This is the Privacy Policy of the OneArc Group of companies (“OneArc”). This Privacy Policy describes our policies and practices in respect of the collection, use, processing and disclosure of personal data.
The main reasons (see also Section of this Policy titled “IDENTIFIED PURPOSES“) why we collect, process, store, and share personal data about our employees, customers, suppliers and others (e.g. users of our webpage) who interact with OneArc are the following:
These are the main reasons why we collect and use data about our customers and others who interact with OneArc:
We think carefully about our use of personal data, and below you can find the details of what we do to protect your privacy. This policy covers, among other topics:
All employees, customers, prospective customers, subscribers, users of our products and services and all visitors to our website are expected to carefully read this Privacy Policy.
If you as a customer, prospective customer, subscriber, user of our products and services or visitor to our website do not agree with this Privacy Policy, you should refrain from providing any personal data to us. Continued use of OneArc’s website, or products and services after having been informed of this Privacy Policy or any such changes to our Privacy Policy constitutes acceptance of this Privacy Policy and changes to it.
If you are an employee, this Privacy Policy gives you all relevant information on how your personal data is being collected, processed, stored and shared and what your rights and obligations are with respect to the EU’s General Data Protection Regulation („GDPR“).
We reserve the right to change our Privacy Policy as we consider necessary from time to time and otherwise in compliance with applicable privacy laws.
The OneArc group of companies is committed to protecting the personal data you share with us. This Privacy Policy describes our policies and practices in respect of the collection, use, processing and disclosure of personal data.
Effective from 4 March 2022, the OneArc group of companies was acquired by a subsidiary of BAE Systems group of companies, namely: BAE Systems Technology Solutions & Services, Inc..
The data controller (meaning the legal person that determines the purposes and means of processing of personal data) of your personal data is either:
(i) BAE Systems OneArc Czechia k.s., ID: 284 76 506, with its registered seat at Karolinská 654/2, Karlín, 186 00 Prague 8, Czech Republic or
(ii) BAE Systems OneArc U.S. Inc., Registered Number: 610A00007666, with its registered seat at 2100 North Alafaya Trail, Suite 100, Orlando, FL 32826, USA.
The other affiliates of the OneArc group of companies are in the position of data processors of your personal data, if necessary. For the avoidance of doubt, references in this document to “OneArc” in any consent given per Art 6 and 7 of GDPR refers to one of the applicable data controllers as set out above.Apart from the data controllers identified within the OneArc group of companies, OneArc hereby informs the data subjects that his/her personal data might be shared within the BAE Systems group of companies under the IGA. Each of the BAE Systems affiliates that is a party to the IGA can be in the position of respective data controller or data processor, depending on the particular case.
OneArc’s objective is to implement and maintain appropriate technical, security and organizational measures to protect personal data against unauthorized or unlawful processing and use, and against accidental loss, destruction, damage, theft or disclosure. In particular, to achieve this goal OneArc aims to ensure that personal data is:
OneArc’s policy is to obtain prior consent from the data subject to the collection, use, processing or disclosure of personal data, except where otherwise required or permitted by law. Our goal is to request consent in an intelligible and easily accessible form, using clear and plain language. Consent may be express or implied, depending on the circumstances. When appropriate, the written consent of the individual (data subject) will be requested (e.g. by mail, email or other electronic means). If the consent is given in the context of a written declaration or form which also concerns other matters, the request for consent will be presented in a manner which is clearly distinguishable from the other matters. Sometimes, an individual’s consent may be obtained verbally or implied through his or her conduct or dealings with OneArc. OneArc generally does not require an individual to consent to collection, use, processing or disclosure of personal data as a condition of the provision of a product or service, beyond that which is necessary to provide the product or service or processing is necessary for the performance of a contract to which the individual (data subject) is party or in order to take steps at the request of the individual (data subject) prior to entering into a contract. However, some personal data may be requested that is optional for an individual to provide in order to improve the user experience or to help OneArc improve the products or services it offers and provides. OneArc may collect, use or disclose personal data without notice or consent only where permitted or required by law. Consent may be varied or withdrawn at any time subject to legal limitations and reasonable notice if required by law (without affecting the lawfulness of processing based on consent before its withdrawal). OneArc will advise the individual of any consequences of a variation or withdrawal.
