Last updated:
This notice explains what personal data DemandArc collects, why we collect it, who we share it with, and what rights you have. If you filled in a form to download something one of our clients sponsored, this is the notice that applies to you.
We have tried to write it plainly. If anything here is unclear, email us and we will explain it.
Who we are
DemandArc, Inc. (formerly NavigateIQ) is a technology demand generation company. We run marketing programs for client brands. In practice that means we publish content those clients sponsor, and pass the details of people who request it to the client so they can follow up.
DemandArc also operates IT Business Wire (itbusinesswire.com), the Resource Center where much of the sponsored content is published. If you completed a form there, DemandArc, Inc. is the company responsible for your data and this notice is the one that applies. This single notice covers both demandarc.com and itbusinesswire.com.
- Address: 10900 Research Blvd, Ste 160C‑1467, Austin, TX 78759, USA
- Privacy contact: privacy@demandarc.com
When we are responsible for your data, and when our client is
If you completed a form to request sponsored content — on one of our pages or on a publisher's site — we decided what data to collect and why. We are the controller for that data, and this notice applies.
Once we pass your details to the client who sponsored the content, that client becomes responsible for what they do with it. They are a separate controller and their own privacy notice applies to their use of your data. We tell you who they are on the form before you submit it.
Separately, clients sometimes give us their own contact lists to work with. For that data the client is in charge and we act on their instructions. If you are not sure which situation applies to you, contact us and we will tell you.
What we collect and why
| What we collect | Why | Our legal basis |
|---|---|---|
| Your name, business email, business phone, job title, job level and function, employer, company size, industry and country | To send you the content you asked for, check you match the audience for the program, and introduce you to the client sponsoring it | Your consent, given when you completed the form |
| Which asset you requested, which program it belonged to, and whether it was delivered | To run the client's program and report on it accurately | Your consent; our legitimate interest in reporting and billing |
| Your opt-in status and the date you opted in | To prove we were entitled to contact you | Legal obligation; our legitimate interest in keeping records |
| The minimum details needed to recognise you and leave you alone | So that once you opt out, you stay out — across every future program | Legal obligation; our legitimate interest in honouring your choice |
| Confirmation that your email address is valid | To avoid passing a client details that do not work | Our legitimate interest in data quality |
| Your business email address, where we market our own services to you | To tell you about what DemandArc does | Our legitimate interest in marketing to business contacts, where the law where you live allows it |
| Business contact details for people at our clients and suppliers | To manage our commercial relationships | Contract; our legitimate interest in running the business |
| Application materials and employment records | Hiring and employing people | Contract; legal obligation |
If you ask for content but do not opt in. Some forms let you request the content without agreeing to have your details passed to the client who sponsored it. If you do that, we still send you what you asked for, and we keep a record showing that you did not opt in — so your details are not passed to that client, and so that we can show they were not. We keep that record because we have a legitimate interest in acting on your choice and being able to evidence it.
We do not knowingly collect sensitive data — nothing about your health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation, and no genetic or biometric data. We do not knowingly collect data from anyone under 16. Our services are aimed at people at work.
Where we get your data
- From you, when you fill in a form on one of our pages — usually the IT Business Wire Resource Center.
- From a publisher partner, when you fill in a form on their site for content one of our clients sponsored. We write the opt-in wording used on those forms, so what you were told when you signed up came from us.
- From our clients, when they give us contact or exclusion lists for a program.
- From an email verification service, which tells us whether an address we already hold is still valid. It does not add anything to your record.
If we get your data from somewhere other than you, we will tell you within one month, or when we first contact you if that comes sooner — including what we collected and where it came from.
Who we share it with
- The client who sponsored the content. This is the main reason we collect your data, and we never do it without telling you first. We name the client on the form before you submit it. Your details go straight from our systems into theirs.
- Companies that provide services to us — hosting, lead processing, and email verification. They act on our instructions under written contract.
- Advisers and authorities, where the law requires it or where we need to defend a legal claim.
- A buyer, if DemandArc is ever sold or merged.
Passing your details to the client who sponsored the content is treated as a “sale” or a “share” of personal information under US state privacy law. We explain what that means, and how to opt out, under If you live in the United States below.
Where your data is held
If you are in the United Kingdom or the EEA, your data is stored in an EU region.
DemandArc is a US company, so our staff and systems in the United States access that data, in order to run the programme you responded to and to deal with any request you make about your record.
