Privacy and Personal Data Protection Policy

1. General and data controller

This Privacy Policy explains how ARSIO SYSTEMS d.o.o. (hereinafter: "Controller" or "we") collects, processes, stores, and protects the personal data of Users of the Karierni Asistent web platform, accessible at www.karierni-asistent.si and app.karierni-asistent.si.

Data controller:

• Company: ARSIO SYSTEMS, development of digital solutions and other services, d.o.o.
• Address: Ulica škofa Maksimilijana Držečnika 6, 2000 Maribor, Slovenia
• Registration number: 7342578000
• Tax number: SI14509903
• Email: info@karierni-asistent.si

This Policy applies to all Users: job seekers, employers, recruitment agencies, and visitors. Data processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR) and the Personal Data Protection Act (ZVOP-2).

2. What personal data do we collect?

2.1 Data you provide directly

Job seekers:

• Identification data: name, surname, date of birth
• Contact data: email address, phone number, address
• Professional data: CV, work history, education, skills, certificates
• Profile settings: profile visibility, job search preferences, geographic preference
• Communication content: messages exchanged via the Platform's messaging system

Employers and Agencies:

• Company data: company name, address, industry, description
• Representative data: name, surname, job role, email address, phone
• Listing content: listing text, logos, graphic materials
• Payment data: order and payment details (payment cards are processed by Stripe; the Controller does not store card data)
• Communication content: messages with candidates

2.2 Data collected automatically

• Technical data: IP address, browser type and version, operating system, screen resolution
• Usage data: page views, visit duration, clicks, search queries, referral URL
• Cookie data: in accordance with the Cookie Policy

2.3 Data from third parties

When a User accesses the Platform via LinkedIn or another external service, we receive the data that such a service provides (name, email address, professional profile), in accordance with the privacy settings at the third party.

3. Purposes and legal bases for processing

3.1 Performance of contract — Article 6(1)(b) GDPR

For the provision of Services, we process data for: creating and managing accounts, displaying listings and profiles, processing applications, messaging between Users, processing payments, and providing technical support.

3.2 Legitimate interest — Article 6(1)(f) GDPR

On the basis of legitimate interest, we process data for: preventing fraud and unauthorized access, improving Platform performance, anonymized usage analytics, and enforcing legal claims.

3.3 Consent — Article 6(1)(a) GDPR

On the basis of your voluntary consent, we process data for: sending newsletters about employment opportunities, personalized content display, analytical and marketing cookies, and forwarding CVs to active employers (opt-in feature).

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

3.4 Legal obligation — Article 6(1)(c) GDPR

Where required by law, we process data to fulfill tax, accounting, and other legal obligations.

4. Data retention periods

We retain personal data only for as long as necessary to achieve the purpose:

• Job seekers — active account: for the duration of the contractual relationship + 5 years after the last login
• Job seekers — after account deletion: 30 days from request, then anonymization (except legally required retention)
• Employers — orders and invoices: 10 years (tax and accounting legislation)
• Employers — campaign data: 5 years from last activity
• Messages between Users: 2 years from the last message in the thread
• Application data at the Employer: until the end of the selection process + 1 year (ZDR-1)
• Analytical data (anonymized): unlimited
• Marketing consent: until withdrawal

After the retention period expires, we permanently delete or anonymize the data.

5. Data recipients

5.1 Employers as independent controllers

When a Job Seeker activates their CV or applies for a listing, the Employer becomes the recipient of those personal data that the Job Seeker has not set as hidden. The Employer processes the received data as an independent controller.

5.2 Data processors (contractors)

In accordance with Article 28 GDPR, we have entered into data processing agreements with the following categories of processors:

• hosting and cloud infrastructure provider (servers in the EU),
• Stripe, Inc. — payment processing (EU standard contractual clauses),
• email service provider for transactional and marketing communications,
• web analytics tools (Google Analytics — processing within the EU/EEA),
• advertising network providers (only when marketing cookies are activated).

5.3 Public authorities

We will disclose personal data to competent authorities (police, prosecutor, court, tax authority) when required by applicable law or a court order.

5.4 Transfer of data to third countries

Some processors (e.g. Stripe, Google) are based in the United States of America. Data transfers are based on the European Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) or an adequacy decision.

6. Your rights

In accordance with the GDPR (Articles 15–22), you have the following rights:

Right of access (Art. 15)

You may request confirmation of whether we process your data, and a copy thereof.

Right to rectification (Art. 16)

You may request the correction of inaccurate or completion of incomplete data.

Right to erasure (Art. 17)

You may request the deletion of data when there is no longer a legal basis for processing ("right to be forgotten").

Right to restriction (Art. 18)

In certain cases, you may request the restriction of processing of your data.

Right to data portability (Art. 20)

You may request a transfer of your data in a machine-readable format.

Right to object (Art. 21)

When processing is based on legitimate interest, you have the right to object.

Right to withdraw consent

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

You may exercise your rights in writing at: info@karierni-asistent.si. We will respond to your request within 30 days. For complex requests, we may extend this deadline by an additional 60 days.

If you believe that we are not properly exercising your rights, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Zaloška cesta 59, 1000 Ljubljana, gp.ip@ip-rs.si).

7. Data security

We implement appropriate technical and organizational measures to protect personal data, including:

• data encryption in transit (TLS/SSL) and at rest,
• access controls and two-factor authentication for administrative access,
• regular security audits and system updates,
• access restriction based on the principle of least privilege,
• employee training on data protection.

In the event of a personal data breach, we will notify the Information Commissioner of the Republic of Slovenia within 72 hours of detection. Individuals whose data has been affected will be notified without undue delay.

8. Cookies

The Platform uses cookies to operate and improve services. Detailed information can be found in the separate Cookie Policy.

9. Special aspects of processing

9.1 Minor Users

The Platform is not intended for persons under the age of 16. We do not knowingly collect data about persons under 16. When we discover that we have collected data about a minor without appropriate consent, we delete it immediately.

9.2 Automated decision-making

The Platform does not carry out automated decision-making that would have legal or other significant effects on an individual within the meaning of Article 22 GDPR.

9.3 Social media recruitment campaigns

When an Employer publishes a recruitment campaign on social networks via the Platform, the privacy terms of the respective social networks apply to the processing of personal data of the persons reached. The Platform only passes on to the Employer those data that the candidate has voluntarily completed in the application form.

10. Privacy Policy changes

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 15 days before they take effect. The date of the last update is stated at the top of the document.

11. Contact

For all questions or requests regarding personal data protection:

Email: info@karierni-asistent.si
Post: ARSIO SYSTEMS d.o.o., Ulica škofa Maksimilijana Držečnika 6, 2000 Maribor, Slovenia
Email subject: Personal data protection — [your request]

Maribor, 25 May 2026