1. Home
    2. /
  2. Privacy Center
    3. /
  3. Privacy Policy

Arrow Privacy Notice

Introduction: Company and website information

This Privacy Notice describes how Arrow Electronics, Inc., its affiliates and wholly owned subsidiaries (collectively, “Arrow”, “we”, or “us”) collects, uses and shares information about you through (1) Arrow websites or mobile apps operated by us from which you are accessing this Privacy Notice (“Arrow websites”), (2) through Arrow’s social media pages (“Social Media Pages”), as well as through (3) email messages or text messages that Arrow may send to you that link to this Privacy Notice (1-3 collectively referred to as the “Services”).

This Privacy Notice does not apply to Arrow’s data collection activities offline or otherwise outside of the Services (except as otherwise stated in this Notice or at the time of collection). By using the Services, you agree to Arrow’s Terms and Conditions and this Privacy Notice. If you do not agree and/or do not consent, discontinue use of the Services and uninstall Service downloads and applications.

The responsible controller for the processing on this website is:

Arrow Electronics, Inc.

9151 E Panorama Cir, Centennial, CO 80112 USA

compliance@arrow.com

1-855-326-4757

Data Protection Representative

You may reach our data protection representative at: compliance@arrow.com

The protection of your personal data is of particular concern to us. We treat the personal data provided by you in the context of the use of our website and services confidentially and in accordance with the applicable data protection laws as well as this privacy policy.

In the following, we would like to inform you in detail about which personal data we collect, for which purposes they are used, with whom we share data and which privacy rights you may be entitled to.

Representative in the European Union

We have appointed a Representative in Germany for the purposes of ensuring compliance with the GDPR.

The contact details of the Representative are: Gregor Scheja, Scheja Partners, Gregor-Scheja@Scheja-Partners.de

Definitions

Personal data means any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Recipient means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, including both processors and controllers.

Legal basis means a lawful ground for data processing under the GDPR.

Data Processing Activities

We collect certain personal information to provide specific Services and functionalities on Arrow websites.

The following sections describe the different data processing activities we conduct on Arrow websites. The information particularly reflects the processing purposes, what personal data we process for this purpose as well as the legal basis for the processing.

Informational use of Arrow websites

a) If you visit an Arrow website for informational purposes only, i.e. surfing on our website without specifically providing personal data, we will process the following information about you. The information may include a limited amount of personal data:

  • IP Address
  • Referrer URL
  • Browser Information
  • Device Information
  • Date and time of the user request

This information is processed to enable you to use our website (e.g. by adapting our website to the needs of your device or browser).

The legal basis for this data processing is performance of contract, Art. 6 para. 1 sentence 1 lit. b GDPR, as we need the information for the effective provision of our website, and for providing you the services of our website at your request. Without the processing of the above-mentioned personal data, we will not be able to carry out the communication over the network and provide you with the required functionalities of our website.

We retain this personal data for 10 years.

User Accounts

a) You have the possibility to register for a user account on the Arrow websites. During registration we will process the following personal data about you:

  • First Name
  • Last Name
  • Email Address
  • Address
  • Payment Info

b) The lawfulness of this data processing is “performance of contract” follows from Art. 6 para. 1 sentence 1 lit. b GDPR. The processing is required for the effective provision and the administration of your user account. Without providing the data required for registration, it is not possible to create a user account on our website.

We retain your personal data while you have a user account with us.

c) You can delete your customer account as follows:

i. Please contact us by e-mail at the email address listed above with your written request for deletion. If you decide to delete your customer account, the account data will be deleted, unless further data retention is required or justified under the applicable law.

ii. You can also delete your entire account within your customer account. If you decide to delete data or your customer account, the account data will be deleted, unless further data retention is required or justified under the applicable law.

Contact Forms

You have the possibility to contact us using the contact details provided on the website. If you contact us, we will process the content of your inquiry, your name, your e-mail address or telephone number, if applicable, our answers as well as all information that you voluntarily provide us with in the context of the inquiry in order to be able to adequately handle your request.

You further have the possibility to contact us via the contact form on our website. In this case, we collect the following personal data:

We will process this data as well as the content of your inquiry, our answers and all information that you voluntarily provide us with in the context of the inquiry in order to be able to adequately handle your request.

