At Arvio, we strive to continue developing and improving our services. Collecting and processing personal data makes this easier for us, as it helps us better adapt to the wishes and needs of our users.

Such use also improves your user experience and makes communication with us easier. Protecting your privacy is important to us, so with this information we want to help you understand which of your personal data we collect, why we collect it, how we use it, which processing operations we carry out, and what your rights are and how you can exercise them.

We carefully store and protect your personal data so that unauthorised disclosure of data to unauthorised persons does not occur.

The controller of your personal data is Arvio, finance technologies, d.o.o., Dunajska cesta 51, 1000 Ljubljana (hereinafter Arvio). Your personal data is processed by the Arvio system and by individual employees who need the data for their work.

On what basis do we process your data?

We process your personal data on the following legal bases under Art. 6 of Regulation (EU) 2016/679 (GDPR):

• Performance of a contract (Art. 6(1)(b)): where data processing is necessary to perform the ordered service (AOW report, appraisal, access to the platform).
• Legal obligation (Art. 6(1)(c)): where we are required to process by law (retention of invoices and accounting records under ZDDV-1 and ZDavP-2, obligations under ZGD-1).
• Legitimate interest (Art. 6(1)(f)): for communication with business clients and partners, handling enquiries and developing services. When processing on this basis, for each purpose we carry out and document a legitimate-interest assessment (three-step test: purpose, necessity, balancing against the expectations and rights of individuals).
• Consent (Art. 6(1)(a)): for sending promotional messages to natural persons. You may withdraw your consent at any time. Direct marketing by email generally requires prior consent (ZEKom-2), with an exception for marketing our own similar products or services to existing customers who have a simple option to unsubscribe in every message.

When may we process your personal data?

Giving consent for the processing of personal data is voluntary. If you decide not to give it or to withdraw it, this does not diminish your rights arising from your subscription contract.

If you decide not to give consent for the purposes listed below, or withdraw it, we will only inform you in cases where this is necessary to provide services under the contract. You may withdraw or restrict your consent at any time, which will not affect the contractual relationship with us or the use of those services for which the processing of this personal data is not necessary.

At Arvio we will process your personal data if you conclude a service contract with us, where this is necessary to provide the service. We will thus inform you about service details, news, instructions for use and the like.

At Arvio we also process personal data in order to maintain a current market offering, thereby meeting your expectations regarding services. In doing so we balance your privacy rights and our interests. We process data in cases where we prevent or investigate fraud, develop our offering, run marketing campaigns, conduct market research and prepare analyses for business decisions.

We will disclose your personal data to public authorities only where required by law. Arvio will, for example, respond to requests from a court or law-enforcement authorities.

How do we collect your personal data and which types of data do we process?

At Arvio we obtain personal data of individuals in cases where they provide it to us themselves and through your use of our services.

We also use information from publicly available sources. We process all collected data only for the provision of services and the improvement of their quality.

We collect basic identification and contact data. Such data includes name and surname, mobile phone and email address. This data is necessary for access to the Arvio Platform or for notifications about news and analyses. For the smooth operation of the Arvio Platform we monitor traffic data, which is kept for 30 days.

To improve the services we offer our users, we also use contact data for surveys, questionnaires and testing. Occasionally we ask customers, for example, how they like the tools and what changes they would want.

We collect information about your use of the Arvio Platform services for the purpose of meeting contractual and legal obligations.

In developing our business we also use social networks, such as LinkedIn and Facebook. We do not store data from your profiles and do not use it for targeted marketing of our services.

Data from public records

When preparing a real-estate appraisal we process data from publicly available records, including the Land Register (ZK) and the Surveying and Mapping Authority of the Republic of Slovenia (GURS/ETN). This data may include personal data of property owners who are not users of the service. We carry out such processing on the basis of legitimate interest (Art. 6(1)(f) GDPR), which is to provide an accurate and reliable real-estate appraisal, whereby we carry out and document a legitimate-interest assessment. Personal data from these records is not disclosed to third parties and is not retained after the appraisal is prepared (it is used only as a basis for an individual appraisal).

Because data from public records is used only as a basis for preparing an individual appraisal and is deleted after processing, we do not notify owners individually – we rely on the disproportionate-effort exception (Art. 14(5)(b) GDPR) and fulfil the transparency obligation by publishing this section. The source of the data is the public records ZK and GURS/ETN, the legal basis is legitimate interest (Art. 6(1)(f)), and the data is deleted after the appraisal is prepared. In respect of this data you may exercise your rights (including objection) and lodge a complaint with the Information Commissioner of the Republic of Slovenia.

