Privacy policy

1. Who we are

The controller of your personal data is:

• ARSIO SYSTEMS d.o.o.
• Address: Ulica škofa Maksimilijana Držečnika 6, 2000 Maribor, Slovenia
• Registration number: 7342578000, VAT identification number: SI14509903
• Email for privacy questions: privacy@arsio.hr
• We have not designated a data protection officer, because our core activities do not consist of regular and systematic monitoring of individuals on a large scale or of processing on a large scale of special categories of personal data (Article 37 GDPR). For privacy questions, please write to the address above.

The ARSIO service (formerly Karierni Asistent) is available on the websites arsio.co, arsio.hr and karierni-asistent.si and in the app at app.arsio.co. In this policy, "we" means the controller and "you" means the person whose data we process.

2. Who this policy applies to

• Visitors to the websites arsio.co, arsio.hr and karierni-asistent.si.
• Guests who start the onboarding questionnaire or upload a CV before creating an account.
• Candidates with an account in the app, including subscribers to the Plus package.
• Company users on the company portal and persons who sign up on behalf of a company for a demo.

3. What data we process

3.1 Data you give us

• Account: email address, first name and surname; when signing in with Google, also the data Google provides (name, email address). We do not store a password: you sign in with a link sent by email or with Google.
• Curriculum vitae (CV): the uploaded file and the data we extract from it: name, telephone, place of residence, date of birth, summary, work experience, education, skills, languages, achievements. You can also build your CV manually.
• Profile: driving licence, means of commuting to work, answers to profile questions, up to four photographs (portrait, work, diploma, certificate), the chosen CV template. We store photographs as JPEG without metadata (including without GPS).
• Onboarding questionnaire: search goal, urgency, obstacles, how difficult the search has been, preferred fields and level of responsibility, current and desired net salary, country of search.
• Search: home address or place with a point on the map, up to 10 saved addresses, maximum distance, work arrangement (on site, remote, hybrid), working hours, countries of search.
• Agent: messages you write to the agent, answers to its questions, the text of attachments you send (we do not store the original file), voice recordings for dictation (we do not store the recording, only the transcript), interview practice and your answers, style preferences for letters.
• Payments: the selected package and subscription status. You enter your card details directly with the provider Stripe; we neither see nor store them.
• Feedback: ratings, comments and emails you send us.
• Companies: the representative's name, email address, telephone and role, company details, answers about hiring volume and the selected package, job ads, logo and photograph of the contact person.

3.2 Data generated through use

• Swiping and applications: job ads viewed and liked, time of the like, application status (draft, sent, interview, offer, rejected), interview date, number of ads viewed and of sessions.
• Match results: match score with a job ad, strong matches, gaps and suggestions for improving the CV, documents prepared by the agent (tailored CV, cover letter, email to the employer).
• Usage: number of messages to the agent, analyses and dictations per day, artificial intelligence usage.
• Email: which messages we have sent you and, for notifications, whether you opened them and clicked.
• Visit source: ad link parameters (utm_*, fbclid, gclid), landing page, referring domain and time; with consent, also the Google Analytics and Meta identifiers (_fbp, _fbc). Details in the Cookie Policy.
• Technical data: IP address, browser and device type, time of requests, errors. We also use the IP address to determine your approximate country, so that we can show you the website in the right language.
• Invitations: your invitation code, the number of shares and of new accounts created with this code, the code with which you registered.

3.3 Sensitive data

We do not ask for data concerning health, religious beliefs, ethnic origin, trade union membership or sexual orientation. If such data is in your CV or an attachment, we process it only as part of the text you uploaded, for the purpose for which you uploaded it. We recommend that you remove it from your CV. We store gender only if it is evident from your CV or if you ask the agent to write in a particular grammatical gender; we use it exclusively for the grammar of texts, not for matching.

4. Purposes and legal bases

Where we rely on legitimate interest, we have balanced it against your interests. A summary of the balancing test is available on request. You can withdraw consent at any time in the cookie settings, in the app's Settings or by email; withdrawal does not affect processing carried out before it.

5. Artificial intelligence and profiling

5.1 What the system does

• CV reading: a language model extracts data for the profile from the file. If the file is not a CV, we reject it and do not store it.
• Matching: we convert the profile into a vector (a numerical representation of the content) and compare it with job ads. A language model then ranks the ads by how well they fit your summary, skills and level of experience. Ads below the match threshold are not shown or are shown later.
• Job ad analysis: for a selected ad, the model assesses the match and shows strengths and gaps. The score is calculated from the model's findings by a fixed formula.
• Agent: a conversational assistant that is an artificial intelligence program, not a person. It searches for job ads, prepares a tailored CV, letter and email, corrects your profile with your confirmation, practises interviews and looks up public information about companies.

