Arival LLC
Privacy Notice

We collect Personal Information about you when you interact with us, including when you visit and use the Sites. We also collect Personal Information about you that you voluntarily provide to us or otherwise publicly available sources. Arival may automatically collect information about the devices you use to interact with the Sites. 

Data Protection Law distinguishes between “controllers” and “processors” of Personal Information. While other jurisdictions and laws use similar terminology, such as “exporter” and “importer,” the concept remains the same. Arival may be a controller (meaning, the entity deciding the purpose and means of Personal Information processing) or a processor (meaning, the entity that processes Personal Information on behalf of a controller), depending on the nature of the relationship with a company, institution or agency, and/or individuals. Arival may engage with another controller (either independently or jointly determining the purpose and means of Personal Information processing).

Depending on the Sites you visit or interact, or the services Arival provides to you, we may collect information from you or about you including, but not limited to, the information listed below. We may provide this information to our service providers, business partners, or third parties as required by law or as part of our service delivery offering to you.

• Identifiers, such as
  • your name, alias, avatar, photo,
  • contact details (business, professional or personal) email address, (business, professional or personal) phone number or mobile number, (business, professional or personal) postal address,
  • your IP address or other unique online identifiers,
  • username, password, account details and history, membership program details,
  • purchase details and history, account payment-related financial details, such as credit card or bank account information. Such information may be entered directly in a partner’s or payment-processing provider’s site.
  • information relating to sponsorship (e.g., where event speakers are also sponsors, or where a sponsor is presenting in an event demonstration session),
  • information relating to compliments or complaints (feedback), or
  • and any other information you voluntarily provide, such as dietary restrictions when providing information for an event.
• Internet or other Electronic Network Activity Information when you access our Sites, we may automatically collect information about your devices, including, but not limited to,
  • IP address, device type, device make and model, browser type, browsing history, search history, web page that referred you to our site,

• • geolocation data, but not your precise geolocation. We collect geographic location information provided by a device interacting with the Sites or associated with your IP address or other online or device identifier, or

• • information regarding your interaction with our Sites, such as navigation journeys.

We may collect this information through the lawful use and deployment of cookies and other online tracking technologies as set forth in the Cookie Notice on the Site you visit.

• User Profiles.  Arival may aggregate the information that we collect about you or that you disclose in order to provide you with information on the Sites, deliver and enhance the services we provide to you, and secure our Sites against unlawful activity. We do not share or sell the user profiles that we create with third parties. We may provide this information to our service providers, business partners, or third parties as required by law or as part of our service delivery offering to you.
• Biometric Information.   Arival does not collect or process Biometric Information for the purpose of unique identification of an individual, except where biometrics may be used for security purposes, such as optional fingerprint or facial recognition processing for account authentication, authorization, or identification, or where such processing is mandatory for activities that require enhanced security measures.
• Audio, electronic, visual, thermal, olfactory, or similar information.  Arival may collect voiceprints and other audio files of your voice, visual recordings such as in a webinar recording, CCTV when you are on our premises (commercial or home offices) or a picture on an ID entry card. 
• Information Subject to Protected Classifications under Data Protection Law (also known as Sensitive Information or Special Category Data)
  • Arival does not process Sensitive Personal Information, except where required by applicable law, or that you disclose to us, for employment or legal purposes.

When you choose to provide information to Arival, such as in a contact form, we may ask you to provide us with Personal Information to fulfill your request. You may choose not to provide Personal Information to us by refraining from, among other things, using portions of the Sites that require Personal Information. You also may refrain from submitting other Personal Information directly to us that we do not request of you. However, if you do not provide Personal Information when requested, we may not be able to provide you with the full range of our products and services, or with information about our products and services, promotions, and other opportunities. Where you receive our services through a partner, we recommend that you contact that partner directly about the processing of your Personal Information.

