Arrow Electronics, Inc.

GLOBAL EXTERNAL Privacy Notice

Effective date: October 16, 2026

Last updated: October 16, 2026

1. Introduction and Scope

This Global External Privacy Notice (this “Notice”) explains how Arrow Electronics, Inc. and the Arrow entities responsible for a relevant website, service, product, account, or business relationship collect, use, disclose, retain, transfer, and protect personal information. It applies to Arrow websites, applications, online stores, portals, electronic communications, events, accounts, and other business interactions that link to this Notice (together, the “Services”).

For purposes of this Notice, (i) the term “personal information” means information that identifies or could reasonably be used to identify an individual; (ii) the terms “we,” “us,” “our” and “Arrow” refer to Arrow Electronics, Inc. and its present and future subsidiaries and affiliates; and (iii) the terms “you,” “your” and “yours” refer to any natural person who accesses or uses the Services.

This Notice describes Arrow’s privacy practices and the rights and choices that may apply to you. It is not a contract and does not itself obtain consent. Where Arrow relies on consent, Arrow requests it separately.

Arrow Electronics, Inc. is the controller for arrow.com, Arrow’s principal websites, and centrally administered marketing, unless another Arrow entity is identified at collection. An Arrow entity with which you or your organization has an account, contract, regional Service, or other business relationship may be a separate controller for processing connected with that relationship.

This Notice covers processing for which Arrow acts as a controller. Where Arrow processes personal information for an enterprise customer, the relevant customer agreement governs. The Annexes and any regional, local, or Service-specific notices supplement this Notice and govern to the extent of a conflict.

Arrow may transfer responsibility for a Service or relationship to a newly formed, dissolved, acquired, or reorganized Arrow entity. The receiving entity becomes responsible from the effective date of that change, subject to applicable law and any required notice.

2. INFORMATION WE COLLECT

Information you provide to us

Not all of the following apply to every person. What we collect depends on which Services you use, whether you hold an account, whether you buy from us directly, and the role you hold at the organization you represent.

Account, business relationship, and identity information: name, contact details, company, role, username, credentials, preferences, account number, purchasing authority, business relationship information, and information used to verify your identity or authority to act for an organization.
Transaction, payment, credit, and tax information: billing and shipping details, orders, quotes, purchase orders, returns, warranty claims, payment and bank details, credit applications, financial statements, references, guarantor information, and tax or exemption documentation.
Export control and trade compliance data: as a distributor of electronic components and technology, Arrow is subject to export control, sanctions, and trade compliance obligations. To meet them we collect and screen information including your name, your organization, your country and location, the destination and end use of products, end user and end use statements, and the identifiers needed to check you and your organization against government restricted and denied party lists. Where required to determine whether Arrow may provide particular products, software, technology, or related services, we may also request nationality, citizenship, residency, or destination information.
Engineering, design, and product tool data: where you use our engineering and product tools, the information you enter and the activity you generate. This includes part searches and saved parts lists, bills of materials you upload or build, sample and evaluation board requests, reference design activity, datasheet and documentation downloads, and design project information.
Support and communications data: the content of inquiries, support tickets, registration and quote request forms, survey responses, and correspondence with us. Chat and support features may be provided through third-party technologies. If Arrow uses recording, transcription, automated assistance, or similar functionality, Arrow will provide any additional notice required for the relevant interaction as required by applicable law
Marketing, events, and hospitality data: subscription elections and marketing preferences, content download requests, webinar and event registrations, attendance and participation records, and information you give us to attend an event, which may include travel details and related dietary, accessibility, or other event arrangement information you choose to provide.
User generated content: material you post through the Services or on our social media pages, including reviews, comments, forum posts, and any personal information you choose to include in it.
Design and opportunity registration data: where you tell us about a design project or sales opportunity, information about the project, your organization, the components being considered, anticipated volumes and timing, and your role, which we may register with the relevant manufacturer as described in Section 5.
Supplier and vendor data: where you represent a supplier or vendor, or register as one through the Services, your contact details and role, information about your organization, banking and tax details needed to pay your organization, and the information needed for our due diligence, quality, and compliance screening.

Information collected automatically

When you use the Services, we and our vendors collect information automatically through cookies and similar technologies, as described in Section 3 and in the Arrow Cookie Policy.

Device and connection data: IP address, browser type and version, operating system, device identifiers, and language settings.
Usage data: pages viewed, click path, date and time of visit, referring and exit pages, search terms used on the Services, and interaction with content, and whether and when you open our email messages and click on their links, which we learn through pixels and tracked links in those messages.
Approximate location: general location derived from IP address.
Advertising identifiers: identifiers used to measure and deliver advertising, where you have consented or where permitted.
Session interaction data: where we use session replay or similar analytics tools, the way you interact with pages, such as clicks, scrolling, and form interactions, recorded with sensitive form fields masked.

Information from other sources

We may receive personal information about you from your employer or the organization you represent, from our distributors, resellers, channel partners and suppliers, from event and webinar co-hosts, from marketing, lead generation, and business information and data enrichment providers, from manufacturers that refer sales opportunities to us, from credit reference agencies where we extend trade credit, from public sources, and from social media platforms when you interact with our pages.

Where required by applicable law, Arrow provides information about personal information obtained from another source within the applicable period.

Sensitive personal information

Some of the information we collect is treated as sensitive under applicable privacy laws. Arrow processes sensitive personal information where reasonably necessary for a specific transaction, legal obligation, security purpose, accommodation, or event arrangement. Depending on the Service, it may include:

Account credentials and information used to verify identity or authority, including government issued identification and tax identifiers;
Payment, bank, credit, citizenship, nationality, residency, and related information needed for transactions, tax, export control, sanctions, or compliance purposes; and
Health, accessibility, dietary, or religious information you voluntarily provide for an event or accommodation.