The lawfulness of this data processing is “legitimate interests” (results from Art. 6 para. 1 sentence 1 lit. b, f GDPR), as this data processing is necessary to ensure proper contact and the provision of customer service. This provision of adequate customer service is our legitimate interest that requires us to process your personal data.

We will retain your data as long as necessary to adequately process your request. Afterwards, it will be deleted, unless longer storage is not required or justified by law.

The retention period for the personal data processed to process your request is:
2 years
Afterwards, it will be deleted, unless longer storage is not required or justified by law.

You have a right to object to processing based on our legitimate interests. As a consequence of any valid objection, we will no longer process your data unless we have sufficiently compelling and legitimate grounds for the processing.

Newsletters

a) You may register for our newsletter on our website. During the registration process we collect the following personal data:

  • First Name
  • Last Name
  • Email Address

We process this data to provide you with the newsletter. The data processing is based on your consent (Art. 6 para. 1 sentence 1 lit. a GDPR). The consent is voluntary. You can revoke your consent at any time without giving reasons with effect for the future. To do so, simply click on the ‘Unsubscribe’ link included in every newsletter or send us an e-mail.

b) We will retain your data as long as necessary you are subscribed to the newsletter. Afterwards, it will be deleted, unless longer storage is required or justified by law. Once you have unsubscribed from the newsletter, we will retain your just strictly necessary information to ensure that we respect your newsletter subscription preferences in the future.

c) The retention period for the personal data is: 10 years

Afterwards, it will be deleted, unless longer storage is required or justified by law.

Job Applications

a) If you apply for a job in our company, we will process your name, contact details, qualifications and other data that you provide us with your application.

(b) In the course of the application procedure, we only process those personal data of yours which are provided by you and related to your application and which are needed for the determination of your professional and personal skills with respect to the position that is to be filled. This may include:

  • Contact data, including your name, address, and telephone number
  • Data relating to your education and qualifications
  • Data relating to training and additional qualifications, if any

The extent of the personal data is essentially determined by you when you submit your application documents. We may complete your application documents in the course of the application procedure by adding the following data:

  • Notes pertaining to the course of the application procedure
  • Job-related information that was made public, e.g., profile information in business-related social media networks

c) We process your data exclusively for the purpose of assessing your application and conducting the application process. If you do not provide the required personal data, unfortunately, we cannot consider your application. You do not have to enter data that is marked as voluntary in order for the application to be considered. The processing is justified under “performance of contract” legal basis Art. 6 para. 1 sentence 1 lit. b GDPR as it is necessary in order to take steps at your request prior to entering into an employment contract.

d) If the application procedure ends without an employment relationship being established, the retention period for your data is: 10 years

Afterwards, it will be deleted, unless longer storage is required or justified by law. If you are also interested in other positions, we will store your data with your consent, until you request deletion of the data. You can opt-in to receive future job notifications from us and you may refuse to stop receiving future job notifications from us at any time.

Additionally, if you are a user from the United States, Arrow may use your Personal data for direct marketing purposes.

No processing of personal data of children

We do not knowingly collect or solicit personal data from persons under the age of 13. The Services are not directed at children under the age of 13. In the event that we learn that we have collected personal data of a child under the age of 13 without parental consent, we will delete that information as quickly as possible. If you believe that we may have personal data from or about a child under 13, please contact us using the contact details outlined in this policy.

No processing of sensitive personal data

We do not knowingly collect or process sensitive personal data.

Cookies

Use of Cookies and other Web Technologies

Cookies and similar tracking technologies are placed on your computer or mobile device to collect, store, and use information about you when you visit our website.

This website uses cookies or similar technologies (“cookies”). There are different kinds of cookies:

Strictly necessary cookies are cookies that are necessary to provide the services and features available through the websites, e.g. shopping. Without the cookie the service cannot be provided.

Non-necessary cookies

Some of the cookies described above are so-called first party cookies where we are responsible for dropping the cookies and processing the personal data. Other cookies we use may be provided by third party (third party cookies). These third parties drop the cookies and process the collected personal data for their own purposes, e.g. to provide you advertisement.

Please refer to Arrow’s Cookie Policy here.