For our colleagues, contingent workers and job applicants, we may collect information from or about you, as required by law or as you disclose to us, listed in the below categories including, but not limited to, the following:

• • personnel ID, candidate reference ID, date of hire, employment status, performance records, leave information, and date of termination,
  • employment history including previous employers and job titles and/or positions, background information (such as your academical and professional qualifications, education, details included in your CV/resume, which might include details of memberships or interests constituting sensitive personal information, employment references,
  • driver’s license number, passport number, national identification number or other similar identifiers,
  • financial information (such as bank account number or salary), insurance details, or other benefits-related identifiers, pay history, tax withholding information,
  • details about your immigration or visa status, criminal offence information, or other background-check identifiers required or allowed by law,
  • Arival may collect and process Sensitive Personal Information only where required by applicable law, or that you disclose to us, for employment or legal purposes, such as life, health, financial details, physical characteristics and description, race, gender, marital status, sexual orientation, professional liability and workers compensation insurance programs, employee benefit program participation and coverage information, membership of a trade organization or union, or veteran/military status. We do not use or disclose your sensitive personal information for any purpose other than as permitted by applicable law.

We may provide this information to our service providers, business partners, or third parties as required by law or as part of our service delivery offering to you.

Where we collect and process Sensitive Information (as described above), and where applicable, we rely on one of the exceptions listed in Article 9 (2) of the European Union’s (EU) and United Kingdom’s (UK) General Data Protection Regulation (“GDPR”), to permit that sensitive information processing, including the affected person’s explicit consent.

Otherwise, we process your Personal Information as necessary for the performance of a contract, in compliance with our legal obligations or any other identified legitimate interest.  

We use your information to manage all parts of the applicant administration process including evaluating resumes, interviewing, selecting and hiring (or contracting) personnel, and conducting background check investigations. 

In certain circumstances, and to comply with applicable laws and regulations, we may need to collect, or request, Sensitive Personal Information for legitimate recruitment-related purposes: for example, information about your race or ethnic origin, gender and disabilities for the purposes of equal opportunities monitoring, to comply with anti-discrimination laws and for government reporting obligations; or information about your physical or mental condition to consider accommodations for the recruitment process and/or subsequent job role. For the most part, the provision of this information will be entirely voluntary, however, where the processing of this information is required, we will make this clear at the relevant time you may provide, on a voluntary basis, other Sensitive Personal Information during the recruitment process.

If you are accepted for a role or position at Arival, the information collected during the recruitment process will form part of your ongoing employee record and will be processed according to our Privacy Policy and other applicable policies.

We will not use your information for automated individual decision-making as contemplated under Article 22 of the GDPR and as described in other Data Protection law.

We may use the Personal Information we collect, within our processing or that of our authorized sub-processors, for the following business purposes:

• To provide information or services requested by you or on behalf of your employer, under contract as our client or partner;
• To send you communications according to services provided;
• To provide you with information about our products and services according to your marketing and contact preferences (which may include emails, calls and messages);
• To respond to customer-service inquiries;
• To implement third-party services for us or on behalf of your employer;
• To conduct processing necessary to fulfill other contractual obligations that affect you;
• To manage our everyday business needs and operations, such as internal service and operations, administering and improving the Sites and our services;
• Undertake troubleshooting and detect malfunctions within the Sites and services we provide as well as improving user-experience;
• To enable you to search our job postings, submit your resume, and contact or be contacted about your submission.
• To prevent unlawful conduct, enforce our Terms of Use, comply with applicable laws and Arival’s reporting obligations (including sharing information, where applicable, with statutory authorities, government institutions, law enforcement agencies and other official bodies), securing our Sites and your account and enforcing our agreements;

If you are an Arival employee (full- or part-time) or a contingent or contract worker (full- or part-time equivalent), we may use your information to support personnel administration and management including maintaining and processing records necessary to manage the employment or worker relationship. 

Your information will be processed by us according to Arival’s policies, or as required by contract with you or your employer. We will process Personal Information only when we have a legal (lawful) basis to do so. The legal basis we rely on will be one of the following:

• The processing is necessary for Arival to perform activities under contract with you or your employer, or fulfill a direct request that you have made that applies to the contract;
• The processing is necessary for purposes that are in Arival’s legitimate interests, such as protecting the security of the Sites, conducting research to improve our products and services, improving the functioning of the Sites, providing you promotional materials about products in which you have expressed an interest.
• You have consented to the processing of your Personal Information, for example, when you applied to a job posting or agreed to receive marketing material; or
• The processing is necessary for Arival to comply with a legal obligation.

In order to process Sensitive Personal Information as defined in Data Protection Law, we rely on contractual or explicit consent legal bases that we or your employer obtain from you in order to provide you with services or fulfill a specified request.

