permission that will support the feature, and we ask only when the feature is used. You can revoke any permission at any time in your device settings, which may disable the related feature.

We do not access your device contacts, photo library, microphone, camera, precise location, or health data unless you affirmatively grant that permission for a specific feature, and we will describe the purpose at the time we ask.

Information We Collect Through Automated Means

When you use our Services, we and our vendors (third parties that perform services on our behalf) automatically collect certain information about your device and how you use the Services. This includes your IP address, browser type, browser language, operating system, the state or country from which you accessed the Services, software and hardware attributes (including device IDs), referring and exit pages and URLs, platform type, the number of clicks, search terms, files you download, domain names, landing pages, pages and features viewed and the order of those pages, the amount of time spent on particular pages, the date and time you used the Services, error logs, and other similar information about how you use the Services. From your IP address, we may be able to infer your general location (for example, city or state, or postal code). We do not collect precise geolocation.

To collect this information, we and our vendors may use Internet server logs, local storage, cookies, tracking pixels, software development kits, and other similar technologies (collectively, “cookies”) to track, measure, and analyze behaviors and usage patterns on our Services. Cookies are small text files placed on your computer or mobile device that enable us to: (i) recognize your device; (ii) store your preferences and settings; (iii) understand which pages of the Services you have visited; (iv) enhance your experience by delivering and measuring the effectiveness of content; (v) perform searches and analytics; and (vi) assist with security and administrative functions.

You may set your web browser to notify you when you receive a cookie and to accept or refuse certain cookies. If you elect not to accept cookies, some functionality and areas of the Services may be restricted. To learn how to manage your cookies, please follow the instructions from your specific browser. If you access the Services via a mobile device, refer to the manufacturer’s instructions. See Section 5 for more on analytics, and Section 9 for how we handle opt-out preference signals such as Global Privacy Control.

Newsletter and Email Analytics

If you subscribe to our newsletter or receive email from us, we collect your email address, your subscription and preference settings, and engagement data such as whether you opened a message, which links you clicked, the date and time of those actions, and your general location and device type at the time. We collect this using clear GIFs, tracking pixels, and similar tools built into our email platform. We use it to understand which content is useful, to improve our communications, and to manage list hygiene. Every marketing email we send includes a link to unsubscribe.

Information We Collect from Other Sources

We may collect information about you from other sources, including Members who refer you, marketing vendors, survey providers, other websites and services, data enhancement services, publicly available professional profiles and company websites, social media, and conferences and other industry events, or for other purposes that we explain to you at the time of collection, to the extent permitted by applicable law. We use this information to supplement and verify the information we collect directly or automatically from you, including to confirm the professional background you have described in your application.

When you “like” or “follow” us on social media (for example, LinkedIn), or use a social media account to log in to our Services, we may collect information from or about you including your name, email address, profile information you have made available, and any comments or content you post that are relevant to us (for example, if you tag us in a comment or comment on one of our posts).

Information About Other People

Because the Services involve introductions and scheduling, we sometimes receive information about people who are not Members and have not interacted with us directly. This can include the names and email addresses of other attendees on a meeting you schedule through a Connected Service (see Section 6), and the name and contact details of a person you refer to Arena. We use this information only to provide the feature you have asked for. If you provide us with someone else’s information, you are responsible for having the right to do so.

2. How We Use Your Information

We use your information for the following purposes:

• Evaluate your membership application and administer our waitlist and cohorts;
• Provide, operate, maintain, and administer the Services and your account;
• Generate, present, and manage Curated Introductions, and help you track connections and follow-ups, as described in Section 3;
• Enable Direct Communications between you and other Members;
• Schedule and facilitate meetings between Members, including through Connected Calendar and Conferencing Services, subject to the limits in Section 6;
• Process your membership payment, manage renewals, cancellations, and refunds, and maintain financial records;
• Organize, host, and administer our events, cohort orientation, and workshops, and manage registration and attendance;
• Photograph, film, and record our events and use that content to promote Arena and our events, in accordance with our Terms of Use;
• Respond to your requests, communicate with you about the Services, and provide customer support;
• Send you our newsletter and contact you by email, postal mail, or phone about events, news, alerts, updates, promotions, surveys, or contests relating to the Services, in accordance with applicable law and your marketing preferences;
• Customize the content you see on the Services;
• Engage in analysis and research about use of the Services, measure and improve the Services, and develop new features;
• Measure the effectiveness of our own communications and marketing;
• Secure the Services, verify accounts, prevent fraud and abuse, and resolve technical issues;
• Comply with the laws, regulations, and procedures that apply to us, including tax and accounting obligations; and
• Establish, exercise, or defend our legal rights.