How Arrow Collects Information

a)  Information You Give Us

Arrow may (with your consent, where required by applicable law) collect Personal data you provide directly to Arrow via the Services. For example, Personal data may be collected when you use or register for Arrow’s Services, subscribe to Arrow’s notifications, post on Arrow’s website, participate in promotional activities, apply for a job, communicate with Arrow through the Services, or use an app installed on a device. You may choose to voluntarily submit certain other information to us through the Services, including Personal data, but you are solely responsible for your own Personal data in instances where Arrow has not collected such information or requested that you submit such information to us. De-Identified data once “de-identified” are subject to this Privacy Notice, and Arrow and its Service Providers may treat it as non-Personal data and use it without obligation to you except as prohibited by applicable law.

b)  Information Arrow Collects Automatically from Your Use of Arrow’s Services

Arrow and Arrow’s Service Providers collect information about the Services that you use and how you use them. Arrow does this with your consent where required by applicable law. Certain information is collected automatically through your device, such as your: IP address; device identifier, Ad ID, browser type; operating system characteristics; information about your use of Arrow’s Services; and data regarding network connected hardware (e.g., computer or mobile device) (“Usage Information”). To the extent that Usage Information is Personal Information under applicable law or is combined with Personal data, Arrow will treat that information as Personal data under this Privacy Notice.

The methods that Arrow and Arrow’s Service Providers may use to collect Usage Information include:

  •  Log Information: Arrow collects information about your use of Arrow’s Services, such as IP address, browser type, Internet service provider, referring/exit pages, operating system, cookies that may uniquely identify your browser or your account, and related data, and store it in log files.
  •  Information Collected by Cookies and Other Tracking Technologies: Arrow and Arrow’s Service Providers may use cookies or other tracking technologies (“Tracking Technologies”) to collect and store information about interactions with Arrow’s Services, including information about your browsing and purchasing behavior. Further information about how Arrow uses cookies is set out in Arrow’s Cookie Policy.

Arrow is giving you notice of the Tracking Technologies and your choices regarding them explained herein so that your consent and/or acknowledgment to encountering them is meaningfully informed.

c)  Personal Information Collected from Other Sources

Arrow may (with your consent, where required by applicable law) receive your Personal data from other sources, such as public databases, joint marketing partners, and social media platforms, and combine that with information Arrow collects about you. To the extent Arrow combines such third-party sourced information with Personal data Arrow collects directly from you, Arrow will treat the combined information as Personal data. Subject to applicable law, Arrow is not responsible for the accuracy of the information obtained from third parties or third-party practices.

Third-Party Services and Social Features

Arrow’s Services may include hyperlinks to Arrow websites, locations, platforms, or services operated by third parties (“Third-Party Service(s)“). These Third-Party Services may use their own cookies, Arrow web beacons, and other Tracking Technology to independently collect information about you and may solicit Personal Information from you. Certain functionalities on the Services permit interactions that you initiate between the Services and certain Third-Party Services, such as third-party social networks (“Social Features”). Examples of Social Features include “liking” or “sharing” Arrow’s content and otherwise connecting Arrow’s Services to a Third-Party Service. If you use Social Features, and potentially other Third-Party Services, information you post or provide access to may be publicly displayed on Arrow’s Services or by the Third-Party Service that you use. Similarly, if you post information on a Third-Party Service that references Arrow’s Services (for example, by using a hashtag associated with Arrow in a tweet or status update), your post may be used on or in connection with Arrow’s Services. Also, both Arrow and the third-party may have access to certain information about you and your use of Arrow’s Services and the Third-Party Service. To the extent Arrow combines information from Third-Party Services with Personal Information Arrow collects directly from you on the Services, Arrow will treat the combined information as Personal Information under this Privacy Policy.

Third-Party Responsibility

The information collected and stored by third parties remains subject to their privacy practices, including whether they continue to share information with Arrow, the types of information shared, and your choices on what is visible to others on Third-Party Services. Arrow is not responsible for the collection, usage, and disclosure policies and practices (including the data security practices) of any other organization, including any Personal Information you disclose to other organizations through or in connection with Arrow’s Social Media Pages. Arrow makes no representations regarding the policies or business practices of any third parties or Third-Party Services and encourages you to familiarize yourself with and consult their privacy policies and terms of use.

