Controller: the arethino user, or the organisation the user acts for. Processor: Arethine Institute, Zavod za strateški razvoj organizacij prihodnosti, Brod 25, 8000 Novo mesto, Slovenia; registration number 9845615000; VAT ID SI22181148; .
1. Subject matter and duration
The processor processes personal data on behalf of the controller solely to provide the arethino service, for as long as the controller's account exists and until deletion or return under section 9.
2. Nature and purpose
Storing, structuring, displaying, searching, AI-assisted extraction, public-information search and Copilot assistance on information the controller enters, imports or confirms, in order to prepare professional interactions.
3. Categories of data subjects and data
- Data subjects: attendees, speakers, co-organisers and other business contacts entered by the controller.
- Data: name, job title, organisation, professional description, photograph, business e-mail, business telephone number, the controller's notes and follow-up items, and any information about data subjects that the controller types into the Copilot.
- The controller must not enter special categories of personal data (Art. 9) or criminal-matter data (Art. 10). The AI features are instructed and filtered not to produce them.
4. Documented instructions
The processor processes personal data only on the controller's documented instructions (Art. 28(3)(a)). These instructions are: this Annex, the Terms of Service, and the controller's use of the service's functions (entering, importing, searching, confirming, editing, sharing and deleting data). Additional instructions may be given in writing to . The processor informs the controller immediately if, in its opinion, an instruction infringes data protection law, and processes data outside these instructions only where required by EU or Member State law, informing the controller unless that law prohibits it. The processor does not use the controller's data for its own purposes and does not sell it.
5. Confidentiality
Persons authorised to process the data are bound by confidentiality obligations. Access by the processor's personnel is limited to what is necessary to operate and support the service.
6. Security measures (Art. 32)
- Storage of the database and photographs in the EU (Frankfurt, Germany); encryption in transit (TLS) and at rest by the hosting platform.
- Row-level access rules isolating each account's data; photographs in a private, non-listable store served through short-lived signed links.
- Sign-in by e-mail link or Google; the service stores no passwords.
- Uploaded import files processed in memory and not retained by the service.
- Automated backups by the hosting platform.
7. Sub-processors
The controller gives general written authorisation for the sub-processors below. The processor informs the controller of intended additions or replacements in advance (on the privacy page and, for material changes, by e-mail), giving the controller the opportunity to object. The processor imposes data protection obligations on each sub-processor by contract and remains liable to the controller for their performance.
Stripe is not a sub-processor for People data. It receives only the account holder's e-mail and billing data for paid plans, for which Arethine Institute acts as controller.
Requests to the AI model are sent with store: false, which prevents a stored response object but does not by itself exclude security or abuse logs kept by the gateway or model provider.
8. Assistance to the controller
Taking into account the nature of the processing and the information available, the processor assists the controller:
- with appropriate technical and organisational measures, in responding to data subject requests (Arts. 15–22) — primarily through the in-app functions to view, correct and delete data, and otherwise on request by e-mail;
- in ensuring security of processing, notifying breaches, and carrying out data protection impact assessments and prior consultations (Arts. 32–36).
If a data subject contacts the processor directly, the processor will, where it can identify the controller, forward the request or inform the controller without undue delay and will not respond on the merits without the controller's authorisation, unless required by law.
9. End of service: deletion or return
- At any time, the controller may delete individual interactions, people, notes and photographs in the application. They are removed from the live database and file store immediately.
- Available in the app: a printable view of each interaction's people list.
- Return on request: before deletion, the controller may ask for a copy of its data. Once identity is confirmed, the processor provides a JSON file with all records linked to the account, plus the stored photograph files on request.
- At the end of the service, the controller chooses between (a) return as described above, followed by deletion, and (b) deletion without return. If no instruction is received within a reasonable time after the account is closed, the processor deletes the data.
- Account deletion is currently carried out on request to . The processor responds within one month and normally deletes within 14 days of identity confirmation, unless EU or Member State law requires the data to be kept. Deletion covers the account, all interactions it owns, people, program items, follow-ups, notes, Copilot conversations, photographs, and usage and creation counters. Interactions owned by other users stay intact; only the departing user's membership and contributions are removed.
- Backups kept by the hosting platform may still contain deleted data until they are overwritten in its rotation. No fixed period has been confirmed. The processor does not restore deleted data from backups.
10. Personal data breaches
The processor notifies the controller without undue delay after becoming aware of a personal data breach affecting the controller's data, providing the information available at the time (Art. 33(2)) and supplementing it as it becomes available. The processor aims to send the first notice within 48 hours; this is an internal target, not a statutory deadline.
11. Demonstrating compliance and audits
The processor makes available all information necessary to demonstrate compliance with Art. 28 GDPR and allows for and contributes to audits, including inspections, by the controller or an auditor it mandates. As a rule, audits begin with a review of documentation and, where needed, proceed with on-site or further checks on reasonable prior notice. This does not limit the controller's or a supervisory authority's statutory rights.
12. Controller's responsibilities
The controller is responsible for having a lawful basis, for documenting its legitimate interest assessment where relied on, and for informing data subjects under Art. 13/14 GDPR.