If we intend to use Personal Information for a purpose other than the purpose for which we collected the data, we will provide you with information about this secondary purpose, the legal basis for processing and, where required, obtain your explicit consent, before we engage in further processing.

Your information may be disclosed for a variety of business purposes:

• With your consent or at your direction: We may disclose your Personal Information if you tell us or ask us to do so.
• With your employer: As part of the services we provide, we may disclose your Personal Information to your employer if that organization is a client of Arival. Certain enquiries or requests may be responded directly by your employer instead of Arival.
• With our service providers: We may disclose your personal information to our service providers and contractors who perform services on our behalf but only if (a) your Personal Information is necessary for them to carry out such services and (b) those service providers and contractors are required to use any Personal Information they receive according to Arival’s instructions and pursuant to a data processing agreement that complies with the requirements of Data Protection Law.
• With our business partners: We may provide your information to our business partners with whom we work to provide you with products and services or to perform one or more of the business purposes identified above. For example, this may include your employer, a third business partner of your employer, or our business partner under contract. We may also provide your information to other business partners as directed by you. 
• To enforce our Terms of Service and other agreements between you and Arival, including for billing or collection purposes.

• In the event of corporate change or internal audits: We may disclose a business relationship but never the Personal Information or customer data uploaded to the service, in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company. If necessary and legally required, we will obtain your separate explicit consent in this regard. Disclosure may also be required for Arival audits.

• To comply with legal requirements: We will disclose your information (i) if we are required to do so by law or legal process, (ii) in response to lawful law enforcement authority or other official government requests, (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, (iv) in connection with an investigation of suspected or actual illegal activity including any legal proceedings or prospective legal proceedings in order to establish, exercise or defend our or a third party’s legal rights or (v) as required for Arival audits or to investigate a complaint or security threat, privacy violation or any other breach of Arival internal policies. 
• To companies within our corporate family: We may disclose your personal information to our corporate affiliates organizational purposes based on a legitimate interest. To the extent that our corporate affiliates have access to your personal information, they will follow practices that are at least as restrictive as the practices described in this Privacy Notice, will use your information solely for the purpose for which it was provided, and will not further disclose your information.

We do not sell any personal information to third parties and have not done so for the past 12 months.

Personal Information is processed by us in the following locations:

• USA, Canada, EU and UK

Personal Information may be processed by our authorized sub-processors as third-party service providers in the following countries:

• USA, Canada, EU and UK

We may process Personal Information in countries in which we do business and whose Data Protection Law may differ from the jurisdiction in which you live.

• When we transfer Personal Information of those who are located in the EU or EEA, or UK to a location outside of the European Economic Area, or UK, respectively, for processing, we use an approved transfer mechanism such as the EU approved Standard Contractual Clauses (SCC), and/or UK International Data Transfer Annex or the Addendum to the EU SCC (Annex), in our contracts or Data Protection Agreements.
• To learn more about the transfer mechanism that we use to effect a transfer, you may contact us at dpo@arival.travel.

Arival has implemented physical, technical, and administrative security safeguards, designed to protect personal information from loss, misuse, alteration, exfiltration, or destruction; considering the sensitivity of the information and the purpose for which it was collected. However, no method of data storage or transmission is completely secure. You are responsible for maintaining the security of your account ID, password and other forms of authentication involved in accessing password-protected or secured Sites.

Arival’s technical and organizational security measures include maintaining an Information Security Management System (ISMS), a Personal Information Management System (PIMS), and a compliance program.

Important measures include:

• privacy and security by design, including privacy engineering and secure systems development,
• personal data collection limitation, data minimization, and disclosure limitation,
• technical measures and processes to ensure personal data accuracy and quality
• data masking techniques, such as pseudonymization and encryption, 
• ensuring limited data retention,
• protection of data during transmission and storage 
• user identification, authentication and authorization,
• technical measures and processes to ensure the security of the processing,
• ensuring ongoing resilience of processing systems and services,
• ensuring the ability to restore in the event of a physical or technical incident,
• ensuring physical security of locations at which personal data are processed,
• ensuring secure configuration of electronic systems,
• information security and privacy governance and management,
• handling and responding to data subject rights’ requests, and
• measures we contract with our vendors (as sub-processors).