Information You Disclose Publicly or to Others

The Services may permit you to post or submit written content, user profiles, audio or visual recordings, computer graphics, pictures, data, or other content, including Personal Information (collectively, “User Content”). If you choose to submit User Content to any public area of Arrow’s Services, your User Content will be considered “public” and will be accessible by anyone, including Arrow, will not subject to this Privacy Policy and may be used to the fullest extent permitted by applicable law. Arrow encourages you to exercise caution when making decisions about what you disclose in such public areas. Individuals aged 13 years old or younger and located in California should see their rights regarding potential removal of certain posted content.

Arrow Sweepsakes, Contests, and Promotions

Where allowable under applicable law, Arrow may offer sweepstakes, contests and other promotions (each, a “Promotion”) jointly sponsored or offered by third parties that may require submitting Personal Information. If you voluntarily choose to enter a Promotion, your Personal Information may be disclosed to third parties for administrative purposes and as required by law (e.g., on a winners list). By entering a Promotion, you are agreeing to the official rules that govern the particular Promotion, and may, except where prohibited by applicable law, allow the sponsor and/or other parties to use your name, voice and/or likeness in advertising or marketing materials.

Data Sharing

Sharing your personal information with service providers

Personal data may be disclosed to service providers who act on our behalf in order to process the personal data in accordance with the purposes outlined above. This includes the following categories of service providers:

  • T Service Providers
  • Cloud Service providers
  • Email marketing providers

Data access by service providers is privileged in accordance with Art. 28 GDPR. We have concluded corresponding data processing agreements with the respective service providers. The agreement obliges the service providers to process your personal data only on our behalf and upon our instruction. They are prohibited to pass on your personal data to other parties without permission, unless this is required by law.

Data Recipients: Arrow Affiliates, website hosting and analytics service providers, Marketing agents, Sales agents, Customer Service agents

Categories of Personal Data: Contact information, activity

Third party recipients of your personal information

We share your data with the below third party recipients, for the purposes listed, along with their legal basis.

Recipient

We may share information with third party recipients such as: Arrow’s affiliates, agents, vendors, consultants, marketing service providers, and other service providers (collectively “Service Providers”)

Purpose for sharing the data:(a) to comply with legal process; (b) to respond to requests from public and government authorities, including public and government authorities outside your country of residence to meet national security or law enforcement requirements; (c) to enforce Arrow’s terms and conditions; (d) to protect Arrow’s operations and protect Arrow’s rights, privacy, safety or property, and/or that of you or others; and (e) to allow Arrow to pursue available remedies or limit the damages that Arrow may sustain

Legal Basis:Processing is necessary to provide the Services and/or to comply with laws and regulations

Details of categories of PD shared with the data recipients: Contact information, activity

International Data Transfer

Some of the data recipients listed above are located in a country outside the European Union and/or access your personal data from a country outside the European Union. We implemented adequate safeguards to secure the cross-border transfer. Where the country of the recipient is not subject to an adequacy decision by the EU Commission we concluded Standard Contractual Clauses. Other than that, we will only transfer your data to a recipient in a third country if you provided your prior consent. For more information about the safeguards, you can always contact us using the contact details above.

Some of the data recipients listed above are located in a country outside of the Federated Republic of Brazil and/or access your personal data from a country outside the Federated Republic of Brazil. We implemented adequate safeguards to secure the cross-border transfer of your personal data. Where the country of the recipient is not subject to an adequacy decision by the ANPD we concluded Standard Contractual Clauses. Other than that, we will only transfer your data to a recipient in a third country if you provided prior consent. For more information about safeguards, you can always contact us using the contact details above.

Arrow may also (with your consent, where required by applicable law) share information about you as follows:

A. With Arrow’s affiliates for internal business purposes. For example, processing your orders, fulfilling your requests, providing customer service, and improving Arrow’s products and services;

B. To a third party in connection with or during negotiations of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of Arrow’s business, assets or stock (including in connection with any bankruptcy or similar proceedings).

Aggregated Information

Without limiting the forgoing, in Arrow’s sole discretion, Arrow may share aggregated information which does not identify you or de-identified information about you with third parties or affiliates for any purpose.

Sharing for Marketing Purposes

If you are a user from the U.S., Arrow may share your Personal Information with third parties for direct marketing purposes. All users have the right to opt-out from direct marketing and can require Arrow to cease to use the data at any time for direct marketing purpose at no cost to you.