We may also use your information for any other purpose with your consent or at your direction.

Aggregate and De-Identified Information. We may aggregate or de-identify information we collect so that it can no longer reasonably be linked to you or your device (“De-Identified Information”). We may use De-Identified Information for research, benchmarking, and marketing purposes, and may disclose it to third parties. Where we de-identify information, we maintain it in de-identified form and do not attempt to re-identify it, except to test the effectiveness of our de-identification. Information we receive from a Connected Service is subject to the additional limits in Section 6.

Combined Information. We may combine information we collect through the Services with information we receive from other sources, both online and offline, and use the combined information subject to this Privacy Policy.

Legal Bases. Where applicable law requires a legal basis for using your information, we rely on: performance of our contract with you for the Services; your consent, including for sensitive personal information and for marketing where required; our legitimate interests in operating, securing, and improving the Services, where those interests are not overridden by your rights; and compliance with our legal obligations.

3. Artificial Intelligence and Automated Processing

We want to be direct about where technology makes suggestions and where people make decisions.

Where we use it. We use algorithms, including artificial intelligence and machine learning models, in one place: to generate Curated Introductions. The system analyzes information in your profile and preferences, including your professional experience, industry, seniority, stated interests and goals, geography, and the introductions you have previously accepted or declined, and compares it against the same categories of information for other Members in order to suggest people you may want to meet.

What it does not do. The output of this process is a suggestion, not a decision. An introduction happens only if both Members separately opt in. The system does not make any decision about your employment, compensation, credit, lending, housing, insurance, education, healthcare, or access to any government or essential service. It does not screen you for a job or a promotion, and Arena is not an employer or employment agency with respect to Curated Introductions.

Membership decisions are made by people. As described in Section 1, membership applications are reviewed and decided by Arena personnel, not by automated processing alone. A person reviews each application, considers the information in it, and has the authority to reach a different conclusion than any tool or score would suggest.

Model training. We do not use the contents of your Direct Communications, or any information we receive from a Connected Service, to develop, train, fine-tune, or improve any generalized or standalone artificial intelligence or machine learning model. We do not use sensitive personal information to train any model. Where we use third-party AI or machine learning vendors to help operate matching features, we do so under contracts that prohibit the vendor from using our Members’ personal information to train the vendor’s own models.

Your choices. You can influence Curated Introductions by editing your profile and preferences at any time. You may also ask us to stop presenting you with Curated Introductions, or to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, by contacting us as described in Section 15. Because Curated Introductions are the core of the membership, opting out will substantially limit the value of the Services to you.

Explanation and human review. You may ask us for information about the categories of personal information used to generate your introductions and the principal factors involved, and you may ask a member of our team to review and reconsider any outcome you believe is wrong. Contact us as described in Section 15.

4. Disclosure of Your Information

We do not sell your personal information. We may disclose the information we collect to the following categories of recipients:

• Other Members. Your profile information is visible to other Members in accordance with your profile and privacy settings. When you accept a Curated Introduction, the other Member receives the profile and contact information necessary to connect with you. Direct Communications are visible to the Members who send and receive them.
• Vendors and service providers. We may disclose your information to third parties that perform services for us. These include payment processing, subscription and billing management, email and newsletter distribution, customer support tooling, identity and account security, fraud prevention, cloud hosting and data storage, analytics, scheduling and conferencing infrastructure, event production and venue management, professional services such as legal and accounting, and consulting. Vendors and service providers engaged in this manner may collect information from you directly when you communicate or interact with us. We require them by contract to protect your information, to use it only for the purposes we specify, and to provide the same or equivalent protection required by this Privacy Policy and by the platform policies applicable to any Connected Service.
• Affiliates and subsidiaries. We may disclose your information within the Arena family of companies for the purposes described in this Privacy Policy.
• Event partners, sponsors, and venues. When you register for or attend an event, we may disclose the information necessary to administer the event, such as your name and dietary or accessibility requirements to a venue or caterer, and attendance information to a co-host or sponsor. Where a sponsor wishes to contact you for its own marketing purposes, we will ask for your consent first, and we will not provide your contact information without it.
• Third parties in connection with a business transaction. We may disclose your information to third parties in connection with a transaction such as a merger, sale of assets or shares, reorganization, financing, change of control, or acquisition of all or a portion of our business, including to evaluate whether to proceed. Information we receive from a Connected Service will be transferred in such a transaction only with your explicit consent, as required by the applicable platform policies.
• Law enforcement, regulators, and other parties for legal reasons. We may disclose your information to third parties as required by law or if we believe in good faith that disclosure is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) enforce our agreements, including the terms applicable to the Services; (c) protect the security or integrity of our Services; or (d) exercise or protect the rights, property, or personal safety of Arena, our personnel, our Members, or others.
• Otherwise with your consent or at your direction. We may disclose your information whenever you consent to or direct such a disclosure.