The fact that data is publicly available does not mean it is exempt from the GDPR: every (re)processing remains subject to a lawful basis, purpose limitation, data minimisation, security and transparency.

Who may use the personal data you have provided to Arvio?

Your personal data may be used by systems and employees as well as our processors.

We may disclose your personal data to the following categories of processors acting on our instructions and in accordance with a data-processing agreement (Art. 28 GDPR):

• payment-service providers (Stripe Payments Europe, Ltd.) for payment processing;
• email-service providers (Google Workspace, Mailjet/Sinch) for communication and notifications;
• providers of hosting and the platform’s technical infrastructure (DigitalOcean, Hetzner Online GmbH).

All our processors are established in the European Union or ensure an appropriate level of protection in accordance with the GDPR. For any transfers to third countries we rely on the EU-US Data Privacy Framework (for certified recipients such as Google and Stripe) and/or on standard contractual clauses (SCC). For card payments, Stripe acts for part of the processing (fraud prevention, regulatory obligations) as an independent or joint controller, not only as our processor.

How do we process your personal data?

We process your personal data manually or by machine, i.e. automatically.

To prepare a real-estate appraisal we use automated processes that process property data from public records (ZK, GURS/ETN). To the extent that this data is connected to an identified or identifiable natural person, such processing may constitute profiling within the meaning of Art. 4(4) GDPR. The appraisal itself, however, does not constitute automated decision-making that would have legal effects or similarly significantly affect an individual within the meaning of Art. 22 GDPR, as it is only one of the inputs in a decision made by a risk manager, bank or other decision-maker. The appraisal is informative and does not replace the decision of that decision-maker.

How long do we keep your personal data?

We keep your personal data only as long as necessary to achieve the purpose of processing or as required by law. Data collected to perform the service is kept for the duration of the contractual relationship and, after its termination, for the duration of the applicable limitation periods for any claims. We keep invoices and accounting records for 10 years after the end of the year to which they relate (ZDDV-1, Art. 86(5)), and invoices relating to real estate for 20 years (ZDDV-1, Art. 86(6)). Data collected on the basis of consent is kept until consent is withdrawn or until the purpose is fulfilled, whichever occurs first. Data collected on the basis of legitimate interest is kept until objection or until the interest ceases.

What are your rights regarding your personal data?

Regarding your personal data you have the following rights:

• Right of access (Art. 15): you can access your personal data by exercising the right of access.
• Right to rectification (Art. 16): if you find that your personal data is incorrect, you have the right to have it corrected.
• Right to erasure (Art. 17): under the conditions set out in the GDPR you may request the erasure of your personal data.
• Right to data portability (Art. 20): you have the right to transfer your data to another controller.
• Right to restriction of processing (Art. 18): you may request that we temporarily restrict the processing of your data, e.g. while we verify the accuracy of the data or handle your objection.
• Right to object (Art. 21): where we process your data on the basis of legitimate interest, you have the right to object. In the case of direct marketing the objection is absolute.
• Right to withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time; withdrawal does not affect the lawfulness of processing prior to withdrawal.
• Right to lodge a complaint with a supervisory authority (Art. 77): you may lodge a complaint with the Information Commissioner of the Republic of Slovenia (IP RS), Dunajska cesta 22, 1000 Ljubljana.

You may request changes, corrections, transfers and erasure of personal data by written request to info@arvio.si. We will respond to your request within one month at the latest.

Cookie notice

Our website uses cookies. We load optional (e.g. analytics) cookies only after your explicit consent via the consent banner on your first visit, and you can change your choice at any time. To learn more about which cookies we use and how to manage consent, read our Cookie Policy.

Contact for questions about personal data protection

For questions regarding the protection of personal data, please contact: info@arvio.si, marked »Data protection«.

We have not appointed a Data Protection Officer (DPO), as we are not required to do so under Art. 37 GDPR and ZVOP-2. The contact point info@arvio.si satisfies the transparency obligation under Art. 13-14 GDPR.

In a rapidly changing world, the circumstances affecting our processes occasionally change too. For this reason we reserve the right to amend this General Information.

For anything not specifically defined by this General Information or by our contract, the provisions of the law apply.

We last updated this General Information in June 2026. The previous version of the document is available on request.