Data Retention

How long we retain your personal information

Unless otherwise stated in this privacy policy, we retain your personal data only as long as necessary for the respective purpose. Subsequently, we will delete your data, unless we are legally entitled or obliged to further storage.

Please refer to the section on Data Processing Activities to find out the exact retention period for different categories of your personal data and/or different processing purposes.

Your Rights

Depending on the circumstances, you may be entitled to exercise some or all of the following rights:

1. Obtain confirmation as to whether or not your personal data is being processed and access to copy of your personal data undergoing processing;

2. Require (i) access to and/or duplicates of your personal data retained, (ii) receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and (iii) to transmit those personal data to another controller without hindrance from our side; where technically feasible you shall have the right to have the personal data transmitted directly from us to another controller;

3. Request rectification, removal or restriction of your personal data;

4. Where the data processing is based on your consent, refuse to provide and – without impact to data processing activities that have taken place before such withdrawal – withdraw your consent to processing of your personal data at any time;

5. Take legal actions in relation to any potential breach of your rights regarding the processing of your personal data, as well as to lodge complaints before the competent data protection regulators;

6. Not to be subject to any automated decision making, including profiling (automatic decisions based on data processing by automatic means, for the purpose of assessing several personal aspects) which produce legal effects on you or affects you with similar significance;

Further, you may be entitled to object, out of grounds relating to your particular situation, at any time to processing of personal data concerning you, including object to direct marketing and automated individual decision-making including profiling. In this case, please provide us with information about your particular situation. After the assessment of the facts presented by you we will either stop processing your personal data or present you our compelling legitimate grounds for an ongoing processing.

In order to allow for efficient processing of any rights requests referred to above or any questions or any complaints regarding our data processing, please use the Data Subjects’ Rights portal.

Make a Data Subjects’ Rights Request

You also have a right to lodge a complaint with the supervisory authority. The contact details of your supervisory authority are:
https://complaints.coag.gov

Choices: Tracking and Communications Options

A.  Tracking Technologies Generally
Regular cookies may generally be disabled or removed by tools available on most commercial browsers, and in some instances blocked in the future by selecting certain settings. Browsers offer different functionalities and options so you may need to set them separately. Please be aware that if you disable or remove cookies, some aspects of Arrow’s Services may not work and that when you revisit Arrow’s Services your ability to limit browser-based Tracking Technologies is subject to your browser settings and limitations. With respect to Arrow’s mobile applications, you can stop all collection of information by uninstalling the app. Also, you may be able to exercise specific privacy choices, such as enabling or disabling location identifying services, by adjusting the permissions in your mobile device.

Do Not Track
Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note there is no consensus among industry participants as to what “Do Not Track” means in this context. Like many online services, Arrow currently does not alter Arrow’s practices when Arrow receives a “Do Not Track” signal from a visitor’s browser. To find out more about “Do Not Track,” visit http://www.allaboutdnt.com.

B.  Analytics and Interest-Based Advertising
Certain companies may participate in the Digital Advertising Alliance (“DAA”) AdChoices Program and may display an Advertising Option Icon for interest-based ads that links to an opt-out tool which allows you to exercise certain choices regarding targeted advertising. You can learn more about the DAA AdChoices Program at http://www.youradchoices.com/ and its opt-out program for mobile applications at https://youradchoices.com/appchoices. In addition, certain advertising networks and exchanges may participate in the Network Advertising Initiative (“NAI”). NAI has developed a tool that allows consumers to opt-out of certain targeted advertising delivered by NAI members’ ad networks. To learn more about opting out of targeted advertising or to use the NAI tool, visit https://optout.networkadvertising.org/. Please beware, even if you are able to opt-out of certain kinds of targeted advertising, you will continue to receive non-targeted ads. Arrow is not responsible for effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. However, Arrow supports the ad industry’s 2009 Self-regulatory Principles for Online Behavioral Advertising (http://www.iab.net/media/file/ven-principles-07-01-09.pdf). and expects that ad networks Arrow directly engages to serve you interest-based ads will do so as well, though Arrow cannot guarantee their compliance.

