Privacy Policy

This Privacy Policy explains what personal data we process in Mybzz, for what purposes and on what legal basis, to whom we may disclose it, how long we keep it and what rights you have. Capitalised terms have the meaning given to them in the Mybzz Terms (https://mybzz.com/terms).

§ 1Controller and contact

1. The controller of personal data is MYBZZ SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Warsaw, ul. Nowogrodzka 31, 00-511 Warszawa, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000948080, NIP (tax ID): 7011069967, REGON: 521033275 (the “Controller”, “we”).

2. The Controller has not appointed a data protection officer. For all matters concerning personal data, you can contact us at contact@mybzz.com or in writing at the Controller's address.

3. Data is processed in accordance with Regulation (EU) 2016/679 (GDPR) and Polish law. This Policy covers the Mybzz mobile application and the mybzz.com website (the “Application”).

4. Event Organizers, payment operators (e.g. Stripe), Apple and Google as app store operators, and operators of external services linked from the Application process data as separate controllers, under the rules described in their privacy policies.

§ 2What data we process and where we get it from

1. Account and Profile data you provide: including phone number, first and last name, e-mail address, photo, language, country, job title, company, work experience, description, goals, skills, links, Brands, consents and settings.

2. Content and activity in the Application: including posts, comments, reactions, Offers, Events and Tickets, contacts, Messages with attachments, reports, groups, Brand Catalog votes, Points, Streaks, achievements, Rankings, Invitations and information about content viewed.

3. Payment and billing data: including purchase and subscription history, payment identifiers, invoice data, information on refunds and disputes and confirmations of statements made. We do not process full payment card details - payment operators do.

4. Technical and usage data: including IP address, device and browser identifiers, system and app version, time zone, notification token, login and activity dates, in-app events and data from cookies and similar technologies.

5. Location data: with your consent given on your device or in your browser - the device's location; in addition, an approximate location determined e.g. from the IP address.

6. Data we generate: including the Profile summary and matches (§ 4), results of automated checks, security signals and statistics.

7. Data from other sources: data of Brands and Event organisers from publicly available sources and from partners we work with (§ 7), data from payment operators and app stores, data of people who report content or submit Brands, data of people who contact us, and phone numbers of people invited by Users to group chats.

8. Providing Account data is voluntary but necessary to use Mybzz. Providing invoice data is necessary to issue an invoice.

§ 3Purposes and legal bases of processing

1. Providing the services described in the Terms (Account, Profile, Discover, search, Messages, Feed, groups, Events, Offers, Brands, Brand Catalog, Points and Invitations programme, Rankings, notifications) - performance of the contract (Article 6(1)(b) GDPR).

2. Paid services, billing, invoices and obligations towards consumers - performance of the contract and legal obligations, in particular tax and accounting obligations (Article 6(1)(b) and (c) GDPR).

3. Security of the Application and Users, account verification, detecting fake accounts, bots, spam, fraud and abuse, including in Messages - legitimate interest (Article 6(1)(f) GDPR).

4. Matching contacts and content, AI Features, automatic translation - performance of the contract and legitimate interest (Article 6(1)(b) and (f) GDPR).

5. Service messages and information about changes to the Terms and the Policy - performance of the contract and legal obligation (Article 6(1)(b) and (c) GDPR).

6. The Newsletter and information about community activity, as well as marketing of our own services - legitimate interest (Article 6(1)(f) GDPR); where the law requires consent for sending commercial information electronically or for using technologies on the terminal device - consent (Article 6(1)(a) GDPR).

7. Statistics, analytics, development of the Application, measuring the effectiveness of communication and campaigns - legitimate interest (Article 6(1)(f) GDPR) and, where required by law, consent (Article 6(1)(a) GDPR).

8. Publishing information about Brands and Events from public sources and contacting their owners and organisers (§ 7) - legitimate interest (Article 6(1)(f) GDPR).

9. Handling complaints, reports and appeals, content moderation and obligations under the Digital Services Act - legal obligation and legitimate interest (Article 6(1)(c) and (f) GDPR).

10. Technical support and contact with us - performance of the contract or legitimate interest (Article 6(1)(b) and (f) GDPR).

11. Establishing, pursuing and defending claims and demonstrating compliance with the law (e.g. records of acceptance of the Terms and of consents given) - legitimate interest (Article 6(1)(f) GDPR).

§ 4Profiling, AI Features and automated decisions

1. To suggest the right contacts and content, we automatically analyse Profile data and activity in the Application. On this basis the Application may, among other things, prepare a Profile summary (e.g. what you are looking for and what you offer), show an estimated match with other people and set the order of Profiles in Discover and posts in the Feed. This is profiling that does not produce legal effects concerning you or similarly significantly affect you - the results are indicative.

2. To analyse Profile content and prepare information about External Events, we use artificial intelligence models provided by OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.), acting as a processor under a data processing agreement. We send only the data needed for the given feature, in particular content you have placed in your Profile and Offers yourself. The “About me” description is a free-text field - it is analysed in the form in which you write it. Under OpenAI's API terms, this data is not used to train models.