Our Sites may contain links to other sites that are outside of our control and are not covered by this Notice. If you access other sites using the links provided, the operators of those sites may collect information from you which will be used by them according to their own privacy policies and notices. We encourage you to read the privacy policies and notices for other websites you visit. Arival is not responsible for the content or privacy practices of linked sites or any use of those sites.

Unless provided otherwise in this Notice, we will retain your information for as long as your account is active or for as long as necessary for the relevant purposes of processing. We may also retain and use your information for longer periods in case it is necessary to comply with our legal obligations, resolve disputes, and/or enforce our agreements. To the extent possible, Arival will de-identify, or take reasonable steps to delete from its records, information no longer required for the purposes identified in this Notice, other than information which we are required by law to retain.

Depending on the nature of relationship with Arival, where you reside or are covered under applicable Data Protection Law, and, if applicable, the services Arival or a partner provides to you, we provide you the ability to exercise your rights regarding our collection and processing, including use, storage, and sharing of your information. Please note that for some of these rights, we will need to verify your identity before we are able to respond to your request, including using commercially reasonable efforts to confirm your identity including matching the information provided in your request with the information we have on file about you. Depending on the sensitivity of the information involved in your request, we may also apply more stringent verification methods to protect against unlawful conduct and ensure your request is fulfilled in a transparent and secure manner.

To exercise any of the rights described below, you can write to us at the address provided below (see Contact Us below), and we will respond as soon as possible according to Data Protection Law.

Right to Access and Data Portability: The right to access and data portability applies differently depending on where you reside. Arival provides this right regardless of where you reside.

• If you are a resident of the EU, European Economic Area (EEA) or UK or as stated in other Data Protection Law, you have the right to obtain confirmation as to whether your Personal Information is being processed, and if so, the right to access your Personal Information. If we maintain your Personal Information, you can also request that we provide you a copy of your data in a structured, commonly used, and machine­ readable format and request the transfer of certain of your Personal Information to another party under certain conditions.
• If you are a California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, or Nevada resident

Right to Correction or Rectification: Regardless of where you reside, you have a right to correct or amend the information we have about you.

Right to Non-Discrimination: We will not discriminate against individuals for exercising any of their data rights under Data Protection Law.   This means that if you exercise any of your rights in connection with your Personal Information, we will not deny you goods or services, charge different prices for them, or provide different levels of service for them.

Right to Deletion or Erasure: The right to delete or erase Personal Information also applies differently depending on where you reside or Data Protection Law.

• If you are a resident of the EU, EEA or UK, or as stated in other Data Protection Law, where the conditions are met provided by and subject to Data Protection Law, you may request that we erase your Personal Information.
• If you are a California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, or Nevada resident, you have a right to ask that we delete your information subject to appropriate exceptions. You may also designate an authorized agent to submit a request on your behalf by submitting proof of written authorization along with your request.

Right to Object to Processing: If you live in the EU, EEA, or UK, or as stated in other Data Protection Law, you may object to the processing of your personal information in certain circumstances when we (i) process your information for the purposes of our legitimate interests, (ii) use your personal information for direct marketing; or (iii) use your personal information for statistical purposes.

Right to Restrict Processing: If you are a resident of the EU, EEA, or UK or as stated in other Data Protection Law, you have the right to request restriction of your Personal Information under certain circumstances.

Right to Withdraw Consent: If you are a resident of the EU, EEA, or UK or as stated in other Data Protection Law, and when our legal basis for processing your information is your consent, you may withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

We do not sell the personal information of California residents, nor have we sold California resident personal information in the past 12 months. We have no actual knowledge of selling the personal information of minors under the age of 16.

We do not sell any personal information we collect to any third parties.  If we were to do so in the future, we will update this Privacy Notice (Statement), and provide residents with the opportunity to opt-out of the sale of their personal information.

You can access, correct, update, and request deletion of your Personal Information using your online account, emailing us, contacting our call center, or by directing your query to your employer that contracted with us. We (or your employer, where applicable) will respond to your request within 30 days or sooner subject to Data Protection Law. We may need to verify your identity before we fulfill your request.

In some circumstances, only your employer, and not Arival, may have the authority to update, correct, or delete your personal information. In these instances, please contact your employer directly. Otherwise, we will forward your request to your employer.

If you are a California resident, California Data protection Law provides you with certain rights as described in California Privacy Rights Act (CPRA), which amended the California Consumers Privacy Act (CCPA).