C.  Communications
You may opt-out of receiving promotional communications (e-mails or text messages) from Arrow at any time by: (i) for promotional e-mails, following the instructions as provided in e-mails to click on the unsubscribe link or changing your communication preferences by logging into your account; and (ii) for text messages, following the instructions as provided in text messages to text the word, “STOP.” Please note that your opt-out is limited to the e-mail address or phone number used and will not affect subsequent subscriptions. If you opt-out of only certain communications, other subscriptions may continue. Even if you opt-out of receiving promotional communications, Arrow may, subject to applicable law and with your consent (where required by applicable law) continue to send you non-promotional communications, such as those about your account, transactions, servicing, or Arrow’s ongoing business relations.

D.  Mobile Applications
Arrow’s mobile applications may send you notifications that include alerts, sounds, and icon badges. These push notifications or in-app messages may include both operational messages and promotional messages regarding products, services, and offers that may be of interest to you. These can be configured in Settings. As with e-mails, even if you opt-out of receiving promotional communications, Arrow may with your consent (where required by applicable law) continue to send you non-promotional push notifications, such as those regarding your use of the applications or Arrow’s ongoing business relations.

Personal Information Protection and Electronic Documents Act (PIPEDA) Rights

PIPEDA Specific Notice

Arrow Electronics, Inc. complies with all of the Principles Set Out in the National Standard of Canada Entitled Model Code for the Protection of Personal Information as required by Personal Information Protection and Electronic Documents Act (PIPEDA).

PIPEDA Representative

Arrow Electronics, Inc. has appointed a PIPEDA representative to oversee the implementation of compliance of PIPEDA at our organization:

compliance@arrow.com

The appointed representative can be contacted for any question, query or complaint related to PIPEDA implementation or compliance by our organization.

PIPEDA Access Rights

Arrow Electronics, Inc. provides complete access rights over their personal information in accordance with PIPEDA. For more information on how to exercise your rights refer to Your Rights

Disclosures to related organizations such as subsidiaries

Arrow Electronics, Inc. shares your personal information with certain related organisations (i.e subsidiaries etc.). 

For more details on the transfer of your personal information you may also refer to Data Sharing.

The subsidiaries we share your personal information with is:

Subsidiary: Arrow Electronics, Inc. and its affiliates and subsidiaries

Types of PI shared

Contact Information, Activity

California Consumer Protection Act (CCPA) Rights

CCPA Specific Notice

In the last twelve months, our company may have collected, used, “sold” (as that term may be interpreted under CCPA), and shared, for business purposes, personal information about you as described in this Privacy Notice. Each category of data may be used by our company or shared with third parties also as described in this Privacy Notice.

CCPA Specific Description of Rights

Our company provides users complete rights over their data in accordance with the California Consumer Privacy Act:

  • Users can request to know PI collected, sold, shared, or disclosed about them by the company in the last 12 months.
  • Users can request to have PI collected about them by the company to be deleted.
  • Users can request the company not to sell PI collected about them.
  • Users can not be discriminated against by the company if they choose to exercise their data rights.

For all CCPA requests, please note the process for verifying your request and the information required to verify your request will be as follows: email verification

For all CCPA requests, we will be verifying your requests following company policy. Refer to Your Rights section to learn more on how to exercise your rights.

CCPA Specific Notice on Minor’s Data

Our company also does not sell the personal information of minors (children below 16 years of age) without the express consent of the lawful guardians (for children below 13 years of age) or the minors (for children between 13 to 15 years of age). At any time lawful guardians of minors or minors who have opted-in for the sale of personal information can opt-out by contacting our DPO.

Privacy Notice for Non-U.S. Jurisdictions

Obligation to Provide Personal Information

EU and Mainland China persons must, on occasion provide Personal Information to Arrow as necessary to enter into a contract or as required to fulfill contractual obligations, including providing Arrow’s products and services, taking payment for products and services Arrow provides, and billing, shipping, and delivery of Arrow’s products and services. You are free to withhold your Personal Information but without this data it will not be possible to execute the contract or provide you with Arrow’s products and services. When you make a purchase on or of the Services, you must provide Personal Information to us so that Arrow can meet Arrow’s legal obligations in accordance with applicable tax and statutory provisions. You are free to withhold your Personal Information, but without this data, it will not be possible to provide you with Arrow’s products and services.