Arrow seeks to limit collection of sensitive personal information through the Services to circumstances where it is reasonably necessary. If a particular Service collects or uses such information, Arrow will provide any additional notice, and obtain any consent, required by applicable law.

Please do not include sensitive personal information in support requests, free text fields, or content you post unless it is needed for your request.

De-identified and aggregated information

We may de-identify or aggregate personal information so that it cannot reasonably be used to identify you. We may use and disclose aggregated or de-identified information for lawful purposes. Where applicable law requires, we maintain de-identified information in de-identified form and do not attempt to re-identify it except as permitted by law.

Information you provide about other people

If you provide personal information about another person, such as a colleague, delivery contact, trade reference, event attendee, owner, principal, or guarantor, please ensure that you are authorized to do so and make this Notice available to that person. Arrow uses the information for the purpose for which it was provided.

Applicant information

This Notice applies when you browse or use Arrow’s public careers sites. Personal information submitted or generated in connection with a job application is governed by the applicant privacy notice presented through the relevant careers site or application system. If you become an Arrow workforce member, relevant applicant information may be transferred into your personnel record and will then be handled as described in the Arrow Global Employee and Workforce Privacy Notice.

Whether you have to provide personal information

Some of the information described above is required by law, is necessary in order to enter into a contract with us or is necessary for us to provide a Service you have asked for. Where that is the case, we tell you at the point of collection, and we explain the consequence of not providing it.

In general, if you do not provide information that is required, we may be unable to open or maintain your account, process your order, extend trade credit, complete an export compliance check, or provide support. Where information is optional, we say so, and not providing it will not affect your access to the Services.

3. COOKIES AND SIMILAR TECHNOLOGIES

We and our vendors use cookies, pixels, tags, software development kits, and similar technologies on the Services for the purposes described below. Additional information about the technologies used, their purposes, providers, and durations is available through the cookie settings tool on each Service, in the Arrow Cookie Policy and in the Arrow privacy preference center.

The categories are:

Category

Purpose

Essential

Required to operate the Services reliably and securely and consistently with your settings, including logging into secure areas, using a shopping cart, e-billing, fraud detection and security, and recording your consent choices.

Analytics

Allow us to recognize and count visitors and understand how visitors move through the Services, so that we can improve how they work.

Personalization

Allow us to recognize you on return, tailor content, and remember your preferences.

Advertising

Record your visit, the pages you view, and the links you follow, and are used by us and our vendors to make advertising more relevant to you on the Services and on third party sites, which may involve profiling and sharing information with third parties for that purpose.

Your choices

Technologies that are strictly necessary to provide a Service or a feature you request may be used without consent where applicable law permits. Arrow seeks consent for other technologies where required.

Where required by applicable law, Arrow treats a recognized opt-out preference signal, such as Global Privacy Control, as a request to opt out of the sale or sharing of personal information and targeted advertising for the browser or device sending the signal. Where required by applicable law and where Arrow can reasonably associate the signal with an identified consumer or account, Arrow applies the request to personal information associated with that consumer or account. Some browsers offer a Do Not Track setting, but we do not currently respond to these signals because no common standard governs their interpretation.

4. How We Use Personal Information

We may use personal information for the purposes below:

Provide and administer Services, accounts, orders, quotes, payments, returns, warranties, and trade credit;
Provide technical and customer support and respond to inquiries;
Operate, secure, maintain, personalize, analyze, and improve the Services;
Send marketing communications and measure or deliver advertising where permitted;
Register design and sales opportunities, obtain pricing authorizations, and report sales to manufacturers;
Verify identity and authority and conduct fraud, security, export control, sanctions, and restricted party screening;
Onboard and manage suppliers, vendors, distributors, and channel partners;
Comply with legal, tax, export, accounting, regulatory, and recordkeeping obligations;
Establish, exercise, or defend legal claims and complete corporate transactions; and
Coordinate customer, sales, marketing, support, and compliance activities among Arrow entities.

The applicable Annexes identify the legal basis for each where GDPR or UK GDPR applies.

If we intend to use your personal information for a new purpose that is not described in this Notice and is not compatible with the purposes for which we collected it, we will tell you before we do so and, where the law requires, ask for your consent.

We do not use personal information collected through the Services to train large language models or other generative artificial intelligence models. Arrow may use analytics, artificial intelligence, or other automated tools to support certain Services and business processes. Depending on the tool and purpose, these technologies may assist with customer support, personalization, security, fraud prevention, compliance, or account administration. Arrow will provide any additional notice or choice required by applicable law.

5. HOW WE SHARE PERSONAL INFORMATION

Arrow entities, for the purposes described in Section 4.
Service providers and processors, including providers of hosting and cloud infrastructure, content delivery, payment processing, order fulfillment and logistics, customer relationship and marketing automation, support ticketing, analytics, consent management, and privacy request management. They act on our instructions under a written contract containing the terms required by Article 28 where applicable and, in the United States, the terms required for service providers and contractors under applicable state privacy laws.
Advertising and analytics partners, as described in Section 6.
Suppliers, manufacturers, distributors, and channel partners, where necessary to fulfill an order, provide a quote, process a warranty or return, or deliver support, and, as our distribution agreements require, to register design opportunities, obtain pricing authorizations, and report sales, including information about the customer and its contacts. Manufacturers may process that information for their own purposes under their privacy notices.
Event co-sponsors and co-hosts, where you register for an event or webinar that we run with a manufacturer or partner, as identified when you register.
Credit reference agencies and credit insurers, where we assess or insure trade credit.
Professional advisers, including lawyers, auditors, and insurers.
Authorities, regulators, courts, and law enforcement, where required by law or legal process, or where necessary to protect our rights, the rights of others, or the safety of any person.
Counterparties in a corporate transaction, subject to confidentiality protections.
Other parties with your consent or at your direction.

