Privacy Policy

Last updated: 23 July 2026

1. Controller

The controller responsible for the processing of personal data described in this Privacy Policy is:

VZUAL GmbH
Lieblgasse 20,
Vienna, Austria

Company registration number: FN 677829 h
Commercial Court: VIENNA
Email: info@vzual.com

Hereinafter referred to as “VZUAL”, “we”, “us” or “our”.

This Privacy Policy applies to:

• the VZUAL website;
• the VZUAL software platform and associated user accounts;
• demo requests, enquiries and contact forms;
• subscriptions and contractual relationships;
• newsletters and marketing communications;
• the VZUAL LinkedIn Page;
• LinkedIn advertisements and Lead Gen Forms;
• related sales, support and customer communication.

2. Applicable law

We process personal data in accordance with the General Data Protection Regulation, Regulation (EU) 2016/679 (“GDPR”), the Austrian Data Protection Act (“DSG”), the Austrian Telecommunications Act 2021 (“TKG 2021”) and other applicable data-protection laws.

3. Personal data we process

Depending on how you interact with VZUAL, we may process the following categories of personal data:

Contact and identification data

This may include:

• first and last name;
• business email address;
• telephone number;
• postal or business address;
• LinkedIn profile information;
• preferred language;
• other information you provide when contacting us.

Professional and company information

This may include:

• company name;
• job title;
• department;
• industry;
• company size;
• country or business location;
• information about your business requirements.

Account and subscription data

When you register for or use VZUAL, we may process:

• account name and user identification;
• email address;
• company affiliation;
• login and authentication information;
• assigned roles and permissions;
• subscription plan;
• licence information;
• contract and billing information;
• account settings;
• support requests;
• communication history.

Passwords are stored only in protected or cryptographically secured form where technically applicable.

Usage and technical data

When you access our website or platform, we may process:

• IP address;
• browser type and version;
• operating system;
• device information;
• date and time of access;
• pages or functions accessed;
• referring website;
• login and security events;
• error logs;
• session and usage information;
• cookie and consent information.

Content submitted to VZUAL

Users may upload files, images, designs, graphics, technical documents, project information or other content to the VZUAL platform.

Where such content contains personal data, the relevant VZUAL customer is generally responsible for determining the purposes and means of that processing. In these situations, VZUAL normally processes the data as a processor on behalf of the customer and in accordance with the applicable contract and data-processing agreement.

Requests concerning personal data contained in customer-controlled content should generally be directed to the customer that uploaded or provided the information.

Billing and transaction data

We may process:

• billing contact details;
• company address;
• VAT identification number;
• order and subscription information;
• invoices;
• payment status;
• transaction references.

Payment-card or banking data may be processed directly by the relevant payment service provider. VZUAL generally does not receive complete payment-card information.

4. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases.

Responding to enquiries and demo requests

We process information submitted through website forms, email, telephone, LinkedIn or other communication channels in order to:

• respond to questions;
• arrange a demonstration;
• provide information about VZUAL;
• prepare quotations;
• discuss potential cooperation;
• take steps requested before entering into a contract.

The legal basis is Article 6(1)(b) GDPR where the processing relates to pre-contractual measures or a contract.

Where an enquiry does not relate directly to a potential contract, processing is based on our legitimate interest under Article 6(1)(f) GDPR in communicating with business contacts and presenting our products and services.

Providing user accounts and VZUAL services

We process account, contract and usage data in order to:

• create and administer user accounts;
• provide access to VZUAL;
• manage licences and permissions;
• provide contracted functions;
• provide technical support;
• communicate service-related information;
• administer subscriptions;
• maintain platform security;
• prevent misuse and unauthorised access.

The legal basis is Article 6(1)(b) GDPR.

Security monitoring, fraud prevention, system administration and service improvement may additionally be based on our legitimate interests under Article 6(1)(f) GDPR.

Billing, accounting and legal compliance

We process transaction, invoice and contract data in order to:

• administer payments;
• issue invoices;
• maintain accounting records;
• comply with tax, commercial and regulatory obligations;
• establish, exercise or defend legal claims.

The legal bases are Article 6(1)(b), Article 6(1)(c) and, where applicable, Article 6(1)(f) GDPR.