Automated Decision-Making

With your consent (where required under applicable law) Arrow sometimes uses EU and/or Mainland China persons’ Personal Information submitted through the Services for automated decision-making. For example, Arrow may display advertisements and send emails to you containing content automatically chosen based on the products or services Arrow has provided to you in the past. However, Arrow will not use such persons’ Personal Information submitted through the Services for automated decision-making, including profiling, that produces legal effects or similarly significantly affects such persons or where not otherwise permitted by applicable law.

Legal Bases for Processing

Arrow processes your Personal Information with your consent where required by law. In addition, Arrow processes your Personal Information as necessary for the performance of the sales contract, for example, when processing your orders and payments and to take steps, at your request, before entering into a contract with you, for example, by providing you with quotes for products and services. Arrow also processes Personal Information as necessary for Arrow’s legitimate interests as follows:

  • Research and Development: To research use of Arrow’s products and services and to improve, and develop new, products and services;
  • Marketing and advertising: To the extent permitted by applicable law, Arrow uses your Personal Information regarding products and services you have ordered, or in which you have otherwise demonstrated an interest, as necessary to analyze your interests and to provide you information about the products and services that Arrow thinks might interest you; and
  • Security: Arrow uses Personal Information for purposes of facility, network, and information security, fraud prevention, and reporting suspected criminal acts. For example, in the event of fraud, a security incident, or a suspected criminal act, Arrow would examine Personal Information that appeared to be linked to the incident as necessary to determine what happened, remediate, report to the authorities, and prevent a recurrence.

In some jurisdictions, under applicable law, consent may be the primary basis for processing Personal Information and, where such laws apply and where required to do so, Arrow will obtain your consent to process your Personal Information. Where Arrow relies on your consent as the lawful basis, you have the right to withdraw your consent to processing of your Personal Information at any time.

Accuracy and Access to Personal Information

EU and Mainland China persons may request access to their Personal Information under this Privacy Policy to the full extent required by applicable law in the home country of the person making the request. Such persons may request the correction, amendment, or deletion their Personal Information that is inaccurate or has been processed in violation of applicable law. Arrow will reasonably fulfill such requests to the extent required by applicable law.

Users from outside the U.S., including Mainland China, have the right to ask Arrow not to process their Personal Information for marketing purposes. Arrow will inform you (before collecting your information) if Arrow intends to use your information for such purposes or if Arrow intends to disclose your information to any third-party for such purposes. You can exercise your right to agree to or to prevent (as the case may be) such processing by checking certain boxes on the forms Arrow uses to collect your information.

Right to Object to Processing for Direct Marketing or Legitimate Interests:

EU persons have the right to object to the processing of their Personal Information for purposes of Arrow’s direct marketing or legitimate interests.

Revocation of Consent

Users from outside the U.S. also have the right to limit or revoke their given consent regarding the processing of their Personal Information. However, it is important to note that in some cases such request may not be immediately or fully executed because it is possible that Arrow has a legal obligation to keep using or retain your Personal Information. Also, you must consider that for certain purposes, the revocation of consent means that Arrow cannot continue providing the services you requested.

Accountability and Inquiries

In compliance with the EU-US DPF and the UK Extension to the EU-US DPF, Arrow commits to resolve DPF Principles-related complaints about Arrow’s collection and use of your personal information. EU and UK individuals with inquiries or complaints regarding Arrow’s handling of personal data received in reliance on the EU-US DPF and the UK Extension to the EU-US DPF, should contact Arrow .

In order to allow for efficient processing of any rights requests referred to above or any questions or any complaints regarding our data processing, please use the Data Subjects’ Rights portal.

Make a Data Subjects’ Rights Request

If, after contacting Arrow, any EU or UK person believes that their complaint has not been satisfactorily resolved, they agree first to try and settle the dispute by mediation, administered by the International Centre for Dispute Resolution under its Mediation Rules, before resorting to arbitration, litigation, or some other dispute resolution procedure. The rules governing these procedures and information regarding how to file a claim free of charge can be found here.

