Privacy Policy

The controller of your personal data is:

For any matter relating to the processing of your personal data, you may contact us at privacy@viuzi.com.

Data Protection Officer (DPO). Atbion OÜ has assessed its processing activities in accordance with Article 37 of the GDPR and has determined that, given the current volume of processing, the mandatory appointment of a Data Protection Officer is not required. In particular, the assessment considered: (a) that Atbion OÜ's principal activity is technological intermediation, not large-scale data processing; (b) that automated calculation of metrics (response rate, average rating) does not constitute systematic monitoring within the meaning of Article 37(1)(b), as these are operational indicators derived from contractual activity; (c) that geolocation data is limited to service areas voluntarily declared by users, not real-time tracking; (d) that special categories of data (Article 9) are not systematically processed. Nevertheless, Atbion OÜ has designated an external contact point specialised in data protection for all GDPR-related matters: privacy@viuzi.com. This assessment is reviewed annually, or when significant changes occur in processing activities or user volume, and will be formally documented. Atbion OÜ commits to formally appointing a DPO as soon as the volume or nature of processing so requires. Atbion OÜ will annually reassess the need to appoint a DPO pursuant to Article 37 of the GDPR, taking particular account of: (a) the volume of geolocation data processed, (b) the number of active users, (c) the complexity of financial processing, and (d) the use of AI systems for moderation. If at any time processing reaches the scale requiring a DPO, Atbion OÜ will formally appoint one and communicate their contact details to the Andmekaitse Inspektsioon.

Atbion OÜ will formally register the privacy contact point with the Andmekaitse Inspektsioon (AKI) pursuant to Article 37(7) of the GDPR. The formal appointment of a DPO will be triggered when the following thresholds are exceeded: 10,000 monthly active users or processing of geolocation data at scale.

This Privacy Policy applies to all personal data collected and processed through:

• The web platform accessible at viuzi.com.
• The Viuzi mobile application available for iOS and Android.
• Any interaction with our services, including communications by email, contact forms and user support.

Viuzi is a services marketplace that connects Service Providers ("Service Providers") with Service Requesters ("Service Requesters") for the procurement of maintenance, repair and professional services in general.

Viuzi operates exclusively in B2B mode. All users are legal entities or professionals acting in the exercise of their commercial activity. The personal data processed corresponds to the designated representatives of such entities.

For the purposes of this Privacy Policy:

• "Personal data": any information relating to an identified or identifiable natural person, as defined in Article 4(1) of the General Data Protection Regulation (GDPR).
• "Processing": any operation or set of operations performed on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, restriction, erasure or destruction.
• "Controller": Atbion OÜ, which determines the purposes and means of processing personal data.
• "Processor": a natural or legal person that processes personal data on behalf of the Controller.
• "Data subject": a natural person whose personal data is processed; in our case, users of the Viuzi platform.
• "Service Provider": a user registered on the platform with the role SERVICE_PROVIDER_ADMIN who offers professional services.
• "Service Requester": a user registered on the platform with the role SERVICE_REQUESTER_ADMIN who seeks to procure professional services.
• "Platform": the website https://viuzi.com and the Viuzi mobile applications for iOS and Android, considered together.

We collect and process the following categories of personal data, depending on your role on the platform and the features you use:

4.1. Identity Data

4.2. Account Data

4.3. Business Data

4.3bis. Distinction between Legal Entity Data and Personal Data

Viuzi operates as a B2B marketplace in which the contracting parties are exclusively legal entities (companies and sole traders). In this context, it is important to distinguish between the data of the legal entity and the personal data of the natural persons representing it:

Legal entity data (NOT personal data). In accordance with Recital 14 of the GDPR, this Regulation does not apply to the processing of data relating to legal persons. The following data are considered legal entity data and therefore do not constitute personal data for the purposes of the GDPR:

• Company legal name.
• Company TIN/CIF.
• Intra-community VAT number.
• Registered office address.
• Commercial registration number.