Newsletter and marketing communications

Where you subscribe to our newsletter or expressly request marketing information, we process your name, email address, company details and communication preferences in order to send:

• product news;
• feature updates;
• event invitations;
• industry information;
• promotional offers;
• other VZUAL marketing communications.

The legal basis is your consent under Article 6(1)(a) GDPR and the applicable provisions of the Austrian Telecommunications Act.

You may withdraw your consent at any time by using the unsubscribe link contained in each marketing email or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

We may send information concerning similar VZUAL products or services to existing customers where this is legally permitted. Every such message will contain a simple method of opting out.

Business-to-business communication

We may contact existing or potential business contacts where we have a legitimate interest in discussing VZUAL, responding to an existing business relationship or maintaining professional contacts.

The legal basis for storing and administering the contact information may be Article 6(1)(f) GDPR. Electronic direct-marketing messages will only be sent where permitted by applicable communications and marketing laws.

Website operation and security

Technical data and server logs may be processed in order to:

• deliver the website;
• maintain availability and stability;
• identify technical problems;
• prevent attacks, fraud and misuse;
• investigate security incidents;
• ensure the integrity of our systems.

The legal basis is our legitimate interest under Article 6(1)(f) GDPR in operating a secure and reliable website and software service.

5. LinkedIn Page, advertising and Lead Gen Forms

VZUAL operates a company page on LinkedIn and may use LinkedIn advertising services, sponsored posts and Lead Gen Forms.

The LinkedIn service for users in the European Economic Area is generally provided by:

LinkedIn Ireland Unlimited Company
Ireland

LinkedIn processes personal data in accordance with its own privacy policy and platform terms.

Interaction with our LinkedIn Page

When you visit, follow or interact with our LinkedIn Page, LinkedIn may process information including:

• profile information;
• professional information;
• likes, comments and shares;
• messages sent to the Page;
• page views and interactions;
• device and usage information.

VZUAL may receive information that you actively provide, publicly display or communicate to us through LinkedIn.

LinkedIn Page Insights

LinkedIn provides VZUAL with aggregated statistics known as Page Insights. These may include information about:

• page visitors and followers;
• industries;
• job functions;
• seniority levels;
• countries or regions;
• engagement with posts and advertisements.

LinkedIn generally provides these insights to us in aggregated form and does not enable VZUAL to identify individual LinkedIn members from the aggregated statistics.

For the processing used to generate Page Insights relating to individuals in the EEA or Switzerland, LinkedIn and VZUAL may act as joint controllers in accordance with LinkedIn’s Page Insights Joint Controller Addendum.

LinkedIn is primarily responsible for providing information about its processing and for handling requests relating specifically to personal data processed by LinkedIn for Page Insights. You may nevertheless contact VZUAL, and we will forward or coordinate relevant requests where required.

LinkedIn advertising

When we promote or boost LinkedIn posts, LinkedIn may select and display advertisements based on criteria such as:

• location;
• industry;
• company;
• company size;
• job title;
• seniority;
• professional interests;
• interactions with LinkedIn content.

LinkedIn is responsible for the operation of its advertising platform and the personalisation and delivery of advertisements within LinkedIn.

VZUAL may receive aggregated campaign information, such as impressions, clicks, interactions, audience characteristics and campaign performance.

Unless expressly stated otherwise, VZUAL does not use the LinkedIn Insight Tag or LinkedIn website-retargeting technology on its own website.

LinkedIn Lead Gen Forms

When you submit a LinkedIn Lead Gen Form connected to a VZUAL advertisement, LinkedIn may transfer the information contained in the form to VZUAL.

Depending on the form, this may include:

• first and last name;
• email address;
• telephone number;
• job title;
• company name;
• industry;
• company size;
• country;
• LinkedIn profile address;
• answers to custom questions;
• your interest in a VZUAL demonstration or product information.

We use this information to:

• respond to your request;
• contact you concerning VZUAL;
• arrange a demonstration;
• provide requested product information;
• assess your company’s requirements;
• prepare a quotation;
• conduct relevant sales follow-up.

The legal basis is Article 6(1)(b) GDPR where you request information, a demonstration, a quotation or other pre-contractual action.

Where you separately consent to further marketing communication, the legal basis is Article 6(1)(a) GDPR.

