> Arlo and the GDPR: New Zealand adequacy, attendee data, registration widget cookies, contract as legal basis and how to use Arlo lawfully in Europe. > > Canonical: https://www.flowconsent.com/en/services/other/arlo Other # Arlo Unclassified · [Official website](https://www.arlo.co) Arlo is a New Zealand-based training management and course registration platform used by training organisations, professional associations, and corporate learning teams. New Zealand has an EU adequacy decision, making it one of the most GDPR-compliant non-EU options. Attendee registration data is processed on the basis of contract performance. Cookies from the embedded registration widget require ePrivacy consent. [Block Arlo until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Unclassified - Prior consent Required - Documented cookies 1 - Third-party domains 3 - Servers New Zealand (Arlo is a New Zealand company with infrastructure in New Zealand and Australia) Overview ## What does Arlo do? ## **What is Arlo?** Arlo is a New Zealand-based training management system (TMS) used by training providers, professional associations, and corporate learning and development teams to manage course catalogues, handle registrations, process payments, and send automated communications to attendees. It provides an embeddable registration widget that can be added to any website, as well as a hosted training website. Arlo handles the full training lifecycle from registration through to post-course evaluation. ## **What data does Arlo collect?** Arlo collects attendee name, email address, phone number, organisation, job title, training preferences, payment information, and attendance records. It also collects IP addresses and browser information from the registration widget. Post-course, it may send evaluation surveys and training completion certificates. All attendee records are linked to the individual's profile in the Arlo system. ## **GDPR and New Zealand adequacy** New Zealand received an EU adequacy decision in 2013, meaning transfers of EU personal data to New Zealand-based processing are permitted without additional safeguards. This makes Arlo one of the most GDPR-compliant non-EU training management platforms available. The primary GDPR obligations for Arlo users relate to the lawful basis for processing (contract performance for registrations), transparency (privacy notice at point of registration), and data subject rights. ## **Consent and legal basis** Contract performance covers the processing of attendee registration data necessary to fulfil the training enrollment. Consent is required for non-essential cookies from the registration widget. For marketing emails after a training (additional courses, newsletters), a separate marketing consent must be obtained. Special category data (disability, dietary requirements) requires explicit consent. ## **Practical compliance steps** Include a privacy notice on the registration page. Obtain ePrivacy consent for widget cookies. Sign a DPA with Arlo. Obtain separate marketing consent for post-training communications. Update your privacy policy noting New Zealand adequacy. Document the processing in your RoPA. Compliance ## Arlo and the GDPR Arlo is classified as “Unclassified”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Contract performance (Art. 6(1)(b)) for processing attendee registration data necessary to fulfil training enrollment. Consent (Art. 6(1)(a)) for non-essential tracking cookies from the registration widget. - Risk level low - Applicable regulations GDPR, ePrivacy Directive, UK GDPR, New Zealand Privacy Act 2020 ### Impact assessment (DPIA) A DPIA is generally not required for standard training registration use cases given the New Zealand adequacy decision. It becomes advisable when training data includes health, disability, or other special category information, or when large-scale attendee profiling for marketing is implemented. ### Sample text for your banner > This registration form is powered by Arlo (New Zealand). To register for this training, Arlo will collect your name, email address, and organisation details. Data is processed in New Zealand, which has an EU adequacy decision. See our privacy policy for full details. Cookies and trackers ## What Arlo sets and contacts - Tracking method JavaScript training registration widget, first-party cookies, server-side training and attendee data processing - Server location New Zealand (Arlo is a New Zealand company with infrastructure in New Zealand and Australia) - Data transferred outside the EU Arlo is a New Zealand company. New Zealand has an EU adequacy decision under GDPR (since 2013). However, infrastructure in Australia may also be used. Australia does not have an EU adequacy decision, requiring Standard Contractual Clauses for any Australian-hosted data. ### Cookies set (1) | Name | Type | Duration | Purpose | | ------------- | ------- | -------- | ------------------------------------------------------------------------------ | | arlo\_session | session | Session | Session identifier used to maintain the active Arlo training registration flow | ### Third-party domains contacted (3) - `arlo.co` - `app.arlo.co` - `api.arlo.co` Questions ## Frequently asked questions about Arlo Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What data does Arlo collect for training registrations? Arlo collects attendee name, email address, phone number, organisation, job title, training preferences, payment information, and attendance records. Post-course, it may collect evaluation survey responses. IP addresses and browser information are also collected