We share personal information among Arrow entities and business groups where reasonably necessary to provide relevant products or services; administer accounts; coordinate customer sales, marketing, fulfillment, and support activities; route inquiries and opportunities; manage supplier and partner relationships; operate shared systems and services; meet legal obligations; and support reorganizations or other changes within the Arrow group. This sharing remains subject to applicable law and to Arrow’s contractual and confidentiality obligations.

6. ADVERTISING, ANALYTICS, AND YOUR CHOICES

Arrow and its advertising and analytics partners may use cookies and similar technologies to measure activity, personalize content, and deliver advertising on Arrow and third-party services. Under some U.S. privacy laws, these activities may constitute sale, sharing, or targeted advertising even where no money is exchanged.

You can manage these activities through the cookie settings or privacy choices link available on the relevant Service and, where supported, through a recognized opt-out preference signal. Annex C provides additional information for U.S. residents.

Where Arrow uses customer list or audience matching services offered by advertising platforms, Arrow obtains consent or provides an opt-out as required by applicable law.

7. INTERNATIONAL TRANSFERS

Arrow operates globally. Personal information collected through the Services may be accessed by or transferred to Arrow entities and service providers in countries other than your own, including the United States and other countries in which Arrow entities are located and in which our principal service providers host or support our systems.

European Economic Area, the United Kingdom and Switzerland

Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on one or more of the following:

for transfers from the European Economic Area and the United Kingdom, transfer to an entity that participates in the EU-U.S. Data Privacy Framework or the UK Extension to it, where the transfer is within the scope of that participation;
standard contractual clauses approved by the European Commission, together with the United Kingdom International Data Transfer Addendum or the International Data Transfer Agreement for transfers originating in the United Kingdom, and the Swiss addendum for transfers originating in Switzerland; or
another mechanism recognized under applicable law, including a derogation under Article 49 where one applies.

Where we rely on standard contractual clauses, we assess the transfer and apply supplementary measures where the assessment indicates they are needed.

You may request a copy of the safeguards we use, redacted where necessary to protect commercial information, by contacting us using the details in Section 14.

Where the law of your country requires your consent, a government filing, or another specific mechanism for transfers of your personal information abroad, we obtain that consent or use that mechanism.

EU-U.S. Data Privacy Framework

Arrow Electronics, Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce. Arrow Electronics, Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF, and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. If there is any conflict between the terms in this Notice and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Arrow’s certification covers both human resources data and non-human resources data. This Section describes Arrow’s DPF commitments for non-human resources data, such as personal data of customer, supplier, and other business contacts collected through the Services and our other business interactions. Arrow’s commitments for human resources data are described in the Arrow Global Employee and Workforce Privacy Notice. The U.S. Arrow entities that adhere to the DPF Principles are listed in Arrow Electronics, Inc.’s entry on the Data Privacy Framework List at https://www.dataprivacyframework.gov/list. An Arrow entity is covered only once it is identified in Arrow’s DPF List entry. The types of personal data we collect, the purposes for which we use it, and the types of third parties to which we disclose it are described in Sections 2, 4, and 5.

Where we intend to disclose personal data received under the DPF to a third party acting as a controller, or to use it for a purpose materially different from the purpose for which it was originally collected or subsequently authorized by you, we will offer you the opportunity to opt out. Where the personal data is sensitive data, we will obtain your affirmative express consent (opt in) before doing so, unless an exception under the DPF Principles applies. You may exercise these choices by contacting us using the details in Section 14.

You have the right to access personal data about you that Arrow holds in reliance on the DPF, and to correct, amend, or delete it where it is inaccurate or has been processed in violation of the DPF Principles, subject to the limitations in the Principles. You may make a request as described in Section 10.

Arrow is responsible for the processing of personal data it receives under the DPF and subsequently transfers to a third party acting as an agent on its behalf. Arrow remains liable under the DPF Principles if its agent processes that personal data in a manner inconsistent with the Principles, unless Arrow proves that it is not responsible for the event giving rise to the damage.

Arrow is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Arrow commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU, UK and Gibraltar individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF should first contact Arrow using the details in Section 14. Arrow will respond to DPF Principles-related complaints within forty-five (45) days of receipt.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Arrow commits to refer unresolved complaints concerning our handling of non-human resources personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF to the International Centre for Dispute Resolution of the American Arbitration Association (“ICDR-AAA”), an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://go.adr.org/dpf_irm.html for more information or to file a complaint. The services of ICDR-AAA are provided at no cost to you.

Complaints concerning human resources data are handled as described in the Arrow Global Employee and Workforce Privacy Notice, under which Arrow cooperates with the panel established by the EU data protection authorities and with the UK Information Commissioner’s Office.

Under certain conditions, more fully described on the Data Privacy Framework website at https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction, you may invoke binding arbitration when other dispute resolution procedures have been exhausted. Arrow may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Additional Jurisdictions

Annexes D, E and F provide additional information for individuals in Canada, Brazil and Mainland China.

8. HOW LONG WE KEEP PERSONAL INFORMATION

We may keep your personal information for as long as necessary for the purposes described in this Notice, including to meet legal, tax, accounting, and reporting obligations; to resolve disputes; and to enforce our agreements. Retention periods vary based on the type of information, the purpose for which it was collected, legal requirements, contractual obligations, and business needs. For individuals covered by Annex C, the criteria we use for each category of personal information are summarized in the retention criteria column of the table in Section C.1 of Annex C.