We will never sell or share your mobile telephone number or SMS opt-in data with third parties for their marketing purposes.

We do not disclose sensitive personal information, the contents of your Direct Communications, or information received from a Connected Service to advertising partners or data brokers.

5. Online Analytics and Advertising

Online Analytics. We use third-party web and app analytics services, such as Google Analytics, on our Services. These services help us collect and analyze usage information through cookies and similar tools, engage in auditing, research, and reporting, take measures to prevent fraud, and provide certain features to you. To prevent Google Analytics from collecting your information for analytics in certain browsers, you may install the Google Analytics Opt-out Browser Add-on.

Email Analytics. As described in Section 1, we use analytics tools such as clear GIFs in our email to understand when messages are opened and which links are clicked, so we can gauge the effectiveness of our communications.

Advertising. We advertise Arena membership, our events, and our content on third-party platforms, including social media and search. To do this, we may:

• Provide a platform with a hashed version of your email address so that the platform can show our advertising to you, or exclude you from an advertising campaign (for example, so that we do not advertise membership to people who are already Members);
• Allow advertising and measurement technologies to place cookies or similar technologies on your browser or device when you visit our Website, so that we can measure how many people who saw our advertising went on to apply, and so that we can show our advertising to people who visited our Website but did not complete an application.

Depending on the jurisdiction, these activities may be considered “sharing” of personal information for cross-context behavioral advertising or “targeted advertising,” even though no money changes hands. You can opt out at any time. See Section 9 and our “Your Privacy Choices” page.

We do not use for any advertising purpose, and we do not provide to any advertising or measurement partner: sensitive personal information, the contents of Direct Communications, information received from a Connected Service, or the substance of your Curated Introductions.

You can also learn more about your choices, and generally control cookies used for tailored advertising, through the Network Advertising Initiative’s Consumer Opt-Out tool, the Digital Advertising Alliance’s Consumer Opt-Out tool, or Your Online Choices. We do not control these opt-out links and we do not control whether our advertising partners participate in these programs. We are not responsible for any choices you make using these programs or links, or for their continued availability or accuracy.

6. Connected Calendar and Conferencing Services

To provide our scheduling and meeting features, we let you connect third-party calendar and video conferencing services to your Arena account. This Section explains how we handle information we receive from those services. It supplements the rest of this Privacy Policy, and to the extent there is any conflict with respect to information received from a Connected Service, this Section controls.

The Services You Can Connect

You may connect any of the following (each, a “Connected Service”):

Connecting a service is entirely optional and is never required to hold an Arena membership. You may connect one, several, or none. If you do not connect any Connected Service, you can still accept introductions and exchange Direct Communications; you will simply arrange meetings yourself.

What We Access

When you connect a Connected Service, we request only the permissions reasonably necessary to provide the scheduling and meeting features, and no more. Specifically:

From a connected calendar (Google Calendar, Outlook Calendar), we access:

• Your free/busy availability, including the dates, times, time zone, and busy or free status of entries on your calendar, so that we can offer times you are actually available;
• Limited details of existing calendar entries only to the extent necessary to schedule, reschedule, or cancel a meeting without creating a conflict;
• The ability to create, update, and cancel calendar events that relate to meetings arranged through Arena, including the event title, description, time, and invitee list;
• Your calendar list and time zone settings, so that we write events to the correct calendar.

