This Policy explains which of your personal data are collected by Arduino s.r.l. (hereinafter “we” or “Arduino”), for which purposes and how they are processed. You can also find below the necessary information to enforce your rights provided for by GDPR.

Generally, we collect your personal data if you create an account, when you use our services and products, when you email or call us or send us a message, when you use our websites, apps and social media. We inform you that the personal data collected during such processes will be used in order to reply to your queries, to allow you to use the services and products provided by Arduino, to carry out marketing activities, to provide customer support and to carry out analyses in order to ensure you have a customized user experience on the website and the app, as specified below.

1Who processes your data – Data Controller

Arduino s.r.l., with registered office in in via Andrea Appiani 25, 20900 Monza (MB) – Italy, is the Data Controller of the processing of your personal data, necessary to provide you with the services and products of Arduino and, upon your consent, for marketing purposes, consistently with the purposes and modalities indicated below.

Arduino’s Data Protection Officer (“DPO”) can be contacted via email dpo@arduino.cc or at the above address.

2Which data we use – type of processed data

For the purpose of creating your Arduino ID account and providing you the Arduino services you have requested, as well as giving you customer assistance, we process your personal data such as name (or username), email address, telephone number.

If you wish to purchase any of our products or services, or make a donation, we also use your Tax Registration Number - Vat Registration Number, your date of birth, your residence address and your credit card data and invoicing data.

To allow you to take part to the discussions in our Arduino Forum and in Arduino User Group and to enable you to log in Arduino Playground, Arduino Day, Arduino Create, Arduino Store, we use your username, your IP address and your ID Account and, if you decide to make such data known to other Arduino users, we use the information relating to your position and to your person that you wish to share with Arduino community and, upon your request, with the public.

To enable the CTC educational program or to let your students coordinate their use of Create, we use your name, surname, email address, residence or work address, as well as your credit card data and invoicing data. Students under the age of 16, who will be involved in the use of the CTC educational trainings or in the use of Create, shall not be identified, as the teacher/coordinator will be provided with univocal and anonymous login credentials that the sole teacher will assign to such students, whose browsing data, however, shall not be visible to Arduino.

To allow you to take part to the Contributor License Agreement Program, we use, in addition to you ID Account, the name, the surname and other personal information that are in the header of the source code or in the other documents of the license.

In order to send you commercial information about our products and services and to submit proposals tailored to your tastes, we may use your email address and your name, spoken language and country of origin, as well as browsing data and website behavioral information to better understand which products and services you prefer, provided you have previously authorized such processing.

3Where we collect your data – Data collection methods

Directly from you. For example, if you create an account, if you download our app, if you post a comment on our websites (or through our app), on our social media accounts, if you send us a query via email or through other communications means. If you do not communicate your data we may not activate your account and we would not be able to provide you with a very limited service either. If you do not activate an Arduino account, you may use only a limited part of our services. If you wish to purchase one of our products or services, the failure to communicate your data would prevent us from provide you with what you requested.

In all cases under section 4 where it is stated that the processing of your data is optional, revocable or that it can be activated upon your request, the failure to communicate your data does not affect your use of Arduino’s services.

Through the use of the website and the app. We use cookies and other analysis tools, to improve the functionalities of the website and the app and make their use more efficient. To learn more, please see our Cookie Policy.

From third parties. For example, if you decide to use the social media functionalities to register on our website or to use our app, the social media website (which is a third party) will transmit us, with your previous consent, some of your data, such as your name, country of origin, spoken language and your email address. Your activities on our websites and apps may be posted on the social media platforms you have an account on (and of which you have accepted the terms and conditions, including those relating to the use of your data). Lastly, if you released a software of which you are the author (or coauthor or contributor) and it is re-released, shared or commented through our website, we may process your personal data, which you already filled in the source code or in the documents of the license.