3. To detect violations and ensure security, we also use automated tools, e.g. checking profile photos for the presence of a face, prohibited content filters, bot protection and automated checks of content (including Messages) for fraud and spam.

4. Some decisions, in particular moderation decisions, may be taken with the use of automated tools. You can appeal such decisions under the Terms - appeals are reviewed by a human, and you can present your point of view.

5. Content may be translated automatically by the browser or device or by external translation services (e.g. Google Translate).

6. You can object to profiling based on legitimate interest or ask for the results to be corrected by writing to contact@mybzz.com.

§ 5What others can see

1. Profile data (including first and last name, photo, job title, company, description, goals, skills, experience, city and country, Brands, achievements and the Profile summary) is visible to other Users, and the public Profile page also to people who are not logged in and to search engines.

2. The Account phone number and e-mail address are not shown on the Profile. Contact details you add to your Profile yourself may be visible to other Users as described in the Application. Other Users may see your approximate distance, but not your exact coordinates.

3. The following, among other things, may be publicly visible: posts and comments, participation in Events, Rankings (first name, initial of the surname, photo, job title, company, score), achievements, share pages you create, Brand votes (first name, initial of the surname, photo, Profile link) and a short Profile of the Brand Owner.

4. If you do not want to be featured in Rankings or on the homepage, write to contact@mybzz.com.

§ 6Location, contacts and device permissions

1. Location. With your consent given on your device or in your browser, the Application may obtain the device's location while you use it and send it to us, in particular to find people and Events nearby, calculate distances, determine the city and country on your Profile and assign a place to content you publish. We may use geocoding services to determine an address or city from coordinates. We may also determine an approximate location (e.g. country, city) from the IP address or device data, among other things for default settings and security. You can withdraw consent in your device or browser settings.

2. Contacts. With your permission (system permission), the application may use your contacts in features you choose, e.g. when inviting people to a group chat or inviting friends. We process the data of people who do not have an Account to the extent needed for these features (legitimate interest - Article 6(1)(f) GDPR). Such a person may request deletion of their data at any time by writing to contact@mybzz.com.

3. The camera, photos, microphone, calendar and notifications are used for the features you use. You can withdraw permissions in your device or browser settings.

§ 7Brands and Events from public sources (Article 14 GDPR)

1. We may publish information about Brands in the Brand Catalog and about public business events in the Application, obtained from publicly available sources (e.g. websites, public directories, calendars and event services) and from partners we work with.

2. We then process, among other things: the name of the Brand or organiser, website address, logo, category, description or Event information (including data of people named in the programme, e.g. speakers, guests and moderators - name, job title, company, photo), a publicly provided contact e-mail address and the history of contact with us (e.g. dates of messages, replies, claims, objections). This data is personal data where it relates to a natural person (e.g. a personal e-mail address or a business name containing a person's name).

3. Purpose and legal basis: presenting Brands and Events and informing the owner or organiser about the publication and that they can claim, correct or remove the entry free of charge, as well as informing them about the Brand's ranking results - the Controller's legitimate interest (Article 6(1)(f) GDPR) in running a reliable brand catalog and events calendar.

4. We provide the information required by Article 14 GDPR in the first message, no later than one month after obtaining the data.

5. Right to object: every message from us on this matter contains an unsubscribe link. An objection can also be made by replying to the message or writing to contact@mybzz.com. After an objection, we send no further messages and, on request, remove the entry. To respect the objection, we keep the address on a suppression list and may pass information about the objection to the partners from whom we obtained the data.

6. People named in information about Events (e.g. speakers) do not always receive a message from us - we make the Article 14 GDPR information available to them in this Policy, because notifying each of them individually would involve a disproportionate effort (Article 14(5)(b) GDPR). Any such person may at any time request the removal or correction of their data or object by writing to contact@mybzz.com - we remove or correct it without undue delay.

7. When a Brand is submitted by a User or a person who is not logged in, we process the submitter's data (e.g. name, e-mail address) and the Brand data to confirm the submission, contact them about the Brand and prevent abuse (Article 6(1)(b) and (f) GDPR). When a Brand or Event is claimed, we process the e-mail address used for verification and information on who claimed it and when.

§ 8Payments, Tickets and Organizers

1. Payments on the website are handled by Stripe, and payments in the mobile application by Apple (App Store) and Google (Google Play); to handle in-app subscriptions we use a subscription system provider, to which we pass the data needed to assign a purchase to the Account. We issue invoices electronically.

2. The Event Organizer receives the Participants' data needed to organise the Event (e.g. first and last name, photo, Profile link, e-mail address, sign-up and check-in status) and processes it as a separate controller. The Organizer may use their own analytics or advertising tools on the Event page, subject to the consent given in the cookie settings.

3. Ticket payments are made through Stripe in the Organizer's account; Stripe and the Organizer are separate controllers of payment and invoice data. We process information on payments, refunds and disputes to handle purchases, refunds, complaints and prevent abuse.

4. We process the seller details provided by the Organizer (e.g. name or business name, contact details, address and tax identification number) and show them to Participants before they buy a Ticket (Article 6(1)(b), (c) and (f) GDPR).

