Legal

Privacy Policy

Last update: July 2, 2025

1. Introduction

This Privacy Policy sets out the rules for collecting, processing, and using personal data obtained from users of the Vizzy service (hereinafter: “Service”).

The administrator of personal data collected through the Service is Halo Sp. z o.o., having its registered office at ul. Warszawska 40/2A, 40-008 Katowice, Poland, NIP: NIP number(hereinafter: “Administrator”).

2. Scope of Data Collected

The Administrator collects the following personal data:

  • Data provided during registration: first name, last name, email address, password (stored in encrypted form);
  • Business data: company name, business address, activity category, contact information, NIP (tax ID), REGON;
  • Business location data: exact address, geographic coordinates, service area;
  • Google Maps listing identifier of the business indicated at purchase, together with its publicly available name, address, category, rating and number of reviews;
  • Publicly available reviews of that listing, together with their content, rating and author name as displayed by Google, retained for the purposes of the monitoring service;
  • Information about devices used to access the Service, and the IP address in the form of an irreversible hash;
  • Service usage data: activity logs, preferences, history of activities performed under the plan;
  • Data on the acceptance of the Terms: the version accepted and the date and time of acceptance;
  • Information collected via cookies and similar technologies;
  • Data from public sources: company information available in public registers and social media.

3. Purposes of Data Processing

Personal data is processed for the following purposes:

  • Providing Google Maps positioning optimization and local business visibility services;
  • Analyzing and monitoring business position in Google search results and Google Maps;
  • Optimizing Google Business Profile and other location platforms;
  • Creating reports on optimization effectiveness;
  • Communicating with Users regarding the Service and provided services;
  • Collecting and analyzing location data to improve geographic visibility;
  • Sending commercial and marketing information (with the User’s prior consent);
  • Analyzing and improving the quality of services provided;
  • Fulfilling legal obligations imposed on the Administrator;
  • Pursuing or defending against potential claims.

4. Legal Grounds for Data Processing

The processing of Users’ personal data is based on:

  • User’s consent (Art. 6(1)(a) GDPR);
  • Necessity to perform a contract to which the User is a party (Art. 6(1)(b) GDPR);
  • Legal obligation imposed on the Administrator (Art. 6(1)(c) GDPR);
  • Legitimate interest pursued by the Administrator (Art. 6(1)(f) GDPR).

5. Data Recipients

Users’ personal data may be transferred to the following categories of recipients:

  • Polar Software Inc. (USA), merchant of record: processes the payment, issues the invoice and handles refunds and payment disputes. It receives the email address and the data necessary to complete the transaction;
  • Resend, Inc. (USA): delivery of transactional and service email. It receives the email address and the content of the message;
  • Meta Platforms, Inc. (USA): measurement of the effectiveness of advertising campaigns. Where a User has arrived from an advertisement, information about page views, the initiation of checkout and the completion of a purchase is transmitted, together with identifiers assigned by Meta and the email address in an irreversibly hashed form. Details in section 8;
  • Google LLC (USA): the Service retrieves publicly available information about business listings and reviews from Google Maps. The Administrator does not use the Google Business Profile API and does not transfer the User’s personal data to Google for that purpose;
  • The provider of the server infrastructure on which the Service operates, and providers of accounting and legal services;
  • Entities authorized under the law (e.g., state authorities).

The recipients listed above have their registered offices in the United States, which means that personal data is transferred outside the European Economic Area. Such transfers take place on the basis of an adequacy decision of the European Commission, or on the basis of standard contractual clauses approved by the European Commission, and the Administrator does not transfer more data than is necessary for the given purpose.

The Administrator may transfer personal data to third countries (outside the European Economic Area) only if an adequate level of protection is ensured, in accordance with GDPR requirements.

6. Data Retention Period

Personal data is stored for the following periods:

  • Account data and data on the acceptance of the Terms: for the duration of the Agreement and for 6 years after its end, which corresponds to the period for pursuing and defending claims;
  • Billing data: for the period required by tax law;
  • Cached reviews of the business listing and notifications relating to them: for the duration of the Agreement, and notifications for approximately 30 days;
  • Analytical data on visits and events: for 26 months from the date of collection;
  • Correspondence and complaints: for 3 years from the closure of the matter;
  • Data processed on the basis of consent: until the consent is withdrawn.

7. User Rights

The User has the following rights:

  • The right to access their data;
  • The right to rectify their data;
  • The right to delete their data;
  • The right to restrict data processing;
  • The right to data portability;
  • The right to object to processing;
  • The right to withdraw consent (without affecting the lawfulness of processing carried out based on consent before its withdrawal);
  • The right to lodge a complaint with a supervisory authority (President of the Personal Data Protection Office).

8. Cookie Information

The Service uses the following cookies:

  • Session cookie: keeps the User logged in to the account. Necessary for the operation of the Service;
  • vz_ccy: remembers the currency in which prices are presented. Retained for 180 days;
  • vz_attr: remembers the source from which the User arrived at the Service, so that a purchase can be attributed to the correct campaign. Retained for 90 days;
  • vz_offer: remembers the individual offer page from which the User arrived, for the same purpose. Retained for 30 days;
  • vz_qv: remembers the variant of the presentation shown to the User. Retained for 180 days;
  • Cookies set by Meta Platforms in connection with the measurement of advertising campaigns, where the User has arrived from an advertisement.

Meta Pixel and Conversions API.The Service uses tools provided by Meta Platforms, Inc. to measure the effectiveness of advertising campaigns. Information about a page view, the initiation of checkout and the completion of a purchase is transmitted to Meta both from the browser and from the Administrator’s server. The email address is transmitted solely in an irreversibly hashed form. Meta’s privacy policy is available at: facebook.com/privacy/policy

The User can manage cookie settings in their web browser independently. Disabling certain cookies may affect the functionality of optimization services.

9. Data Security

The Administrator uses appropriate technical and organizational measures to ensure the security of Users’ personal data, including protection against unauthorized or unlawful processing, accidental loss, destruction, or damage.

10. Changes to the Privacy Policy

The Administrator reserves the right to amend this Privacy Policy. Users will be informed of any changes by posting information on the Service’s website.

11. Contact

For matters related to personal data protection, you can contact the Administrator via email at hello@onsonara.com or in writing to: ul. Warszawska 40/2A, 40-008 Katowice, Poland.