Data of the natural person representing the entity (IS personal data). Data of the natural person acting as representative or contact point of the legal entity constitutes personal data protected by the GDPR. These include:

• Representative's name and surname(s).
• Representative's email address.
• Representative's phone number.
• Representative's photograph or avatar.

Legal basis for processing contact person data. The processing of personal data of the natural person representing the legal entity is based on the legitimate interests of Atbion OÜ (Article 6(1)(f) of the GDPR), consisting in the need to identify and communicate with a valid contact for the execution of the contractual relationship with the legal entity.

Special case: Sole traders and individual professionals. For users operating as self-employed professionals (sole traders), the above distinction is blurred, as business data and personal data may coincide (for example, the sole trader's name is the trading name, and the TIN is personal data). In these cases, all the sole trader's data will be treated as personal data pursuant to the GDPR, regardless of their use in a commercial context. The applicable legal bases will be Art. 6(1)(b) (performance of a contract, as a direct party) and Art. 6(1)(f) (legitimate interests, for additional purposes).

Change of contact person. When the natural person representing the legal entity ceases to perform that function (for example, upon change of employment), that person has the right to request the erasure of their personal data (name, email address, phone number, photograph) pursuant to Article 17 of the GDPR, without affecting the legal entity's data (legal name, TIN, VAT number, registered address, commercial registration number), which will continue to be processed in the framework of the existing contractual relationship with the company.

Application of GDPR rights. The rights recognised in Articles 15 to 22 of the GDPR (access, rectification, erasure, restriction, portability, objection) apply exclusively to the personal data of the natural person and not to the corporate identifiers of the legal entity.

4.4. Location and Geolocation Data

4.5. Professional Data

4.6. Financial Data

Important note: Viuzi does NOT store full credit or debit card numbers, CVVs or sensitive payment data. All complete payment information is processed and stored exclusively by Stripe, our PCI DSS Level 1 certified payment services provider. We only store tokenised references and identifiers provided by Stripe.

4.7. Legal Documents

These documents are stored securely on Amazon Web Services S3 (EU-West-1 region) with encryption at rest and strict access controls.

4.8. Communication Data

4.9. Job and Transaction Data

4.10. Rating and Review Data

4.11. Notification Data

4.12. Technical Data

Mobile Application-Specific Data. Viuzi mobile applications (iOS and Android) may additionally collect: device identifiers (non-advertising), operating system version, application version, diagnostic and crash data, and application performance metrics. Viuzi does NOT collect advertising identifiers (IDFA/GAID) or cross-application tracking data.

4.13. GDPR Request Data

4.14. Special Categories of Data

Viuzi does not request or require special category data (Article 9 of the GDPR), such as health data, ethnic origin, sexual orientation, religious beliefs or biometric data. However, certain data voluntarily provided by Users may incidentally contain special category information (for example, profile photographs that may reveal ethnic origin, or professional insurance documents containing medical information). Prior to uploading profile photographs or other visual content that may reveal special category data, the Platform will display an informative notice indicating that the image may contain sensitive data and requesting the User's explicit confirmation to proceed. This confirmation constitutes the explicit consent required by Art. 9(2)(a) of the GDPR. Additionally, for profile photographs that the User makes manifestly public, the exception in Art. 9(2)(e) of the GDPR applies. Enhanced security measures are applied, including restricted access and encryption.

Atbion OÜ commits to processing personal data in accordance with the following principles:

• Lawfulness, fairness and transparency: All processing is based on a valid legal basis and communicated clearly to the data subject.
• Purpose limitation: Data is collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.
• Data minimisation: Only the data strictly necessary for each purpose is collected.
• Accuracy: Reasonable measures are taken to keep data up to date and correct inaccuracies.
• Storage limitation: Data is retained only for as long as necessary to fulfil its purpose.
• Integrity and confidentiality: Technical and organisational measures are applied to protect the data.
• Accountability: Atbion OÜ is responsible for compliance with these principles and can demonstrate such compliance.