From a connected conferencing service (Google Meet, Microsoft Teams, Zoom), we access:

• The ability to create a meeting and generate a join link for a meeting arranged through Arena;
• Basic meeting metadata for meetings we created, such as the meeting identifier, scheduled start and end time, and join URL, so that we can attach the link to the invitation and update or cancel it if the meeting changes;
• Your basic account identity with that provider (such as your name and the email address on the account), so that we create the meeting under the correct account.

What We Do Not Access

We want to be specific about this, because it is the most common question we get.

• We do not join your meetings. Arena does not send a bot, notetaker, or any other participant into your calls.
• We do not access, collect, store, or process meeting recordings.
• We do not access, collect, store, or process meeting transcripts, captions, or any AI-generated meeting summaries or insights.
• We do not access the audio or video content of any meeting.
• We do not read your email. We do not request or use any email or mailbox permission from Google or Microsoft.
• We do not access your files in Google Drive, OneDrive, SharePoint, or any other storage service.
• We do not access your Teams chats, channel messages, or Zoom chat.
• We do not access your contacts from any Connected Service.
• We do not read the contents of calendar entries that are unrelated to Arena beyond the limited conflict-checking described above.

If we ever begin accessing a type of data from a Connected Service that we have not described here, we will update this Privacy Policy and ask for your consent before we access it.

Information About Other Meeting Attendees

When you schedule a meeting through Arena, we necessarily process information about the other people invited to it, including their names and email addresses, and whether they have accepted the invitation. Some of these people may not be Arena Members and may never have interacted with us. We use this information only to create, send, update, and cancel that meeting invitation. We do not add these individuals to any marketing list, we do not build profiles about them, and we do not use their information for advertising.

How We Use Information from Connected Services

We use information from Connected Services only to provide, personalize, maintain, secure, and troubleshoot the scheduling and meeting features of the Services that are visible and prominent to you. We do not use it for any other purpose.

Limited Use Commitments

Google. Arena integrates with Google Calendar to create meeting events on your behalf. When you connect your Google Calendar, Arena stores an OAuth access token to write calendar events when meetings are booked through the platform. Arena does not read, store, or share your calendar data beyond creating these meeting events. You can disconnect Google Calendar at any time from your Settings page, which immediately revokes Arena’s access.

Arena’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

All Connected Services. Consistent with those requirements, and with the equivalent requirements of Microsoft, Zoom, and Apple, information we receive from a Connected Service is:

• not used or transferred for advertising of any kind, including personalized, retargeted, contextual, or interest-based advertising, and is never provided to any advertising network, ad server, or measurement partner;
• not sold, licensed, or transferred to data brokers, information resellers, credit bureaus, or other third parties, except (a) to the conferencing or calendar provider you have chosen, to the extent necessary to provide the feature you requested, (b) to a service provider acting on our behalf under contractual obligations at least as protective as this Section, or (c) where required by law;
• not used to develop, train, fine-tune, or improve any artificial intelligence or machine learning model, other than, where applicable, a model personalized to you alone in service of a feature you use;
• not used for credit assessment, lending, insurance, employment screening, or any similar purpose;
• not transferred in connection with a merger, acquisition, or sale of assets except with your explicit consent; and
• not read by Arena personnel, except (a) with your consent, (b) where necessary for security purposes or to investigate abuse or a suspected violation of our terms, (c) to comply with applicable law, or (d) where the information has been aggregated or de-identified and is used for internal operations.

Security of Connected Service Data

We connect to each Connected Service using industry-standard OAuth 2.0 authorization. We never ask for, receive, or store your password for a Connected Service. Access tokens and refresh tokens are encrypted at rest and in transit using TLS 1.2 or higher, are stored separately from your profile data, are accessible only to the systems that need them, and are rotated in accordance with our key management practices.

Your Control and Disconnection

You can disconnect a Connected Service at any time, either in your Arena account settings or directly through the provider. For example, you can revoke Arena’s access in your Google Account security settings, your Microsoft account app permissions, or your Zoom account’s installed apps. Disconnecting will limit or disable the Arena scheduling and meeting features that depend on that service; it will not cancel your membership or delete your Arena account.

What happens when you disconnect. When you disconnect a Connected Service, or when we receive a deauthorization notification from the provider, we stop accessing that service immediately. We then delete the access and refresh tokens and the calendar and meeting data we obtained from that service within 10 days, except where we are required or permitted to retain specific records by law or for a legitimate purpose such as security investigation, financial audit, or dispute resolution, in which case we retain the minimum necessary for the shortest period required. Where a provider offers a compliance or deletion-confirmation mechanism, we use it to confirm the deletion within the period that provider requires.