Where we no longer need personal information, we delete it or de-identify it according to the appropriate retention periods. We may retain de-identified information indefinitely.

9. SECURITY

Arrow uses technical, organizational and physical safeguards designed to protect personal information taking into account the nature of the information, the purposes for which it is used, and the risks involved. These measures may include access controls, authentication, encryption, monitoring, secure configuration, incident response procedures, vendor controls, and workforce training.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly if you believe your account has been compromised.

10. Your Rights and Choices

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive portable information, withdraw consent, and complain to a supervisory authority. Annexes A through F describe additional rights and information for individuals in the EEA, Switzerland, the United Kingdom, the United States, Canada, Brazil and Mainland China.

Right	What it means
Access	To confirm whether we process your personal information and to receive a copy of it, together with information about purposes, categories, recipients, retention, your rights, the source, and any automated decision making.
Rectification	To have inaccurate information corrected and incomplete information completed.
Erasure	To have personal information deleted where a ground in the applicable law or regulation applies.
Restriction	To have processing restricted in the circumstances set out in the applicable law or regulation.
Portability	To receive information you provided to us in a structured, commonly used, machine readable format and to have it transmitted to another controller, where processing is based on consent or contract and is automated.
Objection	To object to processing based on legitimate interests on grounds relating to your particular situation, and to object to direct marketing at any time, which we will honor in accordance with applicable law.
Withdraw consent	To withdraw consent at any time where we rely on it, without affecting prior processing.
Complain	To lodge a complaint with a supervisory authority, in particular in your country of habitual residence, place of work, or the place of the alleged infringement. In the United Kingdom you may also complain to us first under our complaints procedure. See Section B.6 of Annex B.

Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline to act, as the law permits. We respond within the period required by applicable law, which under GDPR and UK GDPR is generally one month and may be extended by up to two further months where permitted, in which case we will tell you and explain why.

Rights available in the United States

See Annex C, which sets out the rights available to residents of states with comprehensive privacy laws, including the right to opt out of the sale or sharing of personal information and of targeted advertising.

Marketing choices

You may unsubscribe from marketing emails using the link in any message, or by contacting us using the details in Section 14. We will act on your request within the time required by applicable law. We may continue to send you transactional and service messages relating to your account or orders, which are not marketing.

Automated decision making

Arrow may use automated tools to support functions such as security screening, fraud prevention, trade compliance screening, credit assessment, personalization, chat and customer support, lead scoring, and service administration. Where Arrow uses automated decision making or profiling that replaces or substantially replaces human decision making, or that produces legal or similarly significant effects about an individual, Arrow provides the notices, choices, access, human review, explanation and other safeguards required by applicable law.

How to make a request

You may submit a privacy request through our Data Subject Rights Request form or by using the contact information in Section 14. Depending on where you live and the nature of the request, Arrow may request information reasonably necessary to verify your identity, locate relevant records, or confirm your authority to act for another person. Where applicable law permits an authorized agent to submit a request, Arrow may require evidence of the agent’s authority and may contact the individual directly where permitted or required. If Arrow declines to act on a request and applicable law provides a right to appeal, Arrow will provide instructions for submitting the appeal and will respond within the period required by that law.

11. Children

The Services are intended for business users and are not directed to children. We do not knowingly collect personal information from children under age 16 through the Services, and we do not knowingly sell or share, or use for targeted advertising, the personal information of individuals under age 18.

12. Third Party Sites, Social Media, and Integrations

The Services may link to or embed content from third party sites and platforms, including social media features, video players, and mapping tools. Those third parties may collect information about you through their own technologies, and their handling of that information is governed by their own privacy notices. We encourage you to read them. We are not responsible for the content or privacy practices of sites we do not operate.

13. Changes to This Notice

We may update this Notice from time to time. When Arrow does, it will revise the “Last updated” date and provide any additional notice or obtain any consent required by applicable law. If a material change affects how we use personal information already collected, we will provide any required notice before the change takes effect and obtain consent where required.

14. How to Contact Us

Questions, requests, and complaints about this Notice or about how Arrow handles personal information may be sent by email at compliance@arrow.com, by telephone at the following numbers:

North America: +1-855-326-4757
Europe, Middle East and Africa: +44 2039 365486
Asia-Pacific: +86 21 6154 5907
Japan local number: +81 50 3154 8289

or by post to:

Arrow Electronics, Inc.
Attn: Legal Department (Data Protection)
9151 East Panorama Circle
Centennial, CO 80112, USA

Contact details for our regional privacy contacts and data protection officers are in the Annexes.

We ask that you raise concerns with us first so that we have an opportunity to resolve them. That does not affect your right to complain to a supervisory authority or regulator, or to seek a judicial remedy, at any time. Details are in the Annexes.

If you have a disability and need this Notice in an alternative format, please contact us using the details above.

ANNEX A

European Economic Area and Switzerland

This Annex applies to individuals in the European Economic Area and, as set out in A.5, Switzerland, and supplements Sections 1 to 14 of the Notice.

A.1 Controller

For personal information collected through Arrow’s principal websites and through marketing that Arrow administers centrally, the controller is Arrow Electronics, Inc. Where you or your organization holds an account, contract, or other business relationship with an Arrow entity established in the European Economic Area, or where that entity collects your information for a regional Service or at the point of collection, that entity may also be a controller, separately from Arrow Electronics, Inc., for its own use of your information.

