Privacy Policy
Last updated: 20 October 2026
This English version is a translation provided for convenience. In the event of any discrepancy, the Slovenian version prevails.
1. Data controller
The controller of your personal data is ARSIO SYSTEMS d.o.o. (hereinafter: "we", "us", "the platform" or "ARSIO"), with its registered office at:
- Address: Ulica škofa Maksimilijana Držečnika 6, 2000 Maribor, Slovenia
- Registration number: 7342578000
- VAT number: SI14509903
- Privacy contact email: info@arsio.hr
For any questions, requests or complaints regarding the processing of your personal data, you can contact us at the email address above. We will reply as soon as possible and no later than 30 days after receiving your request.
2. Legal basis and applicable regulations
This privacy policy is prepared in accordance with the following regulations:
- General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679 of the European Parliament and of the Council;
- Personal Data Protection Act (ZVOP-2) – the Slovenian implementing act supplementing the GDPR;
- Electronic Communications Act (ZEKom-2) – regarding cookies and electronic tracking;
- EU Artificial Intelligence Regulation (AI Act) – Regulation (EU) 2024/1689 regarding the transparency of automated decision-making.
3. Supervisory authority
If you believe that the processing of your data violates data protection regulations, you have the right to lodge a complaint with the Slovenian supervisory authority:
- Information Commissioner of the Republic of Slovenia
- Dunajska cesta 22, 1000 Ljubljana
- Phone: +386 1 230 97 30
- Email: gp.ip@ip-rs.si
- Website: www.ip-rs.si
4. Which personal data we collect
When you register, sign in and use the platform, we collect and process the following categories of personal data:
4.1 Registration and sign-in data
- Email address – for creating the account, authentication and communication.
- Data from external sign-in providers (e.g. Google) – name, email address and profile picture.
- Unique user identifier – for securely linking your data.
4.2 CV and profile data
When you upload a CV or fill in your profile, the system processes the following data:
- Full name and contact details (email)
- Profile summary / description
- Education and work experience
- Skills and language knowledge
4.3 Job search and interaction data
- Chosen industry, sub-industry and region – your job preferences.
- Address and search distance – the address you pick from the address register (street, house number, town, postcode and a map point) and the maximum distance to work. We use them to select jobs within that distance and for email alerts about new jobs. Companies do not see your address, only the region it lies in.
- Interactions with jobs – your "like" / "dislike" decisions and browsing history.
4.4 Technical and analytics data
- IP address and approximate location.
- Device and browser data.
- Analytics data – page visits, interactions, session recordings and heatmaps (only with your consent).
4.5 Data stored in the browser
- localStorage – data about your CV, search preferences and analyses is stored locally in your browser and expires automatically after 24 hours.
- Cookies – an authentication token (
auth_token) valid for 7 days, with theSecure(in production),SameSite=LaxandHttpOnlyflags.
5. Purposes of processing and legal bases
We carry out each processing of your personal data on the basis of one of the lawful bases in Article 6(1) GDPR. The individual purposes and their legal bases are listed below:
| Purpose of processing | Legal basis (GDPR) |
|---|---|
| Creating and managing the user account | Article 6(1)(b) – performance of a contract |
| Authentication (Google OAuth, email link) | Article 6(1)(b) – performance of a contract |
| Storing and analysing the CV to build the profile | Article 6(1)(b) – performance of a contract |
| Generating career advice and suggestions for improving the CV | Article 6(1)(b) – performance of a contract |
| AI analysis of the CV and matching with jobs | Article 6(1)(b) – performance of a contract |
| Recording search preferences and browsing history | Article 6(1)(b) – performance of a contract |
| Sending verification emails and the "magic link" for continuing a session | Article 6(1)(b) – performance of a contract |
| Firebase Analytics (web analytics) | Article 6(1)(a) – consent |
| Microsoft Clarity (session recordings, heatmaps) | Article 6(1)(a) – consent |
| Platform security, abuse prevention | Article 6(1)(f) – legitimate interest |
| Platform administration (administrator access) | Article 6(1)(f) – legitimate interest |
Legitimate interest (Article 6(1)(f)): Where we rely on legitimate interest, we have carried out a balancing test and found that our interest (platform security, efficient management) does not override your rights and freedoms. You can contact us by email for a detailed explanation of the balancing test.