California permits you to opt out of the disclosure of your Personal Information by Arival to third parties for those third parties’ direct marketing purposes. We do not disclose your personal information to third parties for the third parties’ direct marketing purposes unless you affirmatively agree to it. You may opt-out of this disclosure by submitting your request to [EMAIL or DSAR TOOL]. We may need to verify your identity before we fulfill your request.

If you are a resident of Colorado, Iowa, New Hampshire, Tennessee, or Utah their respective Data Protection Law contains certain consumer rights, including the rights of resident consumers to opt out of the Sale of Personal Data and the Processing of Personal Data for Targeted Advertising.

Summary of State Data Protection Law

For Colorado: The Colorado Privacy Act.

For Iowa: Iowa Consumer Data Protection Act.

For New Hampshire: New Hampshire SB255.

For Tennessee: Tennessee Information Protection Act.

For Utah: Utah Consumer Privacy Act.

These States permits you to opt out of the disclosure of your Personal Information by Arival to third parties under a Sale of Personal Data or Targeted Advertising purposes. We do not disclose your personal information to third parties these purposes unless you affirmatively agree to it. You may opt-out of this disclosure by submitting your request to [EMAIL or DSAR TOOL], or, for Colorado, by one of Colorado’s specified Universal Opt-Out Mechanisms (UOOM). We may need to verify your identity before we fulfill your request.

If you are a resident of Connecticut, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, New Jersey, Nebraska, Oregon, Rhode Island, Texas, or Virginia, their respective Data Protection Law contains certain consumer rights, including the rights of resident consumers to opt out of the Sale of Personal Data, the Processing of Personal Data for Targeted Advertising, and profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.

Summary of State Data Protection Law

For Connecticut: Connecticut Personal Data Privacy and Online Monitoring Act.

For Delaware: Delaware Personal data Privacy Act.

For Indiana: Indiana Consumer Data Protection Act.

For Kentucky: Kentucky Consumer Data Protection Act.

For Maryland: Maryland Online Data Privacy Act.

For Minnesota: Minnesota Consumer Data Privacy Act.

For Montana: Montana Consumer Data Privacy Act.

For Nebraska: Nebraska Data Privacy Act.

For New Jersey: New Jersey S332.

For Oregon: Oregon Consumer Privacy Act.

For Rhode Island: Rhode Island Data Transparency and Privacy Protection Act.

For Texas: Texas Data Privacy and Security Act.

For Virginia: Virginia Consumer Data Protection Act.

These States permits you to opt out of the disclosure of your Personal Information by Arival to third parties under a Sale of Personal Data, Targeted Advertising or Profiling for Automated Decisions purposes. We do not disclose your personal information to third parties these purposes unless you affirmatively agree to it. You may opt-out of this disclosure by submitting your request to [EMAIL or DSAR TOOL]. We may need to verify your identity before we fulfill your request.

If you request electronic communications, such as an e-newsletter or marketing material, you will be able to unsubscribe at any time by following the instructions included at the bottom of the email or message communication.  However, you cannot opt-out of emails or messages we are required to send as part of our ongoing relationship with you.

When you visit the Sites, we may place pieces of code, commonly referred to as “cookies,” or similar technology on your device. To learn more about what cookies and related technology we use, please see our COOKIE NOTICE.

Do Not Track: Some browsers have “do not track” features that allow you to tell a website not to track you. These features are not all uniform and we may not be able to respond effectively to those signals.

The Sites are intended for a general audience and are not directed at children. We recognize the definition of a child as per age defined in Data Protection Law. If you are underage, please do not provide Personal Information to us through the Sites. If we obtain actual knowledge that any Personal Information that we collect has been provided by a Child per data Protection Law, we will promptly delete the Personal Information.

Please read this Notice from time to time as we may modify the Notice at any time in our sole discretion.  The most current version of this Notice will be published on our Sites.

If you have any questions or concerns about Arival’s use of your Personal Information or about this Notice, you can email us at dpo@arival.travel.

Our Data Protection Officer can be reached at dpo@arival.travel.

Our registered representative for EU/EEA or UK can be reached at Arival@regreps.com.

You may also write to us at:

Arival LLC
ATTN: Data Protection Officer
Privacy Office
315 W. South Boulder Road, Ste 400
Aspen Greens, Louisville, CO 80027 USA