A.2 Lawful Bases in the EEA

Where GDPR applies, Arrow relies on the lawful bases summarized below:

Purpose	Lawful basis
Providing Services, administering accounts, processing orders, payments, returns, and support	Contract where the individual is the contracting party; otherwise legitimate interests in providing Services and managing business relationships
Security, fraud prevention, identity verification, and misuse detection	Legitimate interests in protecting Arrow, its systems, customers, and users; legal obligation where applicable
Tax, accounting, export control, sanctions, corporate transactions, legal claims and legal compliance	Legal obligation where imposed by applicable EU or Member State law; otherwise legitimate interests in complying with other applicable laws and managing legal and regulatory risk
Marketing, personalization, analytics, and advertising	Consent where required; otherwise legitimate interests in communicating with business contacts and improving and promoting Arrow’s Services
Supplier, manufacturer, channel, opportunity registration, and business administration	Contract where applicable; otherwise legitimate interests in operating Arrow’s distribution business and managing commercial relationships
Events and accommodations involving health, dietary, religious, or accessibility information	Consent and, where the information is special category data, explicit consent or another applicable condition under Article 9

Purpose

Lawful basis

Providing Services, administering accounts, processing orders, payments, returns, and support

Contract where the individual is the contracting party; otherwise legitimate interests in providing Services and managing business relationships

Security, fraud prevention, identity verification, and misuse detection

Legitimate interests in protecting Arrow, its systems, customers, and users; legal obligation where applicable

Tax, accounting, export control, sanctions, corporate transactions, legal claims and legal compliance

Legal obligation where imposed by applicable EU or Member State law; otherwise legitimate interests in complying with other applicable laws and managing legal and regulatory risk

Marketing, personalization, analytics, and advertising

Consent where required; otherwise legitimate interests in communicating with business contacts and improving and promoting Arrow’s Services

Supplier, manufacturer, channel, opportunity registration, and business administration

Contract where applicable; otherwise legitimate interests in operating Arrow’s distribution business and managing commercial relationships

Events and accommodations involving health, dietary, religious, or accessibility information

Consent and, where the information is special category data, explicit consent or another applicable condition under Article 9

Where Arrow relies on legitimate interests, the relevant interests include providing and improving the Services, managing business relationships, operating Arrow’s distribution business, protecting Arrow and its users, and promoting Arrow’s products and services. Arrow considers the necessity and proportionality of the processing and its potential effect on individuals.

Where Arrow relies on consent, you may withdraw it at any time, without affecting processing completed before withdrawal.

Where Arrow processes special category personal data, Arrow also relies on an applicable condition under Article 9 of GDPR.

A.3 Data protection officer for German affiliates

Arrow has appointed a data protection officer for its German affiliates:

Florian Reichert
Scheja & Partners GmbH & Co. KG
Adenauerallee 136
53113 Bonn
Germany

Telephone: +49 (0) 228-227 226-0

Encrypted contact form: https://scheja-partners.de/en/contact/?florian-reichert#formular

You may contact the data protection officer directly on any matter relating to the processing of your personal information by an Arrow entity in Germany.

Individuals in other EEA countries may contact us using the details in Section 14.

A.4 Supervisory authorities

You may lodge a complaint with the supervisory authority in the Member State of your habitual residence, place of work, or the place of the alleged infringement.

A list of the supervisory authorities in each Member State, with contact details, is published by the European Data Protection Board at https://www.edpb.europa.eu/about-edpb/about-edpb/members.

A.5 Switzerland

Arrow processes personal information in accordance with the principles and requirements of the Swiss Federal Act on Data Protection. Where a justification is required, Arrow relies on consent, an overriding private or public interest, or applicable law, as appropriate.

For individuals in Switzerland, the controller is determined as described in Section 1 and Section A.1 of Annex A. Because Arrow has establishments in Switzerland, it has not appointed a representative under Article 14 of the Federal Act on Data Protection (FADP).

Under the FADP you have the right to request access to your personal information, to receive it in a common electronic format where the conditions of Article 28 FADP are met, to have inaccurate data corrected, and to object to processing or request deletion, subject to the exceptions in the FADP. You may exercise these rights as described in Section 10.

You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland, www.edoeb.admin.ch.

ANNEX B

United Kingdom

This Annex applies to individuals in the United Kingdom and supplements Sections 1 to 14 of the Notice.

B.1 Controller

For individuals in the United Kingdom, Arrow Electronics, Inc. is the controller of personal information collected through Arrow’s principal websites and through marketing that Arrow administers centrally. Where you or your organization holds an account, contract, or other business relationship with Arrow’s UK entity, or where that entity collects your information for a regional Service or at the point of collection, that entity may also be a controller for its own use of your information:

Arrow Electronics (UK) Ltd., company number 02582534, registered office Kao 1 Kao Park, Hockham Way, Harlow, Essex, United Kingdom, CM17 9NA.

B.2 Lawful Bases

For processing subject to the UK GDPR, Arrow relies on the lawful bases summarized in Section A.2 of Annex A, interpreted under the UK GDPR and applicable UK law.

B.3 Data protection officer and privacy contact

Individuals in the United Kingdom may contact our privacy team using the details in Section 14.

B.4 Cookies and direct marketing

The Privacy and Electronic Communications Regulations apply to the storage of and access to information on your device and to electronic direct marketing.

We obtain your consent before setting cookies and similar technologies that are not strictly necessary, except where an exemption under the Privacy and Electronic Communications Regulations applies, in which case we tell you and give you a simple way to object. Where those Regulations require consent for electronic marketing, we send it only where you have consented, or where the soft opt-in applies because you are an existing customer and the marketing relates to similar products and services. Every marketing message includes an unsubscribe option.

B.5 International transfers

Arrow Electronics, Inc.’s participation in the UK Extension to the EU-U.S. Data Privacy Framework, including independent recourse and binding arbitration, is described in Section 7 under “EU-U.S. Data Privacy Framework.”