Calendar events that Arena already created on your calendar remain on your calendar after you disconnect; they belong to you, and you can edit or delete them yourself.

If you close your Arena account, all Connected Services are disconnected and the same deletion process applies.

Third-Party Terms

Your use of each Connected Service remains subject to that provider’s own terms and privacy policy, and we are not responsible for the provider’s practices. You may review and manage the access you have granted to Arena directly through each provider at any time. Where you use a Connected Service provided through your employer’s account, your employer’s administrator may have independent controls over, and visibility into, the data in that account.

7. Retention of Your Information

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, and then delete or de-identify it. The periods below describe our practice. Where a period is longer than it looks like it should be, it is usually because a law requires us to keep the record.

Information may persist in encrypted backups and business continuity copies for a limited period after it is deleted from our active systems. We overwrite these on a rolling 90-day cycle.

8. Security and Storage of Your Information

Security. We implement technical, administrative, and organizational measures designed to protect your information from accidental or unlawful access, destruction, loss, misuse, alteration, or damage. These include encryption of data in transit using TLS 1.2 or higher and encryption of data at rest, role-based access controls under the principle of least privilege, multi-factor authentication for administrative access, logging and monitoring, regular patching and dependency management, periodic security review and testing, vendor security assessment, and internal policies governing incident response and vulnerability management.

However, no method of transmitting data over the Internet or storing data is ever fully secure or error-free. Please keep this in mind when providing information to us, and please use a strong, unique password for your Arena account.

If a security incident affects your information, we will notify you and any regulator that applicable law requires us to notify, within the time period that law requires.

Where your information is stored. Arena is based in the United States, and we and our service providers store and process information in the United States. If you are located in Canada, this means your personal information is transferred to, stored in, and processed in the United States, where data protection laws differ from those in Canada, and where courts, law enforcement, and national security authorities may be able to obtain access to it under the laws of that country. We use contractual and technical safeguards with our service providers to protect information that crosses borders, and we conduct an assessment before transferring personal information of Quebec residents outside Quebec. You can contact us as described in Section 15 for more detail about these measures.

9. Your Privacy Rights and Choices

Marketing Communications

As legally permitted, we may send you marketing communications about the Services, our events, and our content. You can ask us to stop at any time by using the unsubscribe link in any marketing email, by adjusting your preferences in your account, or by contacting us using the information in Section 15.

Even if you opt out of marketing, we may still send you administrative or transactional messages, such as messages confirming a payment or a request, notifying you of a new introduction or message, or providing updates to this Privacy Policy or our other terms. You cannot opt out of these while you hold an account.

Your Rights

Depending on where you live, applicable law may give you the following rights. We honor these requests for all Members and Applicants, regardless of your state or province of residence, except where a law limits our ability to do so.

• Know and access. Confirm whether we hold personal information about you, and obtain a copy of it, along with information about the categories we collect, the sources, the purposes, and the categories of third parties to whom we disclose it.
• Portability. Receive the personal information you provided to us in a structured, commonly used, machine-readable format, or have it transmitted to another party where technically feasible.
• Correct. Have inaccurate personal information about you corrected.
• Delete. Have your personal information deleted, subject to exceptions in applicable law (for example, where we must keep a payment record for tax purposes).
• Opt out of targeted advertising and “sharing.” Direct us to stop disclosing your personal information for cross-context behavioral advertising or targeted advertising.
• Opt out of profiling. Direct us to stop profiling you in furtherance of decisions that produce legal or similarly significant effects.
• Limit the use of sensitive personal information. Direct us to limit our use and disclosure of your sensitive personal information to the purposes permitted by applicable law.
• Withdraw consent. Withdraw consent you previously gave, without affecting the lawfulness of our prior use of the information.
• Non-discrimination. Not be discriminated against for exercising any of these rights. We will not deny you the Services, charge you a different price, or provide you a different level of quality because you exercised a privacy right.
• Human review of automated processing. Ask a person at Arena to review and reconsider an outcome produced with the help of automated processing, as described in Section 3.