Submitting a Lead Gen Form does not automatically subscribe you to the VZUAL newsletter unless the form clearly includes a separate newsletter or marketing consent.

VZUAL will not use LinkedIn Lead Gen Form information for purposes that are incompatible with the purpose described in the relevant advertisement or form.

6. Google Analytics

We use Google Analytics to understand how visitors use our website and to improve its content, usability and performance.

Google Analytics is provided by Google Ireland Limited. Google may involve affiliated companies and service providers located outside the European Economic Area.

Google Analytics may process information such as:

• shortened or otherwise processed IP address;
• device and browser information;
• approximate geographic location;
• visited pages;
• date and time of visits;
• session duration;
• interactions with website content;
• referral source;
• technical identifiers;
• cookie information.

Google Analytics is activated only after you have given consent through our cookie or consent-management system.

The legal basis is Article 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021.

You may refuse or withdraw your consent at any time through the cookie settings available on our website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We configure Google Analytics with privacy-oriented settings where reasonably available. We do not intentionally transmit names, email addresses or other directly identifying contact information to Google Analytics.

Google may process certain information in the United States or other countries. Where required, transfers are based on an applicable adequacy decision, certification under the EU–US Data Privacy Framework, Standard Contractual Clauses or another legally recognised transfer mechanism.

7. Cookies and similar technologies

Our website may use cookies and similar technologies.

Cookies are small data files stored on or accessed from your device.

Technically necessary cookies

Technically necessary cookies may be used to:

• provide core website functions;
• maintain secure sessions;
• remember privacy settings;
• prevent misuse;
• enable account authentication;
• maintain system stability.

These technologies may be used without consent where they are strictly necessary to provide a service requested by the user.

The legal basis for related personal-data processing is generally Article 6(1)(b) or Article 6(1)(f) GDPR.

Analytics cookies

Analytics cookies, including Google Analytics cookies, are used only after consent.

The legal basis is Article 6(1)(a) GDPR in conjunction with Section 165(3) TKG 2021.

You can change or withdraw your cookie preferences at any time through the cookie-settings function on our website.

8. Hosting and technical service providers

Our website and platform are hosted by an EU-based hosting provider:

[NAME OF HOSTING PROVIDER]
[COUNTRY]

The hosting provider may process technical data, server logs, account data and stored platform content on our behalf.

We may also use carefully selected service providers for:

• cloud infrastructure;
• database operation;
• email delivery;
• newsletters;
• customer support;
• software development;
• monitoring and security;
• invoicing;
• payment processing;
• communication and collaboration;
• data backup.

These providers process personal data only where necessary for the relevant service. Where they act as processors, they are bound by data-processing agreements in accordance with Article 28 GDPR.

9. Recipients of personal data

Personal data may be disclosed to the following categories of recipients where necessary:

• hosting and cloud providers;
• IT and security providers;
• newsletter and email-delivery providers;
• customer-support providers;
• payment service providers;
• accountants, auditors and tax advisers;
• banks and financial institutions;
• legal advisers;
• public authorities and courts where legally required;
• LinkedIn in connection with LinkedIn services;
• Google in connection with Google Analytics, where consent has been provided;
• affiliated companies or contractors involved in providing VZUAL services.

We do not sell personal data.

10. International data transfers

Some service providers, particularly LinkedIn, Google or their affiliated companies and subprocessors, may process personal data outside the European Economic Area.

Where personal data is transferred to a country outside the EEA, we ensure that an appropriate legal transfer mechanism is used where required. This may include:

• an adequacy decision issued by the European Commission;
• participation by the recipient in the EU–US Data Privacy Framework;
• Standard Contractual Clauses approved by the European Commission;
• supplementary contractual, organisational or technical safeguards;
• another transfer mechanism permitted by the GDPR.

You may contact us for further information about the applicable safeguards.

11. Storage periods

We store personal data only for as long as required for the relevant purpose or legal obligation.

Unless a different period is required in an individual case, the following general periods apply:

Enquiries and demo requests

Enquiry and lead information may be stored for up to 24 months after the last meaningful communication, unless:

• a contractual relationship is established;
• consent is withdrawn;
• the individual objects to the processing;
• longer retention is necessary for legal claims.

