Privacy Policy
Last Updated: September 8, 2026
This notice explains what personal data DemandArc collects, why we collect it, who we share it with, and what rights you have. If you filled in a form to download something one of our clients sponsored, this is the notice that applies to you.
We have tried to write it plainly. If anything here is unclear, email us and we will explain it.
Who we are
DemandArc, Inc. (formerly NavigateIQ) is a technology demand generation company. We run marketing programs for client brands. In practice that means we publish content those clients sponsor, and pass the details of people who request it to the client so they can follow up.
DemandArc also operates IT Business Wire (itbusinesswire.com), the Resource Center where much of the sponsored content is published. If you completed a form there, DemandArc, Inc. is the company responsible for your data and this notice is the one that applies. This single notice covers both demandarc.com and itbusinesswire.com.
- Address: 10900 Research Blvd, Ste 160C‑1467, Austin, TX 78759, USA
- Privacy contact: privacy@demandarc.com
When we are responsible for your data, and when our client is
If you completed a form to request sponsored content — on one of our pages or on a publisher’s site — we decided what data to collect and why. We are the controller for that data, and this notice applies.
Once we pass your details to the client who sponsored the content, that client becomes responsible for what they do with it. They are a separate controller and their own privacy notice applies to their use of your data. We tell you who they are on the form before you submit it.
Separately, clients sometimes give us their own contact lists to work with. For that data the client is in charge and we act on their instructions. If you are not sure which situation applies to you, contact us and we will tell you.
What we collect and why
| What we collect | Why | Our legal basis |
|---|---|---|
| Your name, business email, business phone, job title, job level and function, employer, company size, industry and country | To send you the content you asked for, check you match the audience for the program, and introduce you to the client sponsoring it | Your consent, given when you completed the form |
| Which asset you requested, which program it belonged to, and whether it was delivered | To run the client’s program and report on it accurately | Your consent; our legitimate interest in reporting and billing |
| Your opt-in status and the date you opted in | To prove we were entitled to contact you | Legal obligation; our legitimate interest in keeping records |
| The minimum details needed to recognise you and leave you alone | So that once you opt out, you stay out — across every future program | Legal obligation; our legitimate interest in honouring your choice |
| Confirmation that your email address is valid | To avoid passing a client details that do not work | Our legitimate interest in data quality |
| Business contact details for people at our clients and suppliers | To manage our commercial relationships | Contract; our legitimate interest in running the business |
| Application materials and employment records | Hiring and employing people | Contract; legal obligation |
We do not knowingly collect sensitive data — nothing about your health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sex life or sexual orientation, and no genetic or biometric data. We do not knowingly collect data from anyone under 16. Our services are aimed at people at work.
Where we get your data
- From you, when you fill in a form on one of our pages — usually the IT Business Wire Resource Center.
- From a publisher partner, when you fill in a form on their site for content one of our clients sponsored. We write the opt-in wording used on those forms, so what you were told when you signed up came from us.
- From our clients, when they give us contact or exclusion lists for a program.
- From an email verification service, which tells us whether an address we already hold is still valid. It does not add anything to your record.
If we get your data from somewhere other than you, we will tell you within one month, or when we first contact you if that comes sooner — including what we collected and where it came from.
Who we share it with
- The client who sponsored the content. This is the main reason we collect your data, and we never do it without telling you first. We name the client on the form before you submit it. Your details go straight from our systems into theirs.
- Companies that provide services to us — hosting, lead processing, and email verification. They act on our instructions under written contract.
- Advisers and authorities, where the law requires it or where we need to defend a legal claim.
- A buyer, if DemandArc is ever sold or merged.
Where your data is held
If you are in Europe, your data is stored in an EU region.
DemandArc is a US company, so our staff and systems in the United States access that data, in order to run the programme you responded to and to deal with any request you make about your record.
If you want to know more about where your data is held, or who has access to it, email privacy@demandarc.com and we will tell you.
How long we keep it
| What | How long |
|---|---|
| Your lead record | For the period set by our contract with the client whose program you responded to, or 24 months from delivery if that contract does not say |
| Proof of your opt-in | Kept with your record, for as long as we need to evidence it |
| Your opt-out, if you give us one | Kept indefinitely — see below |
| Client and supplier records | For the length of the relationship, plus the period we may need them for legal claims |
Once we have passed your details to the sponsoring client, we keep the record only to report on the program and to make sure you are not contacted again if you asked not to be. We do not market to you ourselves.
If you ask us to stop contacting you, we keep the smallest amount of information needed to recognise you and leave you alone. It is the one record we cannot delete, because deleting it would undo the very thing you asked for.
Your rights
If you are covered by the GDPR, you can ask us to:
- Give you a copy of the personal data we hold about you;
- Correct anything that is wrong, or complete anything that is missing;
- Delete your data, where one of the grounds in Article 17 applies;
- Pause our use of your data while we sort out a dispute about it;
- Send your data to you, or to another organisation, in a machine-readable format;
- Stop using your data for direct marketing. If you object to marketing, we stop. There is no balancing exercise and no exception;
- Withdraw your consent at any time, as easily as you gave it. That does not undo anything we did before you withdrew it;
- Not be subject to a decision made purely by a computer that has a legal or similarly significant effect on you.
How to ask. Email privacy@demandarc.com. We will reply within one month. If your request is complicated we may need up to two months more, and we will tell you within the first month if so. There is no charge.
If we have already passed your details to a client. We will deal with our own copy, tell that client about your request, and tell you who they are so you can go to them directly.
If you are unhappy. You can complain to the data protection authority in the EU or EEA country where you live, where you work, or where the problem happened. We would rather have the chance to put it right first.
Cookies
We use cookies and similar technologies on this site to make it work, to understand how it is used, and for marketing. Where the law requires it we ask before setting anything non-essential, and you can change your mind at any time. You can also block cookies in your browser, though parts of the site may then not work properly.
How we protect your data
Lead data lives in one system rather than being scattered across spreadsheets and shared folders. That is deliberate: it is what lets us find, correct or delete your record reliably when you ask.
Access to that system requires multi-factor authentication and is limited to the people whose job needs it. We review who has access, close accounts promptly when someone leaves, and encrypt personal data both in transit and at rest. Our staff are trained on data protection and formally accept our policies. No system is perfectly secure, but we review these measures regularly.
Changes to this notice
We review this notice at least once a year. If we change something material about how we use your data, we will update the date at the top and, where the change is significant, tell you directly.
Contact us
Email privacy@demandarc.com or write to DemandArc, Inc., 10900 Research Blvd, Ste 160C‑1467, Austin, TX 78759, USA.