4Why and for how long we process your data – Purpose and legal basis of processing – Data retention period

To provide you with Arduino’s services and products, through our website and our app, to give you information and assistance for the activation of your account and on Arduino’s services. The processing of your data is necessary to give you access to the website of Arduino and to the app and their functionalities, to respond to your requests and to assist you when you use our products and services.

In particular, the creation of the ID Arduino account allows you to use different functionalities of the website of Arduino, among which the on-line shop, the Arduino User Group, the Playground Arduino CC, the Arduino Day, the Arduino Create, the educational program CTC, the forum of the users of Arduino, the Contributor License Agreement Program and the other development and educational instruments available on the website.

The legal basis of this processing is the performance of the services you have requested, in accordance with the terms and conditions of Arduino’s service that you have accepted, as well as the fulfilment of pre-contractual measures that you may have requested before activating such services. The retention period of your data is equal to the period of activity of your account for the use of Arduino’s services according to the terms and conditions of use that you accepted. Without your data, we cannot provide you with the services of Arduino described above.

To allow you to request information and to interact with other users. Through the forum and the community functionalities of Arduino User Group, Playground Arduino CC, Arduino Day and Arduino Create, which you can access upon specific request, you may take part to discussions, request information and leave comments or other information relating to your experiences, among which the details of what you created, which can be viewed from other users.

The legal basis of this processing is the user’s consent, to be provided when the terms and conditions of use of Arduino services are accepted. The retention period of your data is equal to the period of activity of your account for the use of Arduino’s services according to the terms and conditions of use that you accepted. Without your consent we cannot enable your interactions with other users and, in particular, your comments and your shares.

To provide you with the products and services you purchased and to send you communications in connection with your purchase order or with your payments. We will process your data to process your purchase orders. We may send you emails regarding your account or your purchase of Arduino’s products and services or the payments made through our website. The legal basis of this processing is the performance of the agreement you become a party of when you accept the terms and conditions of Arduino’s service and the fulfilment of pre-contractual measures that you may have requested. For this purpose, the retention period of your data is equal to the period required to process the purchase order (however, if you have also an account, the retention period of your data is equal to the period of activity of your account for the use of Arduino services, according to the terms and conditions of use that you have accepted). Without your data we cannot process your purchase order and provide you with the products and services requested.

To properly manage your customer account. We process your data for accounting, administrative and tax purposes, directly related to the business of Arduino as required by the applicable legislation. The legal basis of this processing is the compliance with legal, statutory, obligations and the retention period is equal to that required by law (in particular by tax, anti-money laundering, banking and public security law). For internal administrative purposes, we may also share your data within the Arduino companies group, located abroad, in compliance with the principles set by the GDPR for the transfer of personal data to companies located in a third country (in particular, we could communicate your data to Arduino affiliated operating in the European Union, in Switzerland and in the United States and which have entered into with Arduino standard data protection clauses approved by the European Commission). The legal basis of such processing is the legitimate interest of Arduino in pursuing its corporate organizational purposes recognised by law. The retention period, where it is not required by law for a longer period (see the previous paragraph), is equal to the duration of your contractual relationship with Arduino (therefore to the activity of your account, to the processing of your purchase order or to the statutory warranty period).

To enable the use of educational products in the CTC program and through Arduino Create. When you purchase a CTC educational service package or Arduino Create, we process your data in order to process your purchase order, as well as to enable the use of these services on your terminal and on the terminal of the users you wish to involve in the educational program. Users involved in the educational program shall activate an Arduino ID account in their name, with the exception of minors under the age of 16, who shall activate accounts not connected to their identities (known only to the teacher and not disclosed to Arduino). The legal basis of this processing is the need to fulfill the agreement you entered into with us when you ordered a CTC product or when you requested to let your team interact through Create. The retention period in connection with this purpose is equal to the period during which you or your team use the educational package. Without your data, we cannot process your purchase order and provide you with the educational services of the CTC program and Arduino Create.