How to Exercise Your Rights

You can exercise these rights in any of the following ways:

• Email us at privacy@arenatalent.com;
• Use the “Your Privacy Choices” page on our Website, at arenatalent.com/privacy-choices, which includes an interactive form for opt-out and limitation requests; or
• Write to us at the mailing address in Section 15.

Verification. To protect your information, we will take reasonable steps to verify your identity before acting on a request to know, correct, delete, or port your information. We will generally do this by asking you to respond from the email address associated with your account, and in some cases by asking for additional information. We will not ask you to create an account in order to make a request, and we will not use information you give us for verification for any other purpose.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We will ask the agent for proof that you gave them written permission, and we may ask you to verify your own identity directly with us.

Timing. We will confirm receipt of your request within 10 business days and respond substantively within 45 days. If we need more time, we will tell you why and may extend by an additional 45 days. Requests to opt out of targeted advertising or sharing, and requests to limit the use of sensitive personal information, are honored within 15 business days.

Your Right to Appeal

If we decline your request, you have the right to appeal. We will tell you why we declined and how to appeal. To appeal, reply to our decision or email privacy@arenatalent.com with the word “Appeal” in the subject line.

We will review the appeal and respond in writing within 60 days, explaining the action we have taken or declined to take and the reasons for it. If we deny your appeal, you may submit a complaint to the Attorney General or privacy regulator in your state or province. We will provide you with the relevant contact information or an online mechanism to do so as part of our response.

Opt-Out Preference Signals and Do Not Track

We honor Global Privacy Control (GPC). If you visit our Website with a browser or extension that transmits a GPC signal or another recognized opt-out preference signal, we treat it as a valid request to opt out of the sale or sharing of the personal information associated with that browser for cross-context behavioral advertising, and to limit the use of sensitive personal information. Because a browser signal is not tied to your account, it applies to that browser and device. To apply your choice across all devices, submit a request through your account or the “Your Privacy Choices” page while logged in.

Because there is not currently an industry or legal standard for recognizing or honoring Do Not Track (DNT) browser signals, we do not respond to DNT signals at this time. We do honor GPC, as described above.

Cookie Choices

You can manage cookies through your browser settings and, where we present one, through our cookie preference banner. Analytics and advertising cookies are not required to use the Services. Cookies that are strictly necessary for security, authentication, and core functionality cannot be turned off, because the Services will not work without them.

10. Additional Disclosures for U.S. State Residents

This Section provides additional detail required by certain U.S. state privacy laws. It applies in addition to the rest of this Privacy Policy.

Categories of Personal Information We Collect, Disclose, and Share

In the twelve months preceding the date of this Privacy Policy, we have collected the following categories of personal information. For each, we identify the sources, the purposes, the categories of third parties to whom we disclose it for a business purpose, and whether we sell it or share it for cross-context behavioral advertising.

In the table above, “Sold” means disclosed to a third party in exchange for monetary or other valuable consideration, and “Shared” means disclosed to a third party for cross-context behavioral advertising or targeted advertising, as those terms are defined in applicable state law.

Sensitive Personal Information

We collect the following categories of sensitive personal information, in each case only where you choose to provide it: racial or ethnic origin; sex life or sexual orientation; transgender or nonbinary status; disability or accommodation need; and your account log-in credentials.

We use and disclose this information only for the purposes permitted by applicable law, namely: to provide the Services you have requested, including to honor preferences you have set; to ensure security and integrity and to prevent fraud; to verify or maintain the quality of the Services; and for our internal operations, including understanding the composition of our membership. We do not use it to infer characteristics about you beyond what you have told us. We do not sell it and we do not share it for cross-context behavioral advertising, and we never will.

Because we limit our use of sensitive personal information to these permitted purposes, the statutory “right to limit” does not restrict us further. You may nevertheless remove this information from your profile at any time, or ask us to delete it, and we will.

Sale and Sharing

We do not sell personal information for money, and we never have. As described in Section 5, some of our advertising and analytics activity may constitute “sharing” for cross-context behavioral advertising or “targeted advertising” under state law. You can opt out through our “Your Privacy Choices” page, by emailing privacy@arenatalent.com, or by sending a Global Privacy Control signal.

We do not knowingly sell or share the personal information of consumers under 16 years of age. Our Services are not available to anyone under 18.

California “Shine the Light”

California residents may request information about our disclosure of personal information to third parties for those third parties’ direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. If this changes, we will update this Privacy Policy and provide the disclosure and opt-out that California law requires. You may direct questions to privacy@arenatalent.com.