In accordance with Article 6 of the GDPR, we process your personal data for the following purposes and on the following legal bases:

6.1. Performance of a Contract (Article 6.1.b GDPR)

We process your data when necessary for the performance of the contract to which you are a party (the Viuzi Terms and Conditions) or for the implementation of pre-contractual measures taken at your request:

Note: For representatives of legal entities who are not direct parties to the contract, the legal basis for processing their personal data in the context of account management is legitimate interests (Art. 6(1)(f) GDPR), as detailed in Section 4.3bis. Art. 6(1)(b) applies exclusively to sole traders who are direct parties to the service contract. | Assignment and management of roles on the platform | Account data (user role) | | Publication and management of job offers | Job and transaction data, location data | | Sending and managing invitations and proposals | Job data, professional data | | Processing payments and charges | Financial data, job data | | Issuing invoices | Business data, financial data, job data | | Managing transfers to providers (payouts) | Financial data | | Facilitating communication between parties | Communication data | | Validating intra-community VAT numbers | Business data (VAT number) | | Storing and managing legal documents | Legal documents | | Managing service areas and facilities | Location and geolocation data | | Managing professional profiles and portfolios | Professional data |

6.2. Legitimate Interests (Article 6.1.f GDPR)

We process certain data when necessary for legitimate interests pursued by Atbion OÜ, provided those interests are not overridden by the data subject's interests or fundamental rights and freedoms:

In all cases where we base processing on legitimate interests, we have conducted a balancing assessment ensuring that our interests do not override your fundamental rights. You have the right to object to this processing at any time (see Section 10.6).

Summary of legitimate interest assessments (LIA): For each purpose based on legitimate interests, Atbion has conducted a balancing assessment whose results are summarised as follows: (a) Fraud prevention and security: the interest in maintaining Platform integrity prevails over the User's privacy expectation, given the B2B professional context and non-intrusive nature of the measures; (b) Analysis and improvement: the interest in improving the service prevails, as aggregated and anonymised data are used to the extent possible; (c) Dispute resolution: the legitimate interest of all parties in resolving disputes fairly prevails, processing being limited to strictly necessary data; (d) Identification of representatives: necessary to maintain valid commercial relationships with legal entities. Full documentation of each LIA is available upon request to privacy@viuzi.com.

6.3. Legal Obligation (Article 6.1.c GDPR)

We process certain data when required to do so by applicable law:

6.3bis. DAC7 Reporting Obligations (Directive 2021/514/EU)

As a marketplace platform operator, Atbion OÜ is subject to the information reporting obligations established by Council Directive (EU) 2021/514 of 22 March 2021 amending Directive 2011/16/EU on administrative cooperation in the field of taxation (known as "DAC7"), transposed into Estonian law.

Legal basis. The processing of the data indicated below is based on Article 6(1)(c) of the GDPR (legal obligation), as it is necessary to comply with a legal obligation applicable to the Controller.

Data collected and reported. In compliance with DAC7 obligations, Viuzi collects and reports to the competent tax authority the following data about Service Providers operating through the Platform:

Reporting authority. Data is reported to the Maksu- ja Tolliamet (Estonian Tax and Customs Board), which in turn exchanges it with the tax authorities of the relevant EU Member States pursuant to the automatic exchange of information mechanism established by Directive 2011/16/EU.

Reporting thresholds. The reporting obligation applies to Service Providers who, during a calendar year, meet at least one of the following thresholds:

• Have received total consideration equal to or greater than EUR 2,000; or
• Have carried out 25 or more transactions through the Platform.

Reporting frequency. Information is reported to the Maksu- ja Tolliamet on an annual basis, no later than 31 January of the year following the reporting period.

Provider notification. Viuzi will annually inform the affected Service Providers of the data reported to the tax authority, in accordance with the DAC7 Directive.