To allow you to release the softwares of which you are contributor. Arduino allows you to make available to the developers’ community the result of your development work within the Contributor License Agreement program. For this purpose, we use the data of your account, your name, the email and the personal data you filled in the header of the source code and in the documents of the license. The legal basis of this processing is the need to fulfill the contractual obligations in accordance with the terms and conditions that you have accepted. The retention period in connection with this purpose is equal to the period during which your software is available on Arduino sharing platform. Without your data we cannot release your work within the Contributor License Agreement Program. If your work is part of other works released by third parties and the terms of license provide for the publication of your data as author/coauthor, the legal basis of the processing is the legitimate interest of Arduino in pursuing its corporate organizational purposes of promotion of the open source community, which considers, and is compatible with, your rights and interests as developer of open source programs and as community member. In this case, the retention period is equal to the period during which the software that represents your work is available on Arduino sharing platform. If you want to erase your data from the published licenses you shall exercise your moral rights as author of the software, consistently with the terms of the license you and the next contributors used (as regards the erasure of your data from Arduino platform, see the following section “your rights”).

To make donations. If you wish to take part to the “Donate” program, and contribute to the development of Arduino community, we shall use your personal and payment data (see above in the section “which data we use”) to allow you to donate the amount you wishes. The legal basis of this processing is your consent, to be provided when the payment is made. The retention period for this purpose is equal to the period of time necessary to process your payment request. Without your data we cannot perform the activities necessary to allow you to make the donation.

In addition, we may store your data in order to fulfill the obligations required by law (in particular by tax, anti-money laundering, banking and public security law). The legal basis of this processing is the need to comply with the law. In this second case scenario, the retention period of such data is equal to the retention period required by law (in particular by tax, anti-money laundering, banking and public security law).

To send essential information concerning your account your use of Arduino products and services. We use your email to send you important information regarding the status of your account (for example if some of the services you are registered to are about to expire or if your account is about to be closed according to the terms and conditions of the service you accepted), the security of Arduino products and services or changes to this Privacy Policy. The legal basis of this processing is the legitimate interest of Arduino to inform you about your user account and services you have used, and to protect its information systems against security threats. The retention period of data in connection with this processing is equal to the period necessary to carry out the abovementioned communications.

To let you interact with customer care operators. We may use your e-mail address or telephone number, as well as the name and/or postal address, to assist you in case you need help using Arduino products and services. Also to provide you customer assistance, we may communicate your data to Arduino’s affiliated companies operating in the European Union, in Switzerland or in the United States and which have entered into with Arduino standard data protection clauses approved by the European Commission. The legal basis of this processing is the performance of the agreement which you have entered into with Arduino when you have accepted the terms and conditions of use of Arduino’s services and the compliance with the legal obligations regarding statutory due warranties and assistance to the consumer.

We might also collect information regarding customer assistance or issues occurred to our service. To improve quality of customer care services, subject to applicable legislations, Arduino may also record and listen conversations with customer care operators. The legal basis of this processing is the legitimate interest of Arduino to improve the quality of the services provided to its customers. In addition, Arduino might analyze any feedbacks provided voluntarily through surveys submitted to the client. The legal basis of this processing is the consent of the data subject.

In all the abovementioned cases, the retention period of the data is equal to the period of activity of your account.

To monitor and improve our products, services and websites. With your consent, we analyse your data relating to your use and your preferences to improve our approach towards you and our customers in general, through automated processing, including profiling (through the cookies). We do this so that we can make better decisions related to services, advertising, products and content based on greater awareness of how our customers use our services and to ensure you a customized user experience. For such purpose we may also collect the advertising identifier of your mobile device (IDFA - Identifier for Advertising - for iOS devices and ADID - Google Advertising ID - for Android devices) and your Arduino username to enable us to always provide you with targeted and accurate ads based on your preferences and your interests. The legal basis for this processing is your explicit consent. The retention period of your data is 12 months from the collection of your data.