via the registration widget. ### Does Arlo require a GDPR consent banner? For registration data, no separate consent is required as contract performance covers the processing. EPrivacy consent is required for non-essential cookies from the registration widget. Attendees must receive a privacy notice before registering identifying Arlo as a processor with New Zealand data storage. ### What is the legal basis for using Arlo? Contract performance (Art. 6(1)(b)) for processing attendee registration data necessary to fulfil the training enrollment. Consent for marketing communications about additional courses. Explicit consent (Art. 9(2)(a)) for special category data such as dietary requirements or disability information collected during registration. ### Does Arlo transfer data outside the EU? Arlo is a New Zealand company. New Zealand has an EU adequacy decision since 2013, meaning transfers to New Zealand-based processing require no additional safeguard. If Arlo uses Australian infrastructure, Australia does not have an EU adequacy decision and SCCs would apply for that component. ### Do I need a DPIA for Arlo? Generally not for standard training registration. A DPIA becomes advisable if Arlo is used for training that collects health or disability data, if automated decisions are made about training eligibility, or if large-scale profiling of training attendance is implemented for HR purposes. ### How do I implement Arlo in a GDPR-compliant way? Include a privacy notice on the registration page identifying Arlo and noting New Zealand adequacy. Obtain ePrivacy consent for widget cookies. Sign a DPA with Arlo. Obtain separate marketing consent for post-training communications. Document the processing in your RoPA. ### Why is Arlo's New Zealand location advantageous for GDPR? New Zealand has an EU adequacy decision, meaning transfers of EU personal data to New Zealand require no SCCs, adequacy assessments, or Transfer Impact Assessments. This eliminates the primary transfer compliance burden associated with US-based training platforms. It is one of only a handful of non-EU countries with full EU adequacy. ### How do I update my privacy policy for Arlo training registrations? Add a section on training registration data. Describe Arlo as a processor used for course registration and attendee management, list data collected, state the contract performance legal basis, note New Zealand data storage and the EU adequacy decision, and describe how attendees can access or delete their registration data. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [CareCloud](https://www.flowconsent.com/en/services/other/carecloud) [CareCloud is a digital marketing technology that helps businesses reach, engage, and convert their target audience online. It provides advanced targeting, campaign management, and performance analytics capabilities. CareCloud enables marketers to deliver personalized experiences across channels, optimize campaign ROI, and gain actionable insights into customer behavior. With automation features and data-driven optimization, CareCloud empowers marketing teams to achieve measurable growth.](https://www.flowconsent.com/en/services/other/carecloud) [Marketing](https://www.flowconsent.com/en/services/other/carecloud) · ### [Atlassian Statuspage](https://www.flowconsent.com/en/services/other/atlassian-statuspage) [Atlassian Statuspage is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Atlassian Statuspage integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Atlassian Statuspage helps organizations maintain robust websites that meet user.](https://www.flowconsent.com/en/services/other/atlassian-statuspage) [Other](https://www.flowconsent.com/en/services/other/atlassian-statuspage) · ### [Paradox](https://www.flowconsent.com/en/services/other/paradox) [Paradox is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Paradox integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Paradox makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/other/paradox) [Preferences](https://www.flowconsent.com/en/services/other/paradox) · ### [AccessiBe](https://www.flowconsent.com/en/services/other/accessibe) [AccessiBe is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. AccessiBe integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, AccessiBe helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/accessibe) [Other](https://www.flowconsent.com/en/services/other/accessibe) · ### [SmartRecruiters](https://www.flowconsent.com/en/services/other/smartrecruiters) [SmartRecruiters is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. SmartRecruiters supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, SmartRecruiters ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/smartrecruiters) [Preferences](https://www.flowconsent.com/en/services/other/smartrecruiters) · ### [Imagely NextGEN Gallery](https://www.flowconsent.com/en/services/other/imagely-nextgen-gallery) [Imagely NextGEN Gallery is an image management and optimization solution that helps websites deliver high-quality visual content with optimal performance. It provides automatic compression, format conversion, and responsive delivery for fast page loads. Imagely NextGEN Gallery supports lazy loading, CDN distribution, and gallery creation, enabling businesses to showcase visuals beautifully while maintaining excellent Core Web Vitals scores and search engine rankings.](https://www.flowconsent.com/en/services/other/imagely-nextgen-gallery) [Analytics](https://www.flowconsent.com/en/services/other/imagely-nextgen-gallery) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)