Notice at Collection

The tables in this Section, together with Sections 1, 2, 4, and 7, constitute our notice at collection. We provide a link to this Privacy Policy at the point where we collect your information, including on our membership application and our newsletter signup.

Financial Incentives

We do not offer financial incentives or price differences in exchange for the retention or sale of personal information.

11. Additional Disclosures for Canadian Members

Accountability. We have designated a Privacy Officer who is accountable for our compliance with Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for Quebec residents, the Act respecting the protection of personal information in the private sector as amended by Law 25. You may reach our Privacy Officer at:

Parul Khosla, CEO/Privacy Officer
Arena Talent Inc.
privacy@arenatalent.com
8 The Green, #10887, Dover, DE 19901

Consent. We collect, use, and disclose your personal information with your knowledge and consent, except where applicable law permits or requires otherwise. We identify our purposes at or before the time we collect your information. For sensitive personal information, we obtain your express consent separately. You may withdraw your consent at any time, subject to legal and contractual restrictions and reasonable notice; we will tell you what the consequences of withdrawal are before you decide.

Privacy by default. Where we offer technology that collects personal information, any function allowing us to identify, locate, or profile you is deactivated by default. We will ask before turning any such function on.

Cross-border transfer. As described in Section 8, your personal information is transferred to and processed in the United States. We conduct a privacy impact assessment before transferring the personal information of Quebec residents outside Quebec.

Automated decision-making. As described in Section 3, we do not make decisions about you based exclusively on automated processing of your personal information. Membership decisions are made by our personnel. If this changes, we will inform you at or before the time of the decision, and on request we will tell you the personal information used, the reasons and the principal factors and parameters that led to the decision, and your right to have that information corrected. You may always submit observations to a member of our team who has the authority to review the outcome.

Portability and de-indexing. Quebec residents may request their computerized personal information in a structured, commonly used technological format, and may in certain circumstances request that we cease disseminating personal information or de-index a link to it.

Complaints. If you are not satisfied with how we have handled your personal information, please contact our Privacy Officer first so we have an opportunity to put it right. You may also complain to the Office of the Privacy Commissioner of Canada, or, if you are a Quebec resident, to the Commission d’accès à l’information du Québec.

Language. A French-language version of this Privacy Policy is available on request.

12. Links to Third Party Sites and Features

Our Services may contain links to, or integrate with, third-party websites, features, and other services, including the Connected Services described in Section 6, our payment processors, our newsletter platform, and event registration tools. If you follow a link to any of these third parties or use such an integration, please note that they have their own privacy policies, and we do not accept responsibility or liability for their policies or practices. These third parties may also disclose information to us about your activities on their services. Before you submit any information to a third party, please review its privacy policy.

13. Children’s Privacy

Our Services are not directed to persons under 18, and membership is available only to adults. We do not knowingly collect personal information from anyone under 18, we do not sell or share the personal information of anyone under 18, and we do not deliver targeted advertising to anyone we know or should reasonably know is under 18.

If a parent or guardian becomes aware that their child has provided us with personal information, they should contact us as described in Section 15. If we become aware that we have received personal information from a person under 18, we will delete it.

14. Changes to This Policy

We reserve the right to amend this Privacy Policy at any time. We will make the revised Privacy Policy accessible on the Services and update the “Last Updated” date at the top, so you should review it periodically. We will provide additional notice where legally required, and in the following circumstances regardless of whether the law requires it:

• Where we begin to use your personal information for a materially different purpose than the one we described when we collected it, we will notify you and, where required, obtain your consent.
• Where we begin accessing or using a type of data from a Connected Service that we did not previously disclose, we will update this Privacy Policy and prompt you to consent before accessing that data.
• Before we share personal information with any third-party artificial intelligence provider in a way not already described in Section 3, we will disclose it and obtain your explicit permission.

By continuing to use the Services after a change takes effect, you confirm that you have read and understood the latest version of this Privacy Policy.

15. Contact Information

Please contact us if you have any questions about this Privacy Policy or our practices, or if you wish to exercise any of your rights.

Privacy inquiries and rights requests: privacy@arenatalent.com

General legal inquiries: legal@arenatalent.com

Mailing address:
Arena Talent Inc.
Attn: Privacy
8 The Green, #10887
Dover, DE 19901