Retention period. Data collected to comply with DAC7 obligations will be retained for a period of 7 years from the end of the reporting period, pursuant to Article 12 of the Estonian Accounting Act (Raamatupidamise seadus) and the retention obligations set out in applicable tax regulations.

6.4. Consent (Article 6.1.a GDPR)

For certain processing activities, we request your prior, express, free, informed and unambiguous consent:

You may withdraw your consent at any time, without this affecting the lawfulness of processing based on consent prior to its withdrawal.

Consents granted are recorded with a timestamp, the version of the policy in force at the time and the collection mechanism, and are available for the exercise of the data subject's right of access.

We share your personal data with the following categories of recipients, exclusively for the purposes described in this Policy and with appropriate safeguards:

7.1. Other Platform Users

In the context of the normal operation of the marketplace, certain profile data is visible to other users:

• Service Providers: may view basic data of Requesters who publish jobs (name, company, job location, ratings).
• Service Requesters: may view professional data of Providers (name, company, skills, experience, portfolio, certifications, ratings, response rate, service areas).
• Communications: messages are visible only to the parties participating in the conversation.

7.2. Data Processors (Sub-processors)

We work with the following data processors, with whom we have entered into the corresponding data processing agreements pursuant to Article 28 of the GDPR. The data processing agreements entered into with each sub-processor include the obligations of Article 28(3) of the GDPR: processing pursuant to documented instructions, confidentiality obligations, security measures (Art. 32), conditions for sub-sub-processors, assistance with data subject rights, assistance with DPIAs and prior consultations (Arts. 35–36), data deletion/return upon termination, and audit rights. Rights regarding notification of changes to sub-processors are described in the Data Processing Agreement.

7.2.1. Amazon Web Services (AWS)

Amazon SES is used for both transactional and commercial/marketing communications (the latter exclusively with prior consent pursuant to Section 6.4). No additional email marketing provider is used.

7.2.2. MongoDB Atlas

7.2.3. Stripe

Stripe Connect Onboarding Data. During the activation of the Provider's Stripe Connect account, the following additional data is shared with Stripe to fulfil its regulatory obligations (KYC/AML): identity document of the legal representative, bank account details, verified business address, and tax identification number. Stripe acts as an independent controller for its own identity verification process pursuant to its Privacy Policy (https://stripe.com/privacy).

7.2.4. Google (OAuth 2.0 Authentication)

7.2.5. Google Firebase Cloud Messaging (FCM)

7.2.6. Apple Push Notification Service (APNS)

Apple may act as an independent controller with respect to certain aspects of the APNS service pursuant to its own terms. To the extent that Apple acts as an independent controller, the relationship is governed by Apple's privacy policy.

7.2.7. Amazon Rekognition

Amazon Rekognition is used exclusively for moderation content labelling (detection of inappropriate, violent or adult content). Facial recognition, biometric identification and creation of biometric templates are NOT used. No biometric data within the meaning of Article 9 of the GDPR is processed.

7.2.8. Amazon Comprehend

7.2.9. VIES (VAT Information Exchange System) — Data recipient

7.3. Other Recipients

We may disclose your personal data to third parties in the following circumstances:

• Public authorities: when legally required to do so by a request from a competent authority (judicial, tax, administrative).
• Professional advisers: lawyers, auditors and tax consultants, subject to confidentiality obligations.
• In the event of business restructuring: in the case of a merger, acquisition, asset sale or insolvency proceedings, your data may be transferred to the new owner, after notifying the data subjects.

7.4. No Sale of Data

Atbion OÜ does NOT sell, rent or trade your personal data to third parties for marketing or advertising purposes.

7.5. Relationship between Controllers

Atbion OÜ acts as the sole controller of personal data processed through the Platform. The exchange of data between Providers and Requesters (messages, contact details for service provision, reviews) takes place under the Platform's mediation. To the extent that a Provider or Requester independently determines the purposes and means of processing personal data obtained through the Platform (for example, by storing contact details in their own systems), that User acts as an independent controller and is solely responsible for GDPR compliance with respect to such processing.