6. Use of artificial intelligence and automated decision-making
6.1 What our artificial intelligence does
The ARSIO platform uses advanced machine learning and large language model technologies for:
- Analysing and parsing your CV – the system reads the content of the document automatically and extracts structured data for your profile.
- Semantic search – the content of your profile is converted into a form that allows semantic comparison with job descriptions.
- Job matching and profiling – algorithms compare your skills, experience and preferences with open jobs and calculate a match score.
- Generating recommendations and career advice – based on your interactions, the system suggests additional relevant jobs and tips for improving your CV.
- Suitability analysis – for each job, the system assesses your suitability, identifies strengths, points out gaps and suggests improvements.
6.2 How automated decision-making and profiling work
The system automatically ranks and filters jobs according to the calculated match with your profile (profiling). This means that certain jobs may not be shown if the algorithm assesses that they do not meet your search criteria.
No result is determined solely by automated decision-making without the possibility of human intervention – all recommendations are informative, and the final decision to apply is always yours.
6.3 Your rights regarding automated decision-making (Article 22 GDPR)
You have the right to:
- request human intervention in the processing of your data;
- express your point of view on the results of automated processing;
- contest decisions based on automated processing.
6.4 Protection against discrimination and bias
Our algorithms do not take into account sensitive categories of data (gender, race, ethnicity, religion, disability, sexual orientation, political opinion). We regularly check and test the results for possible bias.
6.5 Is your data used to train AI models?
No. Your data is never used to train, fine-tune or improve language models. Our external AI service providers operate under strict terms under which they do not store your data and do not use it to train their models.
7. Semantic databases
By using the platform and uploading documents, you understand and agree that:
- The content of your profile and CV is converted into a machine-readable form that is stored securely in our database.
- The sole purpose of this processing is the semantic search and comparison of your knowledge with open jobs in real time.
- When the account is deleted, all this data is irreversibly deleted together with the rest of your personal data.
8. Recipients and processors of data
We share your personal data with the following categories of recipients, or process it with the help of the following processors, with whom we have concluded data processing agreements (DPA – Data Processing Agreement):
| Recipient / processor | Purpose | Data transferred |
|---|---|---|
| Cloud and authentication service provider (Google) | User authentication and profile storage | Email, identifier, profile data, CV metadata |
| Web analytics provider (Google, Microsoft) | Web analytics and user experience analysis (only with consent) | Device data, page visits, sessions, session recordings |
| Artificial intelligence API provider | Automated CV reading, generating advice and analyses | CV and profile content (without storing data for training) |
| EU hosting provider | Hosting the backend server and infrastructure | All data processed on the server |
The text you type into the address search is sent to the public address register of the Surveying and Mapping Authority of the Republic of Slovenia to get address suggestions. No data about you is sent with it.
9. International data transfers
Some of our processors (Google, Microsoft) also have servers outside the European Economic Area (EEA), in particular in the USA. We safeguard data transfers to third countries with the following mechanisms:
- EU–US Data Privacy Framework – for transfers to the USA to companies certified under this programme.
- Standard contractual clauses (SCC) – where the privacy framework is not sufficient, standard contractual clauses approved by the European Commission are concluded.
- Supplementary measures – including encryption of data in transit (TLS/HTTPS) and at rest.
10. Cookies and tracking technologies
10.1 Strictly necessary cookies
These cookies are essential for the platform to work and do not require your consent:
| Name | Purpose | Validity |
|---|---|---|
auth_token | User authentication (JWT ID token) | 7 days |
10.2 Analytics cookies (require consent)
The following services are only activated when you explicitly allow them:
| Service | Purpose | Provider |
|---|---|---|
| Firebase Analytics | Measuring traffic and use of the platform | Google Ireland Limited |
| Microsoft Clarity | Session recordings, heatmaps, click analysis | Microsoft Corporation |
You can withdraw your consent to analytics cookies at any time via the cookie settings on our website or by contacting us by email.
