Privacy policy for Europe and the UK

This policy explains what personal data VizzBox collects, why, on what legal basis, and what you can do about it. We've tried to write it the way we'd explain it to you in person. It's the version for people in the European Economic Area, the United Kingdom and Switzerland, where the General Data Protection Regulation (GDPR), the UK GDPR or the Swiss Federal Act on Data Protection apply.

It covers our website at vizzbox.com, the VizzBox portal your organisation uses at its own address (for example, yourcafe.vizzbox.com), and the VizzBox player on your screens.

Who is responsible. For visitors to our website and for account holders, VizzBox is the controller of your personal data. For the content an organisation puts on its screens, and for data about its staff that it adds, the organisation is the controller and VizzBox processes that data on its behalf. You can reach us at support@vizzbox.com.

The short version

• We collect what we need to run VizzBox, and we use it for that.
• We don't sell personal data, and we don't use it to show you ads.
• We only measure your visits to our website if you say yes.
• The content an organisation puts on its screens belongs to that organisation.
• You can see, correct, delete or take a copy of your data, and object to how we use it.

When you visit our website

Measuring visits, only with your consent (legal basis: consent). When you first visit vizzbox.com, a banner asks whether we may measure your visit with Google Analytics (through Google Firebase). Nothing is measured, and no analytics cookies are set, unless you say yes. If you do, Google Analytics records things like the pages you look at, roughly where you are (worked out from your IP address), and your device and browser, so we can see which pages are useful. You can withdraw your consent at any time with "Cookie settings" at the bottom of every page. It never runs in organisations' portals or in our staff console, or if your browser sends a "Do Not Track" or "Global Privacy Control" signal.

Prices in your currency and this policy (legal basis: our legitimate interest in showing you the right prices and the right version of this policy). Our server looks up which country your IP address is in, using a database that runs on our own server (from DB-IP). Your address isn't sent anywhere else for this.

Your choices in your browser. The language you pick and your answer to the measurement question are kept in your browser's local storage, so we don't ask again. This storage is needed to remember a choice you made.

Fonts (legitimate interest in a readable site). The site's typefaces come from Google Fonts, so Google receives your IP address when a page loads.

Logs and error reports (legitimate interest in running a secure, working service). Our servers keep short technical logs (IP address, the page requested, browser type), and if something breaks in your browser, the page may send us a report of what went wrong.

The live demo. The demo page plays our own made-up café's screen. Watching it records nothing about you beyond what's described above.

When your organisation uses VizzBox

Your account (legal basis: performing our contract with you or your organisation). Your name, email address, role and preferred language, and your password, which we store only as a secure hash that nobody can read back.

Your organisation (contract). Its name and portal address, the locations and screens you add, and the people you invite.

Your content (we process it on your organisation's behalf). The pictures, videos, PDFs, web page links, designs and schedules you add. They're yours: we store and process them only to show them on your screens.

Your screens (contract). Each player sends us what's needed to manage it: the device model, its Android version or browser, screen size, app version, network status and when it last checked in. It also records what it played and when (proof of play), which you can download as reports. On an Android player, someone in your organisation can ask for a screenshot of what the screen is showing; screenshots are kept with your organisation's data.

Payments (contract, and our legal obligation to keep accounting records). Payment is handled by Stripe, which collects your card details; we never see or store them. We keep a record of your plan, your payment status and your billing country.

Emails (contract). We send the emails the service needs: help signing in, invitations, alerts when a screen goes offline, and billing notices. We don't send marketing emails unless you've agreed to them.

Security and abuse (legitimate interest). We use logs and account data to keep VizzBox secure and to stop misuse.

Who else handles data for us

We use a small number of processors, only to run VizzBox:

• DigitalOcean hosts our servers, where the data above is stored.
• Google measures visits to our website if you agree (Firebase and Google Analytics), sends update notifications to Android players (Firebase Cloud Messaging), and serves our fonts (Google Fonts).
• Stripe handles payments (and Razorpay in India).
• An email delivery service sends the emails described above.

Transfers outside Europe. VizzBox is run from India, and some of these providers process data in the United States and elsewhere. Where data leaves the EEA, the UK or Switzerland, we rely on an adequacy decision where one exists, or on the European Commission's Standard Contractual Clauses (and the UK's addendum to them) offered by the provider. You can ask us for details at support@vizzbox.com.

We give each provider only what it needs to do its part. We may also disclose data where the law requires us to.

Cookies and browser storage

• Strictly necessary: in the portal and during sign-up, a session cookie keeps you signed in and a security cookie protects forms. They don't need your consent because the service can't work without them.
• Your choices: your language and your answer to the measurement question, kept in your browser's local storage.
• Analytics: Google Analytics cookies, on vizzbox.com only, and only after you say yes.

How long we keep it

• Your account and your organisation's data are kept for as long as your organisation uses VizzBox.
• When an organisation is closed, we keep its data for 30 days in case the closure was a mistake, then delete it, apart from records the law requires us to keep, such as invoices and payment records.
• A copy of your data that you ask to download stays available for a week, then it's deleted.
• Backups and server logs are kept for a limited time and then removed.
• If you gave consent to analytics, Google Analytics keeps that data for the retention period set in our Analytics property.

Your rights

You have the right to:

• access the personal data we hold about you and get a copy of it;
• have it corrected if it's wrong or incomplete;
• have it erased where there's no longer a reason to keep it;
• restrict how we use it while a question about it is settled;
• receive it in a portable format, or have it sent to another provider (portability);
• object to our use of it where we rely on legitimate interests;
• withdraw consent at any time, without affecting what was done before.

An organisation's owner can also download a copy of the organisation's data from the portal, and close the organisation there, which deletes its data as described above. If you use VizzBox as a member of an organisation, that organisation decides much of what's stored about you; you can ask them, or us.

Write to support@vizzbox.com. We'll answer within one month, as the law requires. You also have the right to complain to the data protection authority where you live or work: in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.

We don't make decisions about you based solely on automated processing.

Children

VizzBox is a tool for businesses and isn't meant for children. We don't knowingly collect personal data from anyone under 18.

Keeping it safe

Passwords are hashed, the website and the portal only work over encrypted connections, each organisation's data is kept separate from every other organisation's, and only the staff who need it can reach it. No system is perfectly secure, so please use a strong password, and tell us at support@vizzbox.com if you notice anything wrong.

Changes to this policy

When we change this policy we'll update the date at the top, and we'll email account owners about any change that matters to them.

Contact

VizzBox, support@vizzbox.com