Where a transfer is not covered by that certification, transfers from the United Kingdom to countries without UK adequacy regulations are made under the International Data Transfer Agreement, or under the European Commission standard contractual clauses as supplemented by the UK International Data Transfer Addendum, in each case together with a transfer risk assessment.

B.6 Complaints

Arrow provides a channel for data protection complaints and acknowledges qualifying complaints within thirty (30) days. Arrow takes appropriate steps to investigate and respond without undue delay and keeps the complainant reasonably informed.

You may complain to the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, or through the ICO website at https://ico.org.uk. Individuals in Gibraltar may complain to the Gibraltar Regulatory Authority.

ANNEX C

United States

This Annex applies to residents of states with comprehensive consumer privacy laws and, where indicated, to California residents specifically. Except in California, these laws generally apply only to individuals acting in a personal or household capacity, and not to individuals acting for a business. This Annex supplements the body of this Notice and constitutes the notice at collection required under California law.

C.1 Categories of personal information collected, disclosed, and sold or shared

Statutory category	Examples	Disclosed for a business purpose to	Sold or shared?	Retention criteria
Identifiers	Name, email, postal address, telephone, IP address, device and cookie identifiers, Arrow account number	Service providers, channel partners, advisers, authorities	Yes, to advertising and analytics partners	Duration of the account or business relationship, plus the period needed for legal, tax, audit, trade compliance, and dispute resolution purposes
Customer records information	Billing and shipping address, payment and bank details, credit references, guarantor details	Payment processors, logistics providers, credit agencies, insurers	No	Duration of the relationship and applicable financial, tax, accounting, and credit record retention requirements
Commercial information	Orders, quotes, returns, products viewed and considered, saved parts lists and bills of materials	Service providers, channel partners, suppliers and manufacturers	Yes, to advertising and analytics partners	Applicable financial, tax, warranty, and trade compliance recordkeeping periods and any reporting obligations under our distribution agreements
Internet or network activity	Browsing and search history on the Services, click path, interaction with content and email	Analytics and advertising partners	Yes, to advertising and analytics partners	The period needed for analytics, security, and advertising purposes, reflected in the durations disclosed through the cookie settings tool
Geolocation data	Approximate location derived from IP address	Analytics and advertising partners	Yes, to advertising and analytics partners	The period needed for analytics, security, and advertising purposes, reflected in the durations disclosed through the cookie settings tool
Professional or employment information	Company, job title or job type, business contact details, purchasing authority	Service providers, channel partners	Yes, to advertising platforms for audience matching and event co-sponsors	Duration of the business relationship and, for marketing, until you opt out or the information is no longer current, plus any applicable legal period
Audio, electronic, visual information	Recorded support and chat sessions where notified, user generated content	Service providers, including recording and transcription vendors	No	The period needed for quality, training, and dispute resolution purposes; user generated content for as long as it remains posted
Education information	Professional qualifications and certifications, where you provide them	Service providers	No	Duration of the relationship or the relevant program
Characteristics of protected classifications	Disability, health, or religious information revealed by an accessibility or dietary request for an event and citizenship or nationality, if collected for trade compliance	Event service providers; trade compliance screening providers and authorities, where applicable	No	The period needed for the event arrangement and any applicable legal or trade compliance recordkeeping requirement
Inferences	Product and content preferences drawn from your activity on the Services	Service providers, advertising partners	Yes, to advertising partners	The period needed for personalization and advertising, or until you opt out where applicable
Sensitive personal information	Account log-in credentials; government issued and tax identifiers; identity verification documents; financial account information; citizenship, nationality, or residency information used for trade compliance; and event related health, accessibility, dietary, or religious information, each as described in Section 2 (Sensitive personal information)	Service providers	No	Credentials for the life of the account; identifiers, verification documents, and financial account information for the period needed for the transaction or verification and applicable legal, tax, and trade compliance requirements; event information for the event arrangement

The sources of this information are described in Section 2, the purposes in Section 4, and retention in Section 8 and the retention criteria column above.

The table describes the personal information we have collected, disclosed for a business purpose, sold, or shared in the 12 months before the last updated date of this Notice. We have no actual knowledge that we sell or share the personal information of consumers under 16.

C.2 Your rights

Subject to verification and to statutory exceptions, you have the right to:

know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of recipients, including, in California, personal information collected before the 12 months preceding your request, back to January 1, 2022, where we still hold it;
delete personal information we collected from you;
correct inaccurate personal information;
obtain a portable copy of your personal information;
opt out of the sale or sharing of personal information and of targeted advertising;
opt out of profiling in furtherance of decisions producing legal or similarly significant effects, where applicable;
limit the use and disclosure of sensitive personal information, where applicable;
obtain a list of the specific third parties, or the categories of third parties, to which we have disclosed your personal information, where the law of your state provides this right (for example, Oregon, Delaware, and Minnesota);
question the result of profiling used to make a decision that produces legal or similarly significant effects, be told the reasons for the decision, and review the personal information used, where the law of your state provides this right (for example, Minnesota and Connecticut); and
be free from discrimination or retaliation for exercising any of these rights.

We do not charge you for exercising these rights, and we do not deny you goods or services, charge you a different price, or provide you a different level of service because you have done so. Arrow responds within the period required by applicable law and will notify you if a permitted extension is necessary.

C.3 How to opt out

You may opt out of the sale or sharing of personal information and of targeted advertising by:

using the “Your Privacy Choices” link in the footer of each Service;
adjusting your choices through the cookie settings link on each Service;
contacting us using the details in Section 14; or
enabling an opt-out preference signal, such as Global Privacy Control, in your browser, which Arrow treats as described in Section 3.

These mechanisms are described further in Sections 3 and 6. Choices made through cookie settings apply to the browser and device you use. You do not need to create an account or verify your identity to opt out.