1IGA = International Intra-Group Data Protection Agreement executed among BAE Systems plc and other BAE Systems affiliates, dated 25 May 2018, as amended. More info: go to Section “Transferring and sharing personal data”.
1IGA = International Intra-Group Data Protection Agreement executed among BAE Systems plc and other BAE Systems affiliates, dated 25 May 2018, as amended. More info: go to Section “Transferring and sharing personal data”.
In order to keep the data subject(s) updated and in touch with OneArc, data subject(s) might provide consent for Mailing List. Such a consent is considered as a specific one and the data subject (you) by registering for the Mailing List is providing its consent for OneArc to (i) communicate with you about OneArc and TerraSim product releases, development news, videos, special events, and programs; (ii) respond to your inquiries; (iii) enable sales and business developers to contact you directly about our products and services offerings; (iv) publicize events OneArc is sponsoring, exhibiting at or attending and invite you to product or technology demonstrations and (v) solicit feedback about product and technology features and services through surveys (“Mailing List”).
Our website (www.onearc.com) (“Website”) uses cookies and similar technologies to distinguish you from other users of the Website and to better understand the usage of the Website. This helps us provide you with a good experience when you browse the Website and also allows us to improve the Website.
The cookies that are used by OneArc via third parties as defined below are analytical and performance cookies. These collect information about the use of the Website and help to improve the way the Website works. For example, performance cookies may show which are the most frequently visited pages, help to record any difficulties with the Website and show whether advertising on the Website is effective or not. This helps us to improve the way the Website works, for example, by ensuring that users are finding what they are looking for easily. Such cookies do not collect information that identifies a user personally and all information that is collected by these cookies is aggregated and anonymous. The cookies used for analytics help collect data that allows services to understand how users interact with a particular service. These insights allow services both to improve content and to build better features that improve the user’s experience.
Third parties using and processing the cookies are the following:
Google Analytics – Google Analytics helps site and app owners understand how people engage with a service, uses a set of cookies to collect information and report site usage statistics without personally identifying individual visitors to Google. ‘_ga’ is the main cookie used by Google Analytics. ‘_ga’ enables a service to distinguish one user from another and lasts for 2 years. It’s used by any site that implements Google Analytics, including Google services.
More information and relevant policies:
https://marketingplatform.google.com/about/analytics/terms/us/
https://policies.google.com/technologies/partner-sites
Hotjar – Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behavior and their devices. This includes a device’s IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar stores this information on our behalf in a pseudonymized user profile. Hotjar is contractually forbidden to sell any of the data collected on our behalf.
More information and relevant policies:
https://www.hotjar.com/legal/policies/terms-of-service/
https://help.hotjar.com/hc/en-us/articles/115011789248-Hotjar-Cookies
Facebook Pixel – Cookies are used to better understand how users use the Facebook Products. For example: Cookies can help to understand how users use the Facebook service, analyse which parts of the Facebook Products users find most useful and engaging, and identify features that could be improved. As user, you can view your settings Facebook ads settings and update their preferences at any time.
More information and relevant policies:
https://www.facebook.com/legal/terms
https://www.facebook.com/policies/cookies/
When you visit the Website for the first time, we will show you a pop-up with an explanation about cookies. As soon as you click on “I agree”, you consent to us using the cookies in line with the applicable policies described herein.
You can disable the use of cookies via your browser, but please note that our Website may no longer work properly. You can use your internet browser to automatically or manually delete cookies. If you do delete the cookies in your browser, they will be placed again after your consent when you visit our Website again.
General
In order to provide services or information to its customers, prospective customers, website visitors and others, OneArc collects certain types of data from them. This section describes how data is collected and used by OneArc.