LinkedIn Lead Gen Form information

Information received through LinkedIn Lead Gen Forms may be stored for up to 24 months after submission or the last meaningful business communication.

Data may be deleted earlier where it is no longer relevant or where a valid deletion request is received.

Newsletter information

Newsletter information is stored until consent is withdrawn or the newsletter service is discontinued.

After withdrawal, limited information may be retained on a suppression list in order to ensure that no further marketing messages are sent and to document compliance with legal obligations.

Account and subscription data

Account and contract data is generally stored for the duration of the account or contractual relationship.

After termination, data may be retained where required for:

• statutory record-keeping;
• invoicing and taxation;
• legal claims;
• fraud prevention;
• security investigations.

Accounting and invoice data

Accounting records and invoices are generally retained for seven years from the end of the relevant calendar year, or longer where required in connection with an ongoing tax or legal proceeding.

Technical logs

Technical and security logs are generally retained only for the period necessary to maintain security, investigate incidents and ensure system stability. Unless required for an incident or legal claim, logs are normally deleted or anonymised within 90 days.

Customer content

Customer content is retained for the duration of the applicable account or contract and may be deleted by the customer in accordance with the available platform functions.

Following account termination or a valid deletion instruction, remaining copies may continue to exist temporarily in protected backup systems until overwritten in accordance with our backup and deletion procedures.

12. Data security

We implement appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• accidental or unlawful destruction;
• loss;
• alteration;
• unauthorised disclosure;
• misuse.

These measures may include:

• access controls;
• role-based permissions;
• encryption in transit;
• protected authentication;
• logging and monitoring;
• backup procedures;
• security updates;
• contractual confidentiality obligations;
• internal data-protection procedures.

No internet-based service can guarantee absolute security. We therefore continually review and improve our security measures according to the nature and risks of the processing.

13. Requirement to provide personal data

You are not generally legally required to provide personal data to VZUAL.

However, certain information is necessary where you wish to:

• receive a response to an enquiry;
• arrange a demonstration;
• receive a quotation;
• create a VZUAL account;
• enter into a contract;
• use subscribed services;
• receive a newsletter.

Where required information is not provided, we may be unable to provide the requested service or enter into the relevant contract.

14. Automated decision-making

VZUAL does not currently use personal data to make solely automated decisions that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.

LinkedIn may use automated systems to select, personalise and deliver advertisements in accordance with its own privacy policy and user settings.

15. Your rights

Subject to the conditions and limitations of the GDPR, you have the right to:

• obtain confirmation as to whether we process your personal data;
• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion of personal data;
• request restriction of processing;
• receive certain data in a structured, commonly used and machine-readable format;
• request transmission of eligible data to another controller;
• object to processing based on legitimate interests;
• object at any time to processing for direct-marketing purposes;
• withdraw consent at any time;
• lodge a complaint with a supervisory authority.

Where processing is based on consent, withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Right to object

Where we process personal data on the basis of legitimate interests under Article 6(1)(f) GDPR, you may object to the processing on grounds relating to your particular situation.

We will then stop processing the relevant data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing, you may object at any time. Personal data will no longer be processed for direct-marketing purposes after such an objection.

16. Exercising your rights

To exercise your rights, contact:

VZUAL GmbH
Email: [PRIVACY EMAIL ADDRESS]

Please provide sufficient information to allow us to identify the relevant data and process your request.

We may request additional information where reasonably necessary to confirm your identity and protect personal data from unauthorised disclosure.

17. Right to lodge a complaint

You have the right to lodge a complaint with the competent data-protection supervisory authority.

In Austria, the competent authority is:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at

You may also contact the supervisory authority in the EU or EEA member state of your habitual residence, place of work or the place of the alleged infringement.

18. Children

VZUAL is a business-to-business service and is not directed at children.

We do not knowingly request or intentionally collect personal data from children through our website, LinkedIn campaigns or software subscriptions.

19. Changes to this Privacy Policy

We may update this Privacy Policy to reflect:

• changes to our services;
• new technologies or providers;
• changes in data-processing activities;
• legal or regulatory developments.

The current version will be published on our website together with the date of the latest update.

Material changes may also be communicated through the VZUAL platform, by email or through another appropriate communication channel.