Privacy Policy for Vizgu

1. Data controller

Vizgu ApS is the data controller for the processing described in this policy.

2. About Vizgu

Vizgu is an online guide to museums, attractions and cultural experiences. The website provides information such as opening hours, admission prices and links to ticket sellers.

Vizgu does not sell tickets or process payments. When you follow a ticket link, you are redirected to an external ticket seller, currently Tiqets, which operates its own checkout.

Vizgu may receive an affiliate commission when a visitor follows a ticket link and subsequently completes a purchase with the ticket seller.

3. Personal data we process

Depending on how you use Vizgu, we may process the following information.

3.1 Visiting and using the website

When you visit Vizgu, we may process:

• An anonymous session identifier
• Technical request and security information
• Browser and device information, including your user agent
• Your language and currency preferences
• Search filters and other website preferences
• Places saved in your browser
• Referring page information
• Your derived country

Our systems may temporarily receive your IP address when responding to a request. However, we do not store your IP address in our affiliate click records. We store only a country code derived from it.

3.2 Saved places

You can save places without creating an account. In that case, your saved places are associated with an anonymous session identifier.

If you later sign in, you may be offered the option of attaching places saved in your browser to your account.

3.3 User accounts and authentication

If you sign in to Vizgu, we process:

• Your email address
• Your account identifier
• Authentication and session information
• The time and status of sign-in attempts
• Places and notification requests associated with your account

Vizgu uses passwordless authentication. We send you a time-limited sign-in link by email and do not ask you to create or store a password with us.

3.4 Availability notifications

If you ask to be notified when a venue becomes bookable, we process:

• Your email address
• The relevant place or venue
• The date and time of your request
• A record of your consent
• The status of the notification
• Information needed to cancel the request

The notification is intended to be sent once when the selected venue becomes bookable. It is not a subscription to general marketing.

3.5 Reports about incorrect information

If you report incorrect information about a place, we may process:

• The content of your report
• The place and information concerned
• The correction you suggest
• Your email address, if you choose to provide it
• The date and time of the report

We use this information to investigate and, where appropriate, correct the information published on Vizgu.

3.6 Outbound ticket links and affiliate attribution

When you open a ticket link, your browser first visits a Vizgu redirect address, such as /r/<provider>/<place>. Vizgu then immediately redirects you to the ticket seller using an HTTP 302 redirect.

For this redirect and affiliate attribution, we may record:

• Your anonymous session identifier
• The date and time of the click
• Your browser’s user-agent information
• Your derived country code
• The page from which you followed the link
• The destination address
• The selected place
• The ticket provider

We do not store your IP address in the click record.

Affiliate commission may later be reconciled against the anonymous session identifier. Vizgu does not receive your card number, billing address or complete purchase details from the ticket seller.

3.7 Email-delivery information

When we send authentication links, availability notifications or other service emails, we may process:

• Your email address
• A provider-generated message identifier
• Delivery time and status
• Delivery failures and suppression status
• Limited technical information needed to troubleshoot delivery

4. Why we process personal data

Where we rely on legitimate interests, we consider whether the processing is necessary and whether your interests or fundamental rights override our interests.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

5. Ticket sellers and payment information

Vizgu does not operate the ticket seller’s checkout and does not process payments.

When you follow a ticket link, you leave Vizgu and enter the ticket seller’s website. The ticket seller independently determines how it processes information relating to:

• Your order
• Payment information
• Billing address
• Ticket delivery
• Refunds
• Customer service
• Fraud prevention

The current ticket seller is Tiqets. Tiqets acts as an independent data controller for its processing. You should read the ticket seller’s privacy policy before providing personal information or completing a purchase.

Vizgu does not receive your card details or billing address. No payment processor is embedded in vizgu.com.

6. Service providers and recipients

We use carefully selected providers to operate Vizgu.

Supabase

Supabase provides database services and passwordless authentication. It processes account information, saved places, notification requests and other application data on our behalf.

Vercel

Vercel provides website hosting, application delivery and related infrastructure. Requests to Vizgu pass through Vercel’s systems.

Resend

Resend delivers transactional emails, including sign-in links and requested availability notifications. It processes email addresses and email-delivery metadata on our behalf.

Cloudflare R2

Cloudflare R2 provides storage and delivery for images and related website files.

Tiqets

Tiqets receives visitors who choose to follow ticket links. Tiqets acts independently in relation to its website, checkout, payments and customer services.

We may also disclose data where required by law, to protect legal rights or in connection with a corporate restructuring. We do not sell personal data.