To prevent or assess unlawful conducts, to protect and enforce our rights. For example, we may use your data to prevent or prosecute illicit conducts or infringements, including of our - and third parties’ - intellectual/industrial property rights, or to prevent or prosecute cybercrimes or crimes committed through the internet. The legal basis of such processing is the legitimate interest of Arduino to protect its rights and to prevent criminal offences. The retention period of your data is equal to the time reasonably necessary to enforce our rights from the moment we become aware of the offence or of its potential commission.

For Arduino’s and its own partners marketing purposes. After having obtained your consent, you may be contacted by Arduino via email with promotional content regarding Arduino’s services. Also subject to your further consent, we may disclose your data to select Arduino’s partners for the purpose of sending you promotional, advertising material and other communications with marketing purposes related to their products (in such case you will find the explicit mention of the partner that may receive your data with a link to its privacy policy). The legal basis for this processing is your explicit consent. The retention period of your data is 12 months from the collection of your data.

To obtain information on the use of the website. When you browse our website, even when you do so without being registered or having logged in, the software procedures and the computer system controlling the functioning of the web applications acquire, during their normal operation, some data whose transmission is implicit in the use of Internet communication protocols.

This information is not collected to be associated with identified data subjects, but due to their very nature they could, through processings and associations with data held by the Data Controller or by third parties, allow users to be identified.

In case of unregistered users, geographical location data and data related to how the website is used will only be used in an anonymous form that does not in any way allow, even in combination with the Unique Device Identifier (UDID), the MAC address, the IMEI or IMSI codes or other customer codes, to trace, directly or indirectly to your identity, unless you allow us to use your data at the moment of registration with explicit consent. In such case, we shall connect your browsing data used in an anonymous form in the previous 30 days to your identity.

This category of data includes IP addresses or domain names of the devices used by users connecting to the application, the addresses in URI (Uniform Resource Identifier) of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code given by the server indicating the status of the response (successful, error, etc.), the visited sections of the website, the type of device used, the country from which you connect and other parameters related to the operating system and the user's computer environment. Arduino uses this information solely to allow navigation on its websites and to process the operations normally related to the use of the website. The legal basis of this processing is the legitimate interest of Arduino to communicate with the public through telematic networks. The retention period of the information that could potentially allow the identification is 30 days from access to the website.

Data obtained from browsing may be used, with your consent (which you can manage and revoke by modifying the privacy settings), also to determine your preferences and carry out web analytics activities to evaluate the profitability of each online activity and understand the user’s behaviors with the aim of improving the available services. It is however your right to object, at any time and without charge, to the processing of your data for this purpose. The legal basis for this processing is your consent. The retention period of the data related to the website’s navigation for analysis purposes is 24 months from access to the website. To learn more, please read our Cookie Policy.

To obtain information on the use of the app. We may collect data relating the type of device that you are using, or the operating System version of your computer or device. We may as well analyse how often you use the app and from where you downloaded it.

Your preferences on the methods through which we use data on mobile devices are described here.

For these purposes we use third parties’ tools

Among these tools there are some that we use to handle technical problems in the app, whose resolution requires the use and sharing of the data related to the use of the app with our service providers. This function will only use your data if you have spontaneously activated and authorised it.

The legal basis of the processing is the legitimate interest of Arduino to improve the quality of the services offered to its users and the security of its application. The consent to the use of these tools is optional and can be revoked at any time. The retention period of the information used for this purpose is 24 months from the access to the website.

In relation to the aforementioned purposes, the processing of personal data takes place using manual, IT and telematic tools with logics strictly related to the purposes themselves and, in any case, in order to guarantee the security and confidentiality of the same data in compliance with the law.

5Cookies

What are cookies. Cookies are small text files that the websites visited by users send to their terminals, where they are stored before being re-transmitted to the same websites during subsequent visits.

Cookies used by Arduino’s website and their purpose. The website uses cookies which have the functionality of enabling the proper functioning of some sections, for example to access to the reserved area of the website (“technical cookies”), to ensure some customization functionalities (“functional cookies”), to improve the browsing experience (“analytical cookies”) and to help us providing you with customized offers of products you might like (“profiling cookies”).