5.2 What the system does not do

• It does not decide on your employment and has no legal or similarly significant effect on you within the meaning of Article 22 GDPR: it ranks the job ads you see, the decision to apply is yours and the hiring decision is the employer's.
• It does not send applications on your behalf. You review the agent's documents and send them yourself.
• It does not show interview practice results to companies and does not use them for matching.
• We do not use your data to train our own models. Under contract, the language model providers we use do not use it for training; OpenAI does not retain it after processing.

5.3 Your options

If you believe the system is not showing you the right job ads, you can change your profile, filters and fields, and you can also search for ads yourself. You may at any time request an explanation of how the match score was arrived at and a review by a human. You can object to profiling for the purposes of section 6 by switching off "Open to offers".

6. What companies see

Companies that use the ARSIO portal may see you in four ways:

1. When you like or apply to their job ad. The company sees you among interested candidates with your name, email address, the place you selected (not the street and not the point on the map), most recent employment, summary, skills, languages, experience and education, together with the time of the like or application. It does not see your telephone number, date of birth, photographs or CV file. The company does not see how you are progressing on the My Jobs board.
2. In candidate search (headhunting), if you are "Open to offers". The system compares your profile with the company's job ad and may suggest you to it. In that case, the company does not see your surname, email address or the names of your employers, and does not receive your contact details.
3. When we send your profile. From time to time, we may send your profile to a company looking for candidates with your knowledge and experience, but only if you have "Open to offers" switched on and both you and the company agree to this for that company.
4. In the preview for companies interested in the portal: only the number and a blurred summary of matching candidates, without identity.

The "Open to offers" setting is switched on by default; you can switch it off in Settings. Switching it off hides you from candidate search, but does not hide likes and applications you have already submitted. The company where you are currently employed never sees you in search. With the Plus package, you can hide yourself from up to 20 selected companies. Once you request deletion of your account, companies no longer see you anywhere.

A company processes the data it sees on the portal as an independent controller and is solely responsible for that processing.

7. Recipients and processors

We have contracts under Article 28 GDPR with the providers that process data on our behalf.

7.1 Meta and Google as advertising platforms

If you consent to advertising cookies, Meta Platforms Ireland Ltd. receives, via the pixel and from our server, information about registration and purchase of Plus, together with a hashed email address, the account identifier, the IP address, the browser type and the _fbp/_fbc cookies; Google Analytics receives information about registration. For the collection of data via the pixel, we and Meta are joint controllers; Meta is responsible for further processing in accordance with its own privacy policy.

7.2 Other recipients

• Companies on the portal - section 6.
• Public authorities, where required by law or a court decision.
• A legal successor in the event of a sale or merger of the company, with prior notice.

We do not sell your data.

8. Transfers outside the EU

Where a provider processes data outside the European Economic Area, the transfer is based on an adequacy decision (for certified companies in the USA, the EU-U.S. Data Privacy Framework) or on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) with supplementary measures such as encryption in transit. A copy of the safeguards is available on request.

9. How long we keep data

Upon deletion, we erase the data from the database, file storage and the vector search engine. The Plus subscription no longer renews once deletion is requested.

10. Your rights

• Access (Article 15): confirmation as to whether we process your data, and a copy.
• Rectification (Article 16): you can correct most data yourself in your Profile.
• Erasure (Article 17): in Settings, select "Delete account" or write to us. From the request onwards, companies no longer see you; you can revoke it within 30 days, after which we automatically and permanently erase your data.
• Restriction (Article 18) of processing in the cases provided for by law.
• Data portability (Article 20): we send you the data you have provided to us in a machine-readable format (JSON) within one month of the request.
• Objection (Article 21) to processing based on legitimate interest, including profiling for the purposes of section 6. You can always object to direct marketing.
• Withdrawal of consent at any time, without affecting prior processing.
• Rights in relation to automated decision-making (Article 22): explanation, human review, expressing your point of view.

Send your request to privacy@arsio.hr from the email address you use for your account, so that we can identify you. We respond within one month; for complex requests, this period may be extended by two months, in which case we will inform you.

You can lodge a complaint with the supervisory authority: Informacijski pooblaščenec Republike Slovenije (Information Commissioner of the Republic of Slovenia), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si, or with the authority of the country in which you live or work.

11. Security

We encrypt data in transit and at rest. Only employees who need access for their work have access to the data, and administrative access is protected by two-factor authentication. We do not publish CVs or photographs on public links. In the event of a personal data breach that puts your rights at risk, we notify the Informacijski pooblaščenec within 72 hours, and you without undue delay.

12. Minors, changes, contact

The service is intended for persons aged at least 16. If we find that an account was created by a younger person, we delete it.

We update this policy when the processing changes. We notify you of material changes by email or in the app at least 15 days before they take effect. Previous versions are available on request.

Questions: privacy@arsio.hr, post: ARSIO SYSTEMS d.o.o., Ulica škofa Maksimilijana Držečnika 6, 2000 Maribor, subject "Varstvo osebnih podatkov" (Personal data protection).

See also: Terms and Conditions, Cookie Policy.