The Personal Data We Collect:
OneArc collects and retains only the personal data that is required to meet the purposes identified by OneArc. OneArc is committed to collecting personal data in a fair, open and lawful manner. For this reason, OneArc does not indiscriminately collect personal data. The type of personal data we may collect includes contact information (such as name, postal address, email address, telephone or fax numbers, etc.) but we may from time to time request a data subject to optionally provide demographic information or product or service preferences or usage patterns. When a data subject inquires about products or services or orders products or services, or engages in activities such as participating in OneArc-organised events downloading demos or subscribing to a newsletter, the data subject may provide information such as name, company name, job title and department, email, address, telephone and facsimile numbers, and other relevant data. OneArc may also collect, record and analyze information of visitors to its website. We may record your IP address. OneArc may add information collected by way of page view activity. Furthermore, OneArc may collect and process any personal data that you volunteer to us in our website’s forms, such as when you subscribe to a service or submit an enquiry or technical support request. Such personal data may comprise your IP address, first and last name, your postal and email address, your telephone number, your job title, your areas of interest, interest in OneArc’s products, and certain information about the company you are working for (company name and address), as well as information as to the type of relationship that exists between OneArc and yourself. Our website also provides for an easy way to contact us either by direct communication with us or by electronic mail (e-mail address). If a data subject contacts us by e-mail or via a contact form, the personal data transmitted by the data subject are automatically stored. This personal data transmitted on a voluntary basis by a data subject to us are stored for the purpose of processing or contacting the data subject. OneArc also gathers data about visits to the website, including numbers of visitors and visits, Geo-location data, length of time spent on the site, pages clicked on or where visitors have come. This information is used by OneArc to identify its customers, prospective customers, website visitors and others and provide or offer them with products, support, services, mailings, conduct sales and marketing actions, billing and to meet contractual obligations. It is completely optional for customers, prospective customers, website visitors and others to engage in activities or obtain services offered or provided by OneArc. Depending upon the activity or service, some of the information that we ask a data subject to provide is identified as mandatory and some as voluntary or optional. If the data subject does not provide the mandatory data with respect to a particular activity, the data subject may not be able to engage in that activity or receive the applicable product or service or may not be able to fully benefit from the product or service offered. OneArc’s policy is not to conduct processing of (a) personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade-union membership, or (b) genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
OneArc’s website collects a series of general data and information when a data subject accesses the website. This general data and information are stored in the server log files. Collected general data may include (a) the browser types and versions used, (b) the operating system used by the accessing system, (c) the website from which an accessing system reaches our website (so-called referrers), (d) the sub-websites, (e) the date and time of access to the Internet site, (f) an Internet protocol address (IP address), (g) the internet service provider (ISP) of the accessing system, and (h) other similar data and information that may be used in the event of attacks on OneArc’s website or other information technology systems. When using these general data and information, OneArc does not draw any conclusions about the data subject. On the contrary, this information is used to (1) help deliver the content of OneArc’s website in the intended manner, (2) improve the content of OneArc’s website as well as its advertisement and promotion, (3) improve the performance of OneArc’s website or other information technology systems, and (4) provide applicable law enforcement authorities with information necessary for criminal prosecution in case of hacking or cyber-attack on OneArc’s website or other information technology systems. Accordingly, OneArc uses anonymously collected data and information for statistical analysis with the aim of improving and protecting data security and our operations and service offerings, and to improve protection for the personal data we collect and process.
Our goal is that the purposes will be those that a reasonable person would consider appropriate in the circumstances and otherwise consistent with the guiding principles set out in this Privacy Policy.
There are two main purposes why OneArc collects, processes, stores and shares personal data:
Our aim is only to conduct processing of personal data in compliance at all times with applicable legal requirements and if, and to the extent, at least one of the following applies:
Or in rare cases:
If personal data is to be used or disclosed for a purpose not identified at the time of collection, individual consent will be obtained, where required by applicable law.
OneArc intends to transfer and share the personal data of customers, employees or others (data subjects) (i) internally (including via BAE Systems group of companies) and/or (ii) externally (via service vendors or contractors) in order to fulfill the Identified Purposes.
The service vendors or contractors might be based in the EU (e.g. Ireland) and also outside the EU (e.g. USA, Canada, Australia).
For third parties based in the USA and Australia, OneArc requires such third parties to protect the personal data transferred to them by OneArc in a way that ensures the same level of data protection as in the EU. Such protection will be ensured by executing the appropriate safeguards established by Standard Contractual Clauses (“SSC clauses”) adopted by the European Commission as well as additional measures that will ensure the compliance with the EU level of protection of personal data. The SSC clauses will be concluded between OneArc and each third party that is about to receive the personal data outside the EU from OneArc and is based in the USA or Australia. The SSC clauses can be obtained by sending a request to [email protected].
For third parties based in Canada, the European Commission adopted Decision No. 2002/2/EC on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act.