The first time you will visit the website, you will be asked to accept (or not accept) the cookies through a banner. You may refuse to accept all or some of the cookies or you may modify, also in the future, your computer settings in order to know when you receive cookies or to be able to deactivate the function of automatic acceptance of the cookies.

The website uses the following cookies categories:

• Technical cookies (or browsing cookies), which contribute to the functioning of the website, for example to allow to browse through the pages and access the reserved area of the website; the legal basis of the processing underlying the use of these cookies is Arduino’s legitimate interest in providing efficient and well-functioning services to its customers; the retention period of these cookies starts from the date of the first access to the website until they are disabled.

• Functional cookies, which allow to activate specific functionalities of the website and store your preferences (such as the language), in order to improve your browsing experience; the legal basis of the processing underlying the use of these cookies is Arduino legitimate interest in providing efficient and well-functioning services to its customers; the retention period of these cookies starts from the date they are enabled to the website until they are disabled. The user can accept and disable –at their convenience - these cookies at any time by using the cookies consent tool.

• Analytical cookies, which allow the acquisition of statistical information in aggregate and anonymous form, in relation to the navigation modalities; the legal basis of the processing underlying these cookies is Arduino’s legitimate interest in providing efficient and well-functioning services to its customers; the retention period of these cookies starts from the date they are enabled to the website until they are disabled. The user can accept and disable –at their convenience - these cookies at any time by using the cookies consent tool.

• Profiling cookies, which allow us to customize advertising messages according to your interests and your preferences, in order to only send you advertisements that you may consider relevant or interesting. The legal basis of the processing underlying the use of these cookies is the consent of the data subject; the retention period of these cookies starts from the date they are enabled to the website until they are disabled, and in any case no more than 12 months. The user can accept and disable –at their convenience - these cookies at any time by using the cookies consent tool.

The cookies currently used are:

In order to analyse how the website is used, we use Google Analytics, a web analysis service provided by Google Inc. (“Google”), which uses cookies placed on your computer to allow us to make statistical analysis. The collected data are in aggregate form and in no way permit to identify you. To consult the Google privacy policy related to the Google Analytics service, visit the website http://www.google.com/analytics/learn/privacy.html. To know Google’s privacy standards, visit the website http://www.google.com/intl/it/privacy/privacy-policy.html. The cookies of Google Analytics may be refused pursuant to the procedure specified by Google (https://tools.google.com/dlpage/gaoptout?hl=it). Therefore, if you continue to use Arduino website without refusing the cookies of Google Analytics, you consent to your data processing by Google, limited to the procedures and purposes above specified.

How to deactivate technical cookies.

You can refuse the consent to use cookies by means of specific settings of your browser. Some functionalities of the website might not work properly if you refuse to use the cookies.

Here below you will find the links that explain how to deactivate the cookies from the most common browsers (for other browsers, if used, we suggest you to search for this option in the help section of the software, normally available through the F1 key):

• Internet Explorer: click on the Settings button, then on Internet Option. Click on the Privacy tab and, in the settings, if you move the settings bar to the very top all the cookies will be blocked.

• Google Chrome: click on the menu in the toolbar of the browser. Select Settings, click on advanced settings. In the “Privacy” tab, click on the Content Settings button. Deselect the button “Allow sites to save and read cookie data”.

• Mozilla Firefox: click on the menu button and select Options. Select the Privacy tab. In History Settings: select “use personal settings”. To activate the cookies, mark “accept cookies from sites”; to deactivate the cookies, remove such mark.

• Safari: click on the menu toolbar on “Safari”, then in “”Preferences”. Now click on “Privacy”, then on “Details” to select the website, then select “Remove”.

Alternatively, you can disable ony the cookies of Google Analytics, by using the opt out extension provided by Google for the main browsers https://tools.google.com/dlpage/gaoptout?hl=it

6Where are your data processed – Transfer of data

The data will be processed and stored at our premises in Italy.

