FlowConsent
How it worksPricingComparisonsBlogDocumentationLog inTry FlowConsent
Try FlowConsent
Other

Arlo

UnclassifiedOfficial website

Arlo is a New Zealand-based training management and course registration platform used by training organisations, professional associations, and corporate learning teams. New Zealand has an EU adequacy decision, making it one of the most GDPR-compliant non-EU options. Attendee registration data is processed on the basis of contract performance. Cookies from the embedded registration widget require ePrivacy consent.

Block Arlo until consentScan my site
Overview

What does Arlo do?

What is Arlo?

Arlo is a New Zealand-based training management system (TMS) used by training providers, professional associations, and corporate learning and development teams to manage course catalogues, handle registrations, process payments, and send automated communications to attendees. It provides an embeddable registration widget that can be added to any website, as well as a hosted training website. Arlo handles the full training lifecycle from registration through to post-course evaluation.

What data does Arlo collect?

Arlo collects attendee name, email address, phone number, organisation, job title, training preferences, payment information, and attendance records. It also collects IP addresses and browser information from the registration widget. Post-course, it may send evaluation surveys and training completion certificates. All attendee records are linked to the individual's profile in the Arlo system.

GDPR and New Zealand adequacy

New Zealand received an EU adequacy decision in 2013, meaning transfers of EU personal data to New Zealand-based processing are permitted without additional safeguards. This makes Arlo one of the most GDPR-compliant non-EU training management platforms available. The primary GDPR obligations for Arlo users relate to the lawful basis for processing (contract performance for registrations), transparency (privacy notice at point of registration), and data subject rights.

Consent and legal basis

Contract performance covers the processing of attendee registration data necessary to fulfil the training enrollment. Consent is required for non-essential cookies from the registration widget. For marketing emails after a training (additional courses, newsletters), a separate marketing consent must be obtained. Special category data (disability, dietary requirements) requires explicit consent.

Practical compliance steps

Include a privacy notice on the registration page. Obtain ePrivacy consent for widget cookies. Sign a DPA with Arlo. Obtain separate marketing consent for post-training communications. Update your privacy policy noting New Zealand adequacy. Document the processing in your RoPA.

Compliance

Arlo and the GDPR

Arlo is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy.

Legal basis
Contract performance (Art. 6(1)(b)) for processing attendee registration data necessary to fulfil training enrollment. Consent (Art. 6(1)(a)) for non-essential tracking cookies from the registration widget.
Risk level
low
Applicable regulations
GDPR, ePrivacy Directive, UK GDPR, New Zealand Privacy Act 2020

Impact assessment (DPIA)

A DPIA is generally not required for standard training registration use cases given the New Zealand adequacy decision. It becomes advisable when training data includes health, disability, or other special category information, or when large-scale attendee profiling for marketing is implemented.

Sample text for your banner

This registration form is powered by Arlo (New Zealand). To register for this training, Arlo will collect your name, email address, and organisation details. Data is processed in New Zealand, which has an EU adequacy decision. See our privacy policy for full details.
Cookies and trackers

What Arlo sets and contacts

Tracking method
JavaScript training registration widget, first-party cookies, server-side training and attendee data processing
Server location
New Zealand (Arlo is a New Zealand company with infrastructure in New Zealand and Australia)
Data transferred outside the EU
Arlo is a New Zealand company. New Zealand has an EU adequacy decision under GDPR (since 2013). However, infrastructure in Australia may also be used. Australia does not have an EU adequacy decision, requiring Standard Contractual Clauses for any Australian-hosted data.

Cookies set (1)

NameTypeDurationPurpose
arlo_sessionsessionSessionSession identifier used to maintain the active Arlo training registration flow

Third-party domains contacted (3)

  • arlo.co
  • app.arlo.co
  • api.arlo.co
Questions

Frequently asked questions about Arlo

Can't find your question? Write to us, we answer fast.

What data does Arlo collect for training registrations?

Arlo collects attendee name, email address, phone number, organisation, job title, training preferences, payment information, and attendance records. Post-course, it may collect evaluation survey responses. IP addresses and browser information are also collected via the registration widget.

Does Arlo require a GDPR consent banner?

For registration data, no separate consent is required as contract performance covers the processing. EPrivacy consent is required for non-essential cookies from the registration widget. Attendees must receive a privacy notice before registering identifying Arlo as a processor with New Zealand data storage.

What is the legal basis for using Arlo?

Contract performance (Art. 6(1)(b)) for processing attendee registration data necessary to fulfil the training enrollment. Consent for marketing communications about additional courses. Explicit consent (Art. 9(2)(a)) for special category data such as dietary requirements or disability information collected during registration.

Does Arlo transfer data outside the EU?

Arlo is a New Zealand company. New Zealand has an EU adequacy decision since 2013, meaning transfers to New Zealand-based processing require no additional safeguard. If Arlo uses Australian infrastructure, Australia does not have an EU adequacy decision and SCCs would apply for that component.

Do I need a DPIA for Arlo?

Generally not for standard training registration. A DPIA becomes advisable if Arlo is used for training that collects health or disability data, if automated decisions are made about training eligibility, or if large-scale profiling of training attendance is implemented for HR purposes.

How do I implement Arlo in a GDPR-compliant way?

Include a privacy notice on the registration page identifying Arlo and noting New Zealand adequacy. Obtain ePrivacy consent for widget cookies. Sign a DPA with Arlo. Obtain separate marketing consent for post-training communications. Document the processing in your RoPA.

Why is Arlo's New Zealand location advantageous for GDPR?

New Zealand has an EU adequacy decision, meaning transfers of EU personal data to New Zealand require no SCCs, adequacy assessments, or Transfer Impact Assessments. This eliminates the primary transfer compliance burden associated with US-based training platforms. It is one of only a handful of non-EU countries with full EU adequacy.

How do I update my privacy policy for Arlo training registrations?

Add a section on training registration data. Describe Arlo as a processor used for course registration and attendee management, list data collected, state the contract performance legal basis, note New Zealand data storage and the EU adequacy decision, and describe how attendees can access or delete their registration data.

Same category

More services: Other

See the whole category

CareCloud

CareCloud is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. CareCloud enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, CareCloud empowers marketing teams to achieve measurable growth.

Marketing

Atlassian Statuspage

Atlassian Statuspage is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Atlassian Statuspage integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Atlassian Statuspage helps organizations maintain robust websites that meet user.

Other

Paradox

Paradox is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Paradox integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Paradox makes advanced AI accessible to all teams.

Preferences

AccessiBe

AccessiBe is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. AccessiBe integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, AccessiBe helps organizations maintain robust websites that meet user expectations and technical requirements.

Other

SmartRecruiters

SmartRecruiters is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. SmartRecruiters supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, SmartRecruiters ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.

Preferences

Imagely NextGEN Gallery

Imagely NextGEN Gallery is an image management and optimization solution that helps websites deliver high-quality visual content with optimal performance. It provides automatic compression, format conversion, and responsive delivery for fast page loads. Imagely NextGEN Gallery supports lazy loading, CDN distribution, and gallery creation, enabling businesses to showcase visuals beautifully while maintaining excellent Core Web Vitals scores and search engine rankings.

Analytics

Make your site compliant today.

Free up to 25,000 sessions a month. No credit card, no commitment.

Create my bannerScan my site