If you want to know more about where your data is held, or who has access to it, email privacy@demandarc.com and we will tell you.
How long we keep it
| What | How long |
|---|---|
| Your lead record | For the period set by our contract with the client whose program you responded to, or 24 months from delivery if that contract does not say |
| Proof of your opt-in | Kept with your record, for as long as we need to evidence it |
| Your opt-out, if you give us one | Kept indefinitely — see below |
| Your record, if you asked for content without opting in | 24 months from the date you submitted the form |
| Client and supplier records | For the length of the relationship, plus the period we may need them for legal claims |
Once we have passed your details to the sponsoring client, we keep the record to report on the program, to make sure you are not contacted again if you asked not to be, and — where the law allows and you have not objected — to tell you about our own services.
If you ask us to stop contacting you, we keep the smallest amount of information needed to recognise you and leave you alone. It is the one record we cannot delete, because deleting it would undo the very thing you asked for.
Marketing from us
We may send you emails about DemandArc's own services. We do this where we have a legitimate interest in marketing to business contacts, and only where the law where you live allows it — in some countries we will ask your permission first, and in others we will not contact you at all.
Every email we send carries an unsubscribe link, and you can tell us to stop at any time by emailing privacy@demandarc.com. If you object to marketing, we stop: there is no balancing exercise and no exception.
Your rights
If you are covered by the UK GDPR or the EU GDPR, you can ask us to:
- Give you a copy of the personal data we hold about you;
- Correct anything that is wrong, or complete anything that is missing;
- Delete your data, where one of the grounds in Article 17 applies;
- Pause our use of your data while we sort out a dispute about it;
- Send your data to you, or to another organisation, in a machine-readable format;
- Stop using your data for direct marketing. If you object to marketing, we stop. There is no balancing exercise and no exception;
- Withdraw your consent at any time, as easily as you gave it. That does not undo anything we did before you withdrew it;
- Not be subject to a decision made purely by a computer that has a legal or similarly significant effect on you.
How to ask. Email privacy@demandarc.com. We will reply within one month. If your request is complicated we may need up to two months more, and we will tell you within the first month if so. There is no charge.
If we have already passed your details to a client. We will deal with our own copy, tell that client about your request, and tell you who they are so you can go to them directly.
If you are unhappy. You can complain to the data protection authority where you live, where you work, or where the problem happened — the Information Commissioner's Office in the United Kingdom, or the supervisory authority in your EU or EEA country. We would rather have the chance to put it right first.
If you live in the United States
Several US states give their residents privacy rights. This section explains those rights and how to use them. It applies to you if you live in California, Colorado, Connecticut, Virginia or another state with a comprehensive privacy law. Where a right below is given by only some of those states, we give it to everyone rather than ask you which state you live in.
We treat passing your details to a client as a “sale”
When you request sponsored content, we pass your details to the client who sponsored it so they can follow you up. Under California’s CCPA and several other state laws, that counts as a sale or a share of personal information — even though no money changes hands for your data specifically, and even though it is the thing you asked us to do.
We do not argue about whether the definition catches us. We assume it does, and we give you the rights that go with it.
What we collect, sell and share
In the last twelve months we have collected these categories of personal information. The third column says whether we sell or share it — which, for us, means passing it to the client who sponsored the content you requested.
| Category | What it means for us | Sold or shared? |
|---|---|---|
| Identifiers | Your name, business email address, business phone number and employer | Yes — to the sponsoring client |
| Customer records information | The same contact details, where state law treats them as a separate category | Yes — to the sponsoring client |
| Commercial information | Which asset you requested, which program it belonged to, and whether it was delivered | Yes — to the sponsoring client |
| Professional or employment information | Your job title, job level, job function, employer, company size, industry and country | Yes — to the sponsoring client |
| Consent records | Your opt-in status and the date you opted in | Yes — to the sponsoring client, as evidence that we were entitled to pass your details on |
| Contact validity | Whether your email address is deliverable. Nothing is added to your record | No |
| Suppression records | The minimum details needed to recognise you and leave you alone, if you have asked us to | No — the whole point of this record is that it goes nowhere |
| Internet or network activity | Cookie identifiers, IP address, browser and device data, and pages viewed. Collected on demandarc.com, which uses cookies. The IT Business Wire Resource Center sets no cookies. Kept for 12 months | No |
If you work for one of our clients, publishers or suppliers, or you have applied to work at DemandArc, we also hold your business contact details or your application and employment records, as described above under What we collect and why. We do not sell or share any of it.