10.3 Local storage (localStorage / sessionStorage)
In addition to cookies, the platform stores data in the browser:
pinia-cv-storage– data from your CV, expires after 24 hours;pinia-job-storage– search preferences (including the chosen address and distance) and browsing history, expires after 24 hours;pinia-dashboard-storage– analyses and recommendations, expires after 24 hours;arsio:emailForSignIn– email address during verification (deleted once completed);arsio:pendingRegistration– registration flag (deleted once completed);app-language– the chosen app language (Slovenian or English), no expiry;
11. Data retention periods
| Data category | Retention period |
|---|---|
| User account (email, name, UID) | For the lifetime of the account + 30 days after deletion |
| CV data and vector representations | For the lifetime of the account; deleted when the account is deleted |
| Search preferences and browsing history | For the lifetime of the account |
| Local storage in the browser | 24 hours (automatic expiry) |
| Authentication cookie | 7 days |
| Firebase Analytics | 14 months (Google Analytics default setting) |
| Microsoft Clarity session recordings | 30 days (Clarity default setting) |
| Server logs | 90 days |
| Inactive accounts without sign-in | Data deleted after 12 months of inactivity (with a warning 30 days in advance) |
12. The "Continue where you left off" feature
The platform offers the option of sending an email link ("magic link") that lets you continue your job search on another device or in another browser. The link encodes the state of your session (chosen industry, region, liked jobs) as a Base64 string in a URL parameter.
- The link is valid for a limited time and is intended for one-time use.
- The encoded content does not contain passwords or other sensitive security data.
- Warning: Anyone with access to your email can access this link.
13. Your rights as an individual
Under the GDPR (Articles 15–22) and ZVOP-2, you have the following rights:
13.1 Right of access (Article 15)
You have the right to obtain confirmation as to whether we process your personal data and, if so, to request a copy of all your data in a structured, machine-readable format.
13.2 Right to rectification (Article 16)
You have the right to request the rectification of inaccurate personal data or the completion of incomplete data. You can correct most profile data directly in the user interface by uploading an updated CV.
13.3 Right to erasure – "Right to be forgotten" (Article 17)
You can at any time request the complete and irreversible erasure of all your personal data, including vector representations, profile data and your CV file. We carry out the erasure as soon as possible and no later than within 30 days.
13.4 Right to restriction of processing (Article 18)
You have the right to request the restriction of the processing of your data, for example if you contest the accuracy of the data or the lawfulness of the processing.
13.5 Right to data portability (Article 20)
You have the right to receive your personal data in a structured, machine-readable format (e.g. JSON, CSV) and to transfer it to another service provider. This includes your profile data, CV data, browsing history and saved analyses.
13.6 Right to object (Article 21)
You have the right to object at any time to the processing of your personal data based on legitimate interest (Article 6(1)(f)). In that case we will stop the processing unless we demonstrate compelling legitimate grounds that override your interests.
13.7 Right to withdraw consent (Article 7(3))
If the processing is based on your consent (e.g. analytics cookies), you have the right to withdraw that consent at any time. The withdrawal does not affect the lawfulness of the processing carried out before the withdrawal.
13.8 Right regarding automated decision-making (Article 22)
See section 6.3 above. You have the right not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you.
If you believe your rights have been violated, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (see section 3).
14. Data security
To protect your personal data, we implement the following technical and organisational measures:
- Encryption in transit and at rest: Data is transmitted over secure connections (SSL/TLS) and stored in encrypted form in line with industry standards.
- Secure password storage: Passwords are stored only in a secure encrypted form; we have no access to plain-text passwords.
- Access control: Access to systems is strictly limited to authorised persons with the appropriate rights.
- Cookie security: Authentication cookies use the appropriate security flags to prevent abuse.
- Data minimisation: We only collect data that is strictly necessary for the service to work.
15. Use by minors
The ARSIO platform is intended for job searching and is therefore not intended for individuals under 16 years of age (in accordance with Article 8 GDPR and ZVOP-2). We do not knowingly collect data from children. If we find that we have collected data from a person under 16, we will delete it immediately.
16. Changes to this privacy policy
We may update this privacy policy from time to time. We will notify you of material changes by email or by a notice in the application at least 30 days before the changes take effect.
The date of the last update is always shown at the top of the document. Continued use of the platform after the changes take effect means that you agree to the updated terms.
17. Contact
For any questions, requests or complaints regarding your personal data, please contact:
- ARSIO SYSTEMS d.o.o.
- Email: info@arsio.hr
- Ulica škofa Maksimilijana Držečnika 6, 2000 Maribor, Slovenia