7. International data transfers

Some of our providers, including Vercel, Resend and Cloudflare, are companies established in the United States. Depending on their infrastructure and support arrangements, personal data may be processed outside the EU or European Economic Area.

Where personal data is transferred outside the EU/EEA, we require an appropriate transfer mechanism. This may include:

• An adequacy decision adopted by the European Commission, including participation in the EU–US Data Privacy Framework where applicable
• The European Commission’s Standard Contractual Clauses
• Additional technical and organisational safeguards where required

You may contact us at privacy@vizgu.com for more information about the safeguards applicable to a particular transfer.

8. Cookies and similar technologies

Vizgu uses cookies and similar browser technologies to operate the website, maintain sessions, remember preferences and support features such as saved places.

These technologies may remember:

• An anonymous session identifier
• Authentication sessions
• Saved places
• Language and currency
• Search and display preferences
• Consent choices

The anonymous session identifier may also be used for affiliate attribution.

Vizgu currently does not use advertising cookies or general website analytics. If we introduce statistics, marketing or advertising technologies, we will update this policy and obtain consent where required before activating them.

A separate cookie policy will provide details about individual cookies, their providers, purposes and duration, and explain how you can change your preferences.

9. How long we retain personal data

We keep personal data only for as long as it is reasonably necessary for the relevant purpose, including legal, accounting and security requirements.

Our intended retention principles are:

• Anonymous session identifiers expire after approximately 90 days unless renewed through continued use.
• Browser-based preferences and saved places remain until they expire, are deleted by the user or are cleared from the browser.
• Account information is kept while the account remains active and for a limited period after deletion where necessary for security, legal claims or legal obligations.
• Pending availability-notification information is kept until the notification is sent, the request is cancelled or the service is discontinued.
• After sending or cancelling a notification, the associated data is deleted or anonymised after a limited period, except for documentation we are legally required to retain.
• Correction reports are retained while they are investigated and for a limited period afterwards to document the correction.
• Click records are retained only for the period needed for affiliate reconciliation, fraud prevention and accounting.
• Email-delivery metadata is kept for the period needed to confirm delivery, investigate failures and protect the service from abuse.
• Consent records are retained for as long as needed to demonstrate compliance and for the applicable limitation period.
• Security logs are retained for a limited period unless a longer period is needed to investigate an incident.

Vizgu will document and apply specific internal deletion periods. You may contact us for information about the retention period applicable to particular data.

10. Your choices

You are not required to create an account to browse Vizgu.

Certain information is needed if you choose to use a particular feature. For example:

• We need an email address to send a magic sign-in link.
• We need an email address and selected place to send an availability notification.
• We need a session identifier to maintain an anonymous session and associate saved places with it.

If you do not provide the required information, we may be unable to provide that feature.

You may cancel a pending availability notification using the cancellation option provided by Vizgu or by contacting us.

You may delete saved places through the website or by clearing the relevant browser data. Clearing browser data may also remove your anonymous session and preferences.

11. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• Obtain confirmation of whether we process your personal data
• Request access to your personal data
• Ask us to correct inaccurate or incomplete data
• Ask us to delete your personal data
• Ask us to restrict processing
• Object to processing based on legitimate interests
• Receive certain data in a structured, commonly used and machine-readable format
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

When processing is based on legitimate interests, you may object because of circumstances relating to your particular situation. We will then stop the processing unless we demonstrate compelling legitimate grounds or the processing is needed for legal claims.

To exercise your rights, contact privacy@vizgu.com. We may need to verify your identity before responding.

12. Complaints

If you are concerned about our processing of personal data, please contact us first so that we can investigate the matter.

You may also lodge a complaint with the Danish Data Protection Agency:

If you live in another EU/EEA country, you may also contact the data-protection authority in that country.

13. Children

Vizgu is a general guide to museums and attractions and is not designed to collect personal data from children.

Children should not create an account or submit an email address unless they are legally able to do so or have the involvement of a parent or guardian where required.

If you believe that a child has provided personal data improperly, contact us at privacy@vizgu.com.

14. Automated decision-making

Vizgu does not use the personal data described in this policy to make decisions based solely on automated processing that produce legal or similarly significant effects.

15. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss and destruction.

No internet service can guarantee absolute security. If you believe your account or information has been compromised, contact us promptly.

16. External websites

Vizgu contains links to ticket sellers, museums, attractions and other external websites. Those organisations are responsible for their own processing of personal data.

This privacy policy applies only to processing for which Vizgu ApS is the data controller.

17. Changes to this policy

We may update this policy when our services, providers or legal obligations change.

The current version will always be published on vizgu.com with its effective date and version number. If a change materially affects how we process personal data, we will provide appropriate notice and seek new consent where required.