C.4 Sensitive personal information

We use and disclose the sensitive personal information described in Section 2 (Sensitive personal information) only for the purposes permitted under the CCPA regulations, which include providing the Services you request, verifying your identity, preventing fraud and unauthorized access, and meeting our legal obligations. We do not use or disclose it to infer characteristics about you.

Because our use falls within those permitted purposes, the right to limit the use and disclosure of sensitive personal information does not apply, and we do not offer a separate limitation mechanism. If that changes, we will update this Notice and provide the mechanism.

Where the law of your state requires your consent before we process sensitive data, we obtain it, except where the law does not require consent for the processing concerned.

C.5 California specific disclosures

Employee and business contact data. California, unlike most states, applies its privacy law to personal information about employees, applicants, and business to business contacts. Employee data is addressed in the Arrow Global Employee and Workforce Privacy Notice, and applicant data in the California applicant notice at collection on our careers site. Business contact data collected through the Services is covered by this Notice and this Annex.

Shine the Light. California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. Requests may be sent to the contact in Section 14.
Minors. As described in Section 11, we do not knowingly sell or share, or use for targeted advertising, the personal information of individuals under 18.
Notice of financial incentive. We do not offer any financial incentive or price or service difference in exchange for the retention or sale of personal information.
Data broker registration. We are not a data broker. We do not sell personal information about consumers with whom we do not have a direct relationship, and we are not registered as a data broker in any state.

C.6 Other state and sectoral laws

Some states regulate particular categories of information separately from their comprehensive privacy laws. Where those laws apply to information we hold about you, we comply with them in addition to this Notice.

Nevada. Nevada residents may submit a request directing us not to sell covered information, as defined in Nevada law, by emailing compliance@arrow.com. We do not sell covered information as that term is defined under Nevada law.

ANNEX D

Canada

This Annex applies when Arrow processes personal information subject to Canadian private sector privacy law. Arrow handles personal information in accordance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and applicable provincial privacy laws, including those of Alberta, British Columbia and Québec.

D.1 Accountability

The Arrow entity identified under Section 1 is responsible for the personal information it controls. Questions and complaints may be directed to Arrow using the contact information in Section 14 of the Notice. For Québec, the title and contact information of the person in charge of the protection of personal information are Vice President of Legal Affairs – Data Protection and compliace@arrow.com.

D.2 Consent and marketing

Arrow identifies the purposes for collecting personal information at or before collection and obtains meaningful consent where required. Depending on the circumstances and the sensitivity of the information, consent may be express or implied, or Arrow may rely on an exception permitted by law. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Arrow will explain any material consequences of withdrawal.

Arrow sends commercial electronic messages to individuals in Canada only as permitted by applicable anti-spam law. Each marketing message provides a means to unsubscribe. Unsubscribing from marketing does not prevent Arrow from sending transactional, security, or service communications.

In Québec, where Arrow collects personal information using technology that includes functions allowing an individual to be identified, located or profiled, Arrow provides notice of that use and explains the means available to activate the relevant functions. Where Québec’s privacy by default requirement applies to a technological product or service offered to the public, Arrow configures applicable privacy settings as required by law.

D.3 Processing outside Canada or Québec

Arrow and its service providers may process personal information in the United States and other jurisdictions identified in Section 7 of the Notice. While information is in another jurisdiction, it may be accessible to courts, law enforcement agencies or national security authorities under that jurisdiction’s laws.

Where Arrow transfers personal information to a service provider for processing, Arrow uses contractual or other measures designed to provide protection appropriate to the information and remains accountable as required by Canadian law. Before communicating personal information outside Québec, Arrow takes the measures required by applicable Québec law, which may include assessing relevant privacy factors and implementing appropriate contractual safeguards.

D.4 Your rights

Subject to applicable law and exceptions, you may request access to personal information Arrow holds about you, request correction of inaccurate or incomplete information, withdraw consent, and challenge Arrow’s compliance with Canadian privacy law.

Québec law may also provide rights relating to data portability, cessation of dissemination, and de-indexing or re-indexing where the statutory conditions are met. Requests may be submitted as described in Section 14 of the Notice. Where Arrow makes a decision based exclusively on automated processing of your personal information, Québec law may entitle you to receive information about the personal information used and the reasons and principal factors that led to the decision, to have inaccurate information corrected, and to submit observations to a member of Arrow’s personnel who is able to review the decision. You may also complain to the Office of the Privacy Commissioner of Canada or, where applicable, the Commission d’accès à l’information du Québec, the Office of the Information and Privacy Commissioner of Alberta or the Office of the Information and Privacy Commissioner for British Columbia.

ANNEX E

Brazil

This Annex applies to individuals in Brazil and to processing subject to the Brazilian General Data Protection Law (“LGPD”).

E.1 Controllers and data protection contact

For Arrow’s principal websites and centrally administered marketing, the controller is Arrow Electronics, Inc., unless another Arrow entity is identified at collection. For a local account, contract, Service, or other business relationship, the Arrow entity identified at or before collection may act as a separate controller. Additional information about the applicable Brazilian controller may be provided at the relevant collection point or through a local notice.

Arrow’s data protection contact for Brazil, including the individual or function designated to serve as encarregado may be contacted at compliance@arrow.com directed to the Vice President of Legal Affairs – Data Protection.

E.2 Purposes and legal bases

The categories of personal data Arrow processes, the sources, purposes, recipients and retention practices are described in Sections 2, 4, 5 and 8 of the Notice. Depending on the processing, Arrow relies on one or more of the following legal bases: consent; performance of a contract or steps requested before entering a contract; compliance with legal or regulatory obligations; the regular exercise of rights; protection of credit; or legitimate interests, subject to the balancing of interests required by the LGPD.