For third parties based in the UK, the European Commission adopted “adequacy decisions” No. C(2021) 4800 final and No. C(2021) 4801 final for transfers of personal data to the UK under GDPR and Law Enforcement Directive. These allow for the ongoing free flow of personal data from the EU to the UK.
For internal transfers of personal data within BAE Systems group of companies, OneArc is a party to an International Intra Group Data Protection Agreement (IGA), dated 25 May 2018, as amended, executed among BAE Systems affiliates and the lead entity (BAE Systems plc). The IGA represents the contractual framework under which the personal data of data subjects can be shared, transferred and processed internally within the BAE Systems group of companies. IGA also contains up-to-date SCC clauses under which the adequate level of protection of personal data that are being processed internally is ensured. The SSC clauses can be obtained by sending a request to [email protected].
OneArc limits its use or disclosure of personal data to the purposes for which it was originally collected, unless it has first obtained the consent of the person from whom such information was received, or as otherwise permitted or required by law. OneArc retains personal information only for as long as it is needed for the purposes for which it was collected or used, or as otherwise required by law. The corresponding data is routinely deleted, as long as it is no longer necessary for the fulfilment of the contract or the initiation of a contract.
Personal data is maintained in as accurate, complete and up-to-date form as necessary for the purpose for which it is collected, or where it is likely to be used to make a decision about an individual. OneArc does not routinely update personal data and relies on the individual to advise it when his or her personal data changes. From time to time, in its sole discretion, and for a reasonable and legitimate purpose, OneArc may request written confirmation from an individual that the information collected and held by OneArc is up to date and accurate.
Personal data is protected, by appropriate technical and organizational measures including security safeguards appropriate to its sensitivity and level of risk, from unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks. OneArc’s security safeguards include, as relevant:
Individuals (data subjects) have the right to obtain from OneArc restriction of processing where one of the following applies:
the accuracy of the personal data is contested by the individual for a period enabling OneArc to verify the accuracy of the personal data;
Where processing has been restricted in this regard such personal data shall, with the exception of storage, only be processed with the individual’s consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of an applicable governmental authority. An individual who has obtained restriction of processing pursuant to Privacy Policy be informed by OneArc before the restriction of processing is lifted.
Individuals (data subjects) have the right to obtain from OneArc the erasure of personal data concerning him or her without undue delay and OneArc will erase personal data without undue delay where one of the following grounds applies:
the personal data have to be erased for compliance with a legal obligation to which OneArc is subject.
Notification regarding rectification or erasure of personal data or restriction of processing
OneArc will communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with this Privacy Policy (or otherwise as required by applicable law) to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. OneArc will inform the individual (data subject) about those recipients if the individual (data subject) requests it.
Individuals (data subjects) have the right to refuse to be subjected to automated decision making, including profiling and may insist on human intervention if the decision is:
Individuals (data subjects) have the right to receive the personal data concerning him or her, which he or she has provided to OneArc, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from OneArc, where:
In exercising his or her right to data portability pursuant to this Privacy Policy, the Individuals (data subjects) have the right to have the personal data transmitted directly from one controller to another, where technically feasible. The exercise of the right referred to in this section shall be without prejudice to the rights of the individual for erasure. That right shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in OneArc.
We are permitted to disclose personal information when we are legally required to do so or have good reason to believe that this is legally required.
Applicable law to which OneArc is subject may restrict the scope of the obligations and rights provided for in this Privacy Policy when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
We may also reveal a user’s personal information without his/her prior permission only when we have good reason to believe that the disclosure of this information is required to establish the identity of, to contact or to initiate legal proceedings against a person or persons who is/are suspected of infringing rights or property belonging to OneArc or to others who could be harmed by the user’s activities or of persons who could (deliberately or otherwise) transgress upon these rights and property.
Subject to some exceptions, you have the right to request access to any personal information relating to you that is held by OneArc in accordance with applicable laws. Ordinarily, a copy of the personal information held by OneArc electronically or in files can be provided.
If you:
you will need to make a written request by email to [email protected] with sufficient details for OneArc to identify you, and to contact you in the event that OneArc requires further confirmation of your identity.
By requesting that OneArc cease holding personal information relating to you, you acknowledge and agree that OneArc will cease the provision of all services to you requiring such information. OneArc will then take all reasonable steps to ensure that the personal information relating to you is destroyed or de-identified by secure means.