8.1. Principal Processing within the European Union

All principal Viuzi data processing takes place within the European Union, specifically in the EU-West-1 (Ireland) region:

• Database: MongoDB Atlas, EU-West-1 region.
• File storage: Amazon S3, EU-West-1 region.
• Cache and sessions: Amazon ElastiCache/Redis, EU-West-1 region.
• Email: Amazon SES, EU-West-1 region.

8.2. Transfers outside the European Economic Area

In certain cases, data may be transferred outside the European Economic Area (EEA), specifically to the United States, in connection with the following services:

Where the EU-US DPF applies, transfers are additionally covered by the European Commission Adequacy Decision C(2023) 4745 final of 10 July 2023. In all cases, transfers comply with the requirements of Chapter V of the GDPR (Articles 44–49), being covered by:

1. The Adequacy Decision of the European Commission regarding the EU-US Data Privacy Framework (where applicable).
2. Standard Contractual Clauses (SCCs) approved by Implementing Decision (EU) 2021/914, as the primary or supplementary safeguard mechanism.
3. Transfer Impact Assessments (TIA) conducted in respect of each provider.

In the event that the adequacy decision for the EU-US Data Privacy Framework is invalidated, the Standard Contractual Clauses (Implementing Decision (EU) 2021/914) constitute the principal fallback transfer mechanism. Atbion OÜ maintains valid SCCs with all sub-processors that transfer data to the USA as a supplementary and contingency measure.

Supplementary measures (EDPB Recommendations 01/2020). In addition to the transfer mechanisms described, Atbion applies the following supplementary measures for transfers to third countries: (a) Technical measures: TLS 1.2+ encryption in transit and AES-256 at rest for all data transferred; pseudonymisation where technically feasible; role-based access controls with the principle of least privilege; (b) Organisational measures: periodic transfer impact assessments (TIA); staff training on data protection; procedures for responding to government access requests; (c) Contractual measures: notification clauses in the event of government access requests; commitment to challenge requests that exceed applicable legal requirements.

8.3. Request for Additional Information

You may request additional information about the safeguards applied to international data transfers by contacting privacy@viuzi.com.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or for as long as required by applicable law:

9.1. Deletion Procedure

When retention periods expire, personal data is:

1. Irreversibly deleted from our production databases.
2. Deleted from backups in the next backup rotation cycle (maximum 90 additional days).
3. Anonymised where full deletion is not possible due to legal retention obligations, so that the data no longer allows identification of the data subject.

9.2. Financial Data Retained by Legal Obligation

Pursuant to Article 12 of the Estonian Accounting Act (Raamatupidamise seadus) and the VAT Directive 2006/112/EC, we are required to retain accounting documents and invoices for a minimum period of 7 years. During this period, financial data will be retained even where the user has requested account deletion, but will be processed exclusively for compliance with this legal obligation and for no other purpose.

Pursuant to Articles 15 to 22 of the GDPR, you have the following rights in relation to your personal data:

10.1. Right of Access (Article 15 GDPR)

You have the right to obtain from the Controller confirmation as to whether or not personal data concerning you is being processed and, if so, access to that data and to the following information:

• The purposes of processing.
• The categories of personal data concerned.
• Recipients or categories of recipients.
• The envisaged retention period.
• The existence of the other rights (rectification, erasure, restriction, objection).
• The right to lodge a complaint with a supervisory authority.
• The source of the data where not collected directly from you.
• The existence of automated decision-making, including profiling.

Built-in functionality: Viuzi offers a built-in data export function on the platform that allows you to download a copy of all your personal data at any time, without needing to contact us.

10.2. Right to Rectification (Article 16 GDPR)

You have the right to obtain the rectification of inaccurate personal data concerning you, and to have incomplete personal data completed. You can update most of your data directly from your profile settings on the platform. For data that cannot be modified directly, you may contact privacy@viuzi.com.