Sensitive personal information. We do not knowingly collect any of the categories that state law treats as sensitive — racial or ethnic origin, religious or philosophical beliefs, union membership, health, sex life or sexual orientation, genetic or biometric data, precise geolocation, the contents of your messages, government identifiers, account credentials or financial account details. The one exception is our own staff: employment records may contain payroll identifiers, which we use only to employ and pay people. Because we collect no sensitive personal information from you as a lead, and use none of it to infer anything about anyone, the right to limit how sensitive personal information is used does not arise.
Inferences. We do not build a profile of your personal characteristics or predict your behaviour. We check the details you gave us against the audience the client defined for their program — a comparison of what you told us against a stated set of criteria — and we do not add anything to your record from outside sources except confirmation that your email address works.
Who receives it. We sell or share your personal information with one category of recipient: the client who sponsored the content you requested. We name that client on the form before you submit it. We do not sell or share your personal information with anyone else, and we do not sell or share it for cross-context behavioural advertising. We also disclose personal information, without selling or sharing it, to the service providers listed above under Who we share it with — hosting, lead processing and email verification — and to advisers and authorities where the law requires it.
Where we get it, and why. These are set out above under Where we get your data and What we collect and why, except for internet and network activity, which is collected automatically from your device when you visit demandarc.com, to operate the site, understand how it is used, and protect it. The business purposes are the ones described above: delivering the content you asked for, checking you match the audience for the program, introducing you to the sponsoring client, reporting on the program, and honouring your choices.
How long we keep it. Set out above under How long we keep it, except for internet and network activity, which we keep for 12 months.
Your rights
You can ask us to:
- Tell you what we hold — the categories of personal information we have collected, sold and shared, where we got it, why we collected it, who we disclosed it to, and the specific pieces of information we hold about you;
- Delete the personal information we hold about you;
- Correct anything about you that is wrong;
- Stop selling or sharing your personal information, at any time and for any reason;
- Appeal, if we refuse a request. We will tell you how when we give you our decision.
We will not treat you differently for exercising these rights. We do not offer financial incentives for personal information, and there is nothing we could withhold from you for opting out.
How to ask
Email privacy@demandarc.com, or use the Do Not Sell/Share My Info link in the footer of either of our sites.
We will confirm we have your request within ten days and answer it within 45 days. If it is complicated we may take up to a further 45 days, and we will tell you why before the first 45 days are up. There is no charge.
If you are opting out of selling or sharing, we will not ask you to prove who you are. We just stop. For any other request we will ask for enough information to be confident the request is really yours — usually the email address you used, and sometimes a reply from that address. If we cannot verify you, we will say so rather than guess. An authorised agent may make a request for you if they provide your written permission.
Opting out, and browser signals
We honour the Global Privacy Control signal. If your browser sends it, we treat it as an instruction not to set non-essential cookies, and as an opt-out of future selling or sharing of your personal information.
One thing that signal does not do: it does not stop us delivering a lead you have just asked us to deliver. If you complete a form that names the sponsor and asks us to introduce you, we act on that request. Your opt-out applies to everything after it.
People under 16
Our services are for people at work and are not directed to children. We do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share the personal information of anyone under 16.
Cookies
We use cookies and similar technologies on demandarc.com to make it work, to understand how it is used, and for marketing. Where the law requires it we ask before setting anything non-essential, and you can change your mind at any time. The IT Business Wire Resource Center sets no cookies at all. You can also block cookies in your browser, though parts of demandarc.com may then not work properly.
How we protect your data
Lead data lives in one system rather than being scattered across spreadsheets and shared folders. That is deliberate: it is what lets us find, correct or delete your record reliably when you ask.
Access to that system requires multi-factor authentication and is limited to the people whose job needs it. We review who has access, close accounts promptly when someone leaves, and encrypt personal data both in transit and at rest. Our staff are trained on data protection and formally accept our policies. No system is perfectly secure, but we review these measures regularly.
Changes to this notice
We review this notice at least once a year. If we change something material about how we use your data, we will update the date at the top and, where the change is significant, tell you directly.
Contact us
Email privacy@demandarc.com or write to DemandArc, Inc., 10900 Research Blvd, Ste 160C‑1467, Austin, TX 78759, USA.