Arrow processes sensitive personal data only under a basis permitted by Article 11 of the LGPD, such as specific and highlighted consent, compliance with a legal or regulatory obligation, the regular exercise of rights, or fraud prevention and security in identification and authentication processes.

Where Arrow relies on consent, you may withdraw it through a free and facilitated procedure. Withdrawal does not affect processing completed lawfully before withdrawal.

E.3 Your rights

Subject to the LGPD and applicable exceptions, you may request:

confirmation that Arrow processes your personal data;
access to your personal data;
correction of incomplete, inaccurate, or outdated data;
anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed unlawfully;
portability, subject to applicable regulations and protection of trade secrets;
deletion of data processed on consent, subject to lawful retention;
information about public and private entities with which Arrow has shared data;
information about the possibility and consequences of withholding consent;
withdrawal of consent;
review of decisions made solely through automated processing that affect your interests, and information about the criteria and procedures used, subject to protection of trade and industrial secrets; and
objection or other relief provided by the LGPD.

Requests may be submitted as set forth in Section 10 of the Notice. Arrow responds to requests within the periods and in the form required by the LGPD and applicable ANPD regulations. For confirmation or access requests, Arrow provides a simplified response immediately or a clear and complete statement within fifteen (15) days, as provided by Article 19 of the LGPD. You may also petition the ANPD or applicable consumer protection bodies in accordance with their procedures.

E.4 International transfers

Arrow may transfer personal data from Brazil to Arrow entities and service providers in other countries, including the United States. Arrow uses an international transfer mechanism or other legal basis permitted by the LGPD and applicable ANPD regulations. Where required by ANPD regulations, Arrow makes information about the relevant international transfers, and the applicable contractual terms, available in Portuguese, subject to the protection of commercial and industrial secrets.

E.5 Children and adolescents

The Services are intended for business users and are not directed to children or adolescents. If Arrow processes personal data of a child or adolescent in circumstances subject to the LGPD, it will act in the individual’s best interests and obtain parental or guardian consent when required.

ANNEX F

Mainland China

This Annex applies to individuals in Mainland China, excluding Hong Kong, Macao and Taiwan, and supplements the Notice where the Personal Information Protection Law of the People’s Republic of China (“PIPL”) applies.

F.1 Personal information processors

For Arrow’s principal websites and centrally administered marketing, the personal information processor is Arrow Electronics, Inc., unless another Arrow entity is identified at collection.

The Arrow entity identified at the point of collection, or that determines the purposes and methods of the relevant processing, acts as the personal information processor under the PIPL. Additional entity and contact information may be provided through a collection point or Service-specific notice.

Where the PIPL requires an overseas Arrow entity to establish a specialized agency or designate a representative in Mainland China, Arrow provides the required identifying and contact information through the applicable Service or collection-specific notice. Arrow may also identify a local privacy contact for the relevant Service.

F.2 Processing information and consent

Sections 2, 4, 5 and 8 of the Notice describe the categories of personal information Arrow processes, its purposes and methods, recipients and the criteria used to determine retention. Arrow processes personal information only where a basis permitted by the PIPL applies. Depending on the processing, Arrow may rely on your consent; necessity to enter into or perform a contract to which you are a party; compliance with statutory duties or obligations; protection of life, health or property in an emergency; reasonable processing of information that you have made public or that has otherwise been lawfully disclosed; or another basis permitted by law. Arrow retains personal information for the shortest period necessary for the stated purpose unless a longer period is required or permitted by law.

Where processing is based on consent, Arrow obtains consent in the form and manner required by applicable law and provides a convenient means to withdraw it. Arrow obtains separate consent when required, including for certain processing of sensitive personal information, provision of personal information to another independent processor, public disclosure, and transfers outside Mainland China.

F.3 Sensitive information and minors

Arrow processes sensitive personal information only for a specific and necessary purpose and with appropriate protective measures. Before doing so, Arrow provides any required information about the necessity of the processing and its effects on individual rights and obtains separate or written consent where required.

The Services are not directed to minors. If Arrow knowingly processes personal information of a child under age 14, it obtains consent from the child’s parent or guardian and applies special processing rules.

F.4 Recipients and cross-border transfers

Where Arrow provides personal information to another personal information processor, Arrow informs you of the recipient’s name and contact information, the purposes and methods of processing, and the categories of information, and obtains separate consent when required.

Before transferring personal information outside Mainland China, Arrow provides any additional information required by applicable law, which may include information about the overseas recipient, the processing purposes and methods, the categories transferred, and how individuals may exercise their rights. Arrow completes any assessment, filing, contract, certification, consent process or other measure required by applicable Chinese law for the relevant transfer.

F.5 Automated decision making and marketing

Where the PIPL applies to automated decision making, Arrow provides the transparency, choice, explanation and other protections required by applicable law.

For personalized content or marketing based on automated decision making, Arrow provides an option that is not based on personal characteristics or a convenient means to refuse personalized marketing. Where a solely automated decision has a significant effect on your rights or interests, you may request an explanation and may refuse a decision made solely through automated processing as provided by law.

F.6 Your rights

Subject to applicable law and exceptions, you may ask to be informed about and make decisions concerning processing; restrict or refuse processing; access and copy, correct, supplement, or delete personal information; request transfer of your personal information to another processor where the conditions set by the Cyberspace Administration of China are met; withdraw consent; request an explanation of Arrow’s processing rules; and exercise rights relating to automated decisions. The next of kin of a deceased individual may exercise certain of these rights as provided by law.

Requests may be submitted as described in the “How to Make a Request” section of the Notice or through any Mainland China contact identified for the relevant Service. You may submit a complaint to a competent authority or seek relief in a competent court as provided by applicable law.