§ 9Messages, notifications and marketing

1. We send service messages (e.g. codes, confirmations, invoices, activity notifications, moderation decisions, changes to the Terms and the Policy) regardless of marketing consents.

2. We may send the Newsletter and information about the Mybzz community. We send commercial information electronically where permitted by law, in particular with consent where consent is required. You can unsubscribe from the Newsletter and marketing information at any time via the link in the message or in the Account settings, and withdraw your consent.

3. E-mails may contain elements that show whether the message was delivered and opened and which links were clicked - to measure the effectiveness of communication and improve its content.

§ 10Cookies and similar technologies

1. The website uses cookies and similar technologies (e.g. browser storage). Cookies necessary for the website to work (e.g. login, security, language, remembering settings) are used without consent. Other categories (preferences, statistics, marketing) are used as chosen in the cookie banner; you can change your settings at any time (e.g. “Cookie settings” in the page footer).

2. With consent, we may use analytics and advertising tools (e.g. Google Analytics, Google Ads, the Meta pixel) and record the course of sessions on the website to improve it, with form fields masked.

3. External services needed for individual features may also run on the website, e.g. bot protection, maps, videos, translation and geocoding services; loading them involves passing, among other things, the IP address and browser data to the provider.

4. The mobile application uses tools from external providers (e.g. Google Firebase, AppsFlyer, Meta, a subscription system provider) to send notifications, collect app usage and error statistics, attribute installs, handle links that open the app and handle subscriptions. Device settings allow you to limit ad tracking and reset the advertising identifier.

5. We record decisions made in the cookie banner in order to demonstrate that consent was given.

§ 11Recipients of data

1. We may entrust or disclose data to the following categories of recipients, to the extent needed for their tasks:

1.1. providers of hosting, IT infrastructure, data storage and security services,

1.2. payment operators (e.g. Stripe), Apple and Google (app stores) and a subscription system provider,

1.3. providers of e-mail, SMS and notification delivery, real-time communication and customer support services,

1.4. providers of analytics, advertising and attribution tools,

1.5. providers of artificial intelligence (OpenAI), translation, map and geocoding services,

1.6. software providers, including invoicing and customer relationship management software, and development companies,

1.7. accounting office, legal and tax advisers,

1.8. Event Organizers (Participants' data) and other Users as regards public data (§ 5),

1.9. public authorities and other entities entitled under the law.

2. Processors act under data processing agreements. We can provide an up-to-date list of our main providers on request sent to contact@mybzz.com.

§ 12Transfers outside the EEA

1. Some recipients may process data outside the European Economic Area, in particular in the USA.

2. Transfers are based on a European Commission adequacy decision (including the EU-US Data Privacy Framework), standard contractual clauses approved by the European Commission or other safeguards provided for in the GDPR. Information about the safeguards can be obtained by writing to contact@mybzz.com.

§ 13How long we keep data

1. Account and Profile data and content - for as long as you have an Account and, after it is deleted, for the period needed to complete the deletion process, ensure security and handle any complaints or appeals. After the Account is deleted, data may be anonymised; Messages sent to other people may remain in their conversations as coming from a deleted Account.

2. Data processed to perform the contract - for the duration of its performance and then until the limitation period for claims expires.

3. Payment records and invoices - for the period required by tax and accounting law.

4. Data processed on the basis of consent - until it is withdrawn; on the basis of legitimate interest - until the purpose is achieved or a successful objection is made.

5. Data of Brands and Events from public sources - for as long as the entry is presented; suppression list entries - for as long as needed to respect the objection.

6. Technical data, logs, session recordings, security check results and auxiliary data (e.g. queries to AI services) - for as long as needed for the purpose for which they were collected.

7. After these periods, data may be kept longer only to the extent necessary to establish, pursue or defend claims or to comply with a legal obligation.

§ 14Your rights

1. You have the right: of access to your data and to receive a copy (Article 15 GDPR), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to data portability (Article 20), to object to processing based on legitimate interest, including profiling and direct marketing (Article 21), and to withdraw consent at any time without affecting the lawfulness of processing before its withdrawal (Article 7(3)).

2. You can correct or delete most data in the Account settings. You can delete your Account in the Application (Settings), on the Mybzz website if this feature is available, or by writing to contact@mybzz.com.

3. To exercise your rights, write to contact@mybzz.com. We may ask you to confirm your identity. We reply without undue delay and no later than within one month; in specific cases this period may be extended by two months.

4. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland) or with the supervisory authority in the country of your habitual residence, place of work or place of the alleged infringement.

§ 15Minors, security and changes to the Policy

1. Mybzz is intended for people aged 18 or over. If we learn that we are processing data of a minor, we may delete their Account and data.

2. We apply technical and organisational measures appropriate to the risk, in particular securing connections, access control and limiting access to data to what is necessary.

3. We may change the Privacy Policy, in particular in the event of changes in the law, Application features or providers. We inform you of material changes in advance, under the rules described in the Terms. All versions of the Policy are available at https://mybzz.com/privacyPolicy.

4. Matters not regulated here are governed by the GDPR and Polish law.

The effective date of this version of the Privacy Policy is shown on the Privacy Policy page (mybzz.com/privacyPolicy) and in the notice of the change.