As anticipated, for internal administrative and organizational purposes and to provide you with customer assistance, we may communicate your data to companies belonging to the Arduino’s group, operating in the United States and which have entered into with Arduino agreements in compliance with art. 28 GDPR with standard data protection clauses approved by the European Commission.

Your data may also be stored in the European Union, in Switzerland and in the United States by Arduino’s suppliers to whom the data are transmitted on the basis of agreements in compliance with art. 28 GDPR with standard data protection clauses in accordance with the decision of the European Commission concerning the data protection clauses and by virtues of an adequacy decision of the European Commission on the level of data protection (Privacy Shield). The updated list of third party suppliers, operating as data processors pursuant to art. 28 GDPR, is available by sending a request to privacy@arduino.cc.

7With whom we share your data – recipients of the personal data

With other Arduino’s users. If you use the Forum, Arduino Playground, Arduino User Group, Arduino Create, Arduino Day, Arduino Blog and the social media channels of Arduino accessible through our website, you can interact with other users, to whom your comments, your position and the other information you want to share will be visible.

With Arduino’s commercial partners. If you accept, at the time of expressing your preferences regarding personal data, to let your data to be communicated to Arduino’s commercial partners, they may process them according to the privacy policy they will submit to you.

With service providers. Arduino uses third-party services (clouds, customer care, analysis, profiling, research, hosting, browsing functionalities, use of the app and of the website and components of Arduino’s products and services) that operate as data processors pursuant to agreements in compliance with art. 28 GDPR. When such providers operate from a third country, they do it on the basis of standard contractual clauses in compliance with the decision of the European Commission relating to the data protection clauses or by virtue of an adequacy decision of the European Commission on the level of data protection (Privacy Shield). These subjects acquire only the personal data necessary to fulfil their functions and may use them only for the purpose of performing these services on our behalf or to comply with the law. The updated list of third-party suppliers, operating as data processors pursuant to art. 28 GDPR, is available by sending a request to privacy@arduino.cc.

With other companies belonging to the Arduino’s Group. Your data may be shared with other companies belonging to Arduino’s group either for internal administrative and organizational purposes or to provide you with the services you have requested or with customer assistance. Up-to-date data on Arduino companies recipients of your data are available by sending a request to privacy@arduino.cc.

With judicial or administrative authorities. Where we believe we have to do so to comply with an order from the judge or from an authority, or to comply with legal obligations or in order to protect us or third parties judicially, we may disclose your data to the Judicial Authority or to a Governmental Agency in Italy or the European Union.

8Minors

Arduino does not process the personal data of minors under the age of 16. In the event that Arduino becomes aware that it has collected personal data from users under the age of 16, it will take the necessary steps to delete such information as soon as possible. Students under the age of 16 who will be involved in the use of CTC educational trainings or in the use of Create shall not be identified, provided that the teacher will be provided with univocal and anonymous login credentials that the sole teacher will assign to the students under the age of 16, whose browsing data, however, shall not be visible to Arduino.

9Your rights

In addition to managing your preferences on processing of your personal data in accordance with the previous paragraphs, you can contact Arduino to request access to your personal data, rectification, erasure of the same or restriction of the processing, to object to the processing and ask for the portability or the copy of your data; you can also revoke the consent at any time (this will not affect the lawfulness of the processing based on the consent given before the revocation).

You have the right to lodge a complaint with the Authority for the Protection of Personal Data and to ask to the data controllers, at any time, information about the data processors and the persons authorized by the data controllers to process your data.

You can exercise your rights by contacting Arduino via email at dpo@arduino.cc or by writing to the address indicated above.

10What do we do if we change this policy – update of the privacy policy

We may introduce changes to our privacy policy. We will notify you in relation to these changes by publishing an updated version on our website and by notifying you via email and with other messages that may be available on the app. The new privacy policy will have a different date than the one shown below. Please visit the website periodically for updates.

Version updated as of May 25, 2018