Any EU or UK person who remains dissatisfied may contact his or her national Data Protection Authority in the country where the person resides. Arrow has agreed to cooperate and comply with appropriate EU Data Protection Authorities, the UK Information Commissioner’s Office and the Gibraltar Regulatory Authority, and the U.S. Department of Commerce in resolving such disputes. If an EU or UK person remains dissatisfied and meets the pre-arbitration requirements of Annex I Part C of the EU – U.S. DPF and the UK Extension to the EU-US DPF, the person may invoke binding arbitration pursuant to procedures in Annex I of the EU – U.S. DPF Principles found here.

Data Subjects Located in Brazil

In addition to the provisions of this Privacy Policy, this Section applies to data subjects located in Brazil. According to the Brazilian General Data Protection Law (“LGPD”) the data subjects located in Brazil have the following rights:

Right to Confirm the Existence of Processing: At any time, you have the right to confirm whether Arrow is processing any Personal Information related to you.

Right of Access: You have the right to request that Arrow discloses or provides you with access to the information regarding the processing of your Personal Information.

Right to Correction: You have the right to correct any incorrect, incomplete, or out-of-date information that Arrow has relating to your Personal Information.

Right to Anonymization: You the right to have your data processed in a way that prevents the possibility of direct or indirect association with you. This is possible only in situations where the Personal Information in question is considered unnecessary, excessive, or processed in noncompliance with the LGPD´s provisions.

Right to Block: You have the right to request that Arrow no longer processes your Personal Information. This is possible only in situations where the Personal Information in question is considered unnecessary, excessive, or processed in noncompliance with the LGPD´s provisions.

Right to Deletion: You have the right to request that Arrow deletes the Personal Information Arrow collects from you. This is possible only in situations where the Personal Information in question was collected with the data subject´s consent or if such information is considered unnecessary, excessive, or processed in noncompliance with the LGPD´s provisions. Please note, however, that in certain situations Arrow is not required to delete your Personal Information, such as when: (i) to comply with a legal obligation; (ii) to perform a contract with you; (iii) to preserve Arrow’s rights.

Right to Portability: You have the right to receive your own Personal Information in a structured, commonly used, and machine-readable format that you can transmit to another controller.

Right to Information: You have the right to be informed about which, if any, public and private entities Arrow has shared your Personal Information with, and to be informed about the possibility of denying consent and the consequences of such denial.

Right to revoke your Consent: You have the right to request, through a free and facilitated procedure, that from the moment you revoke your consent to allow processing of your Personal Information.

EU-US Data Privacy Framework

Arrow complies with the EU-US Data Privacy Framework (“EU-US DPF”) and the UK Extension to the EU-US DPF, as set forth by the U.S. Department of Commerce. Arrow has certified to the U.S. Department of Commerce that it adheres to the EU-US DPF Principles with regard to the processing of personal data received from the European Union in reliance on the EU-US DPF. If there is any conflict between the terms in this Privacy Policy and the EU-US DPF Principles, the Principles shall govern. The United States Federal Trade Commission has jurisdiction over Arrow’s compliance with the EU-US DPF.

To learn more about the EU-US DPF and to view Arrow’s certification, please visit https://www.dataprivacyframework.gov/.

Arrow is based in the U.S. and the information Arrow collects from the U.S. is governed by U.S. law. If you are accessing the Services from outside of the U.S., please beware that information collected through the Services may be transferred to, processed, stored and used in the U.S. Your Personal Information may also be transferred to, processed, stored and used in other jurisdictions wherein Arrow has subsidiaries (for a list of subsidiaries, please visit Subsidiaries of Arrow Electronics, Inc.), affiliates, and Service Providers. Data protection laws in these jurisdictions may be different from those of your country of residence. When Arrow shares your Personal Information with third parties in other jurisdictions, Arrow will put in place appropriate measures to require them (where required by applicable law) to protect your Personal Information in a manner comparable to the level of security and privacy protection under and in accordance with the relevant data privacy laws (including where applicable the standard contractual clauses approved for use by the European Union and Mainland China).

Updates to this notice

We may update this Privacy Statement from time to time. If we modify our Privacy Statement, we will post the revised version here, with an updated revision date. You agree to visit these pages periodically to be aware of and review any such revisions. If we make material changes to our Privacy Statement, we may also notify you by other means prior to the changes taking effect, such as by posting a notice on our websites or sending you a notification. By continuing to use our website after such revisions are in effect, you accept and agree to the revisions and to abide by them.

This privacy notice was last updated on Jan 15, 2025