10.3. Right to Erasure — "Right to be Forgotten" (Article 17 GDPR)

You have the right to obtain the erasure of your personal data when any of the following circumstances apply:

• The data is no longer necessary for the purpose for which it was collected.
• You withdraw the consent on which the processing was based and there is no other legal basis.
• You object to the processing and there are no overriding legitimate grounds.
• The data has been unlawfully processed.
• The data must be erased to comply with a legal obligation.

Built-in functionality: Viuzi offers a built-in account deletion request function on the platform. Upon requesting deletion:

1. Your account will be deactivated immediately.
2. Your personal data will be deleted within 30 days.
3. Data subject to legal retention obligations (financial data, invoices) will be retained for the legally required period, but will be anonymised to the extent possible and processed exclusively for that purpose.

Exceptions: The right to erasure does not apply where processing is necessary for compliance with a legal obligation (for example, retention of tax records for 7 years) or for the establishment, exercise or defence of legal claims.

10.4. Right to Restriction of Processing (Article 18 GDPR)

You have the right to obtain restriction of processing of your data when:

• You contest the accuracy of the data, for a period enabling verification.
• The processing is unlawful and you oppose erasure and request restriction instead.
• The Controller no longer needs the data but you need it for legal claims.
• You have objected to the processing, pending verification of whether the Controller's legitimate grounds override yours.

Where processing has been restricted, the data may only be processed, other than for storage, with your consent or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another person.

10.5. Right to Data Portability (Article 20 GDPR)

You have the right to receive the personal data you have provided to Viuzi in a structured, commonly used and machine-readable format, and to transmit it to another controller without hindrance from the controller.

Built-in functionality: The platform offers a data export function that generates a ZIP file containing all your personal data in machine-readable JSON format, facilitating portability to other services.

The right to data portability under Article 20 of the GDPR applies specifically to data directly provided by the user and processed on the basis of consent or performance of a contract. Data automatically calculated by the Platform (performance metrics, average rating) are not subject to portability, although they may be included in the export as a courtesy.

10.6. Right to Object (Article 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data based on legitimate interests (Article 6.1.f GDPR). The Controller will cease processing the data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

Where processing is for direct marketing purposes, you have the right to object at any time without justification, and the Controller will immediately cease processing the data for that purpose.

10.7. Right to Withdraw Consent (Article 7.3 GDPR)

Where processing is based on consent, you have the right to withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.

You may withdraw your consent:

• For commercial communications: via the unsubscribe link included in each communication or from your account settings.
• For non-essential cookies: via the cookie settings panel on the platform.
• For push notifications: from the application's notification settings or your device settings.

10.8. Right Not to be Subject to Automated Individual Decision-Making (Article 22 GDPR)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects on you or similarly significantly affects you.

Automated Decision-Making. Viuzi uses an automated moderation system assisted by artificial intelligence for the review of user profiles and content. This system uses Amazon Rekognition for image moderation and Amazon Comprehend for text toxicity detection. Decisions by this system may result in the approval, rejection or escalation of content for manual review. Confidence scores (0.0–1.0) determine the outcome:

• Content with critical issues (explicit content, violence): automatic rejection
• Content with warnings (low confidence, spam): escalation for human review
• Content with no issues: automatic approval

Automated content moderation decisions may significantly affect Users by restricting their ability to offer services on the Platform. Therefore, pursuant to Article 22 of the GDPR, Users have the right to: (a) obtain human intervention by an administrator, (b) express their point of view, and (c) contest the decision. All automated decisions resulting in access restriction will be reviewed by a human team member before their final implementation.

In accordance with the Digital Services Regulation (EU) 2022/2065, Atbion OÜ publishes annual transparency reports on content moderation decisions, including the use of automated systems, the number of decisions taken, and reversal rates. These reports are available on the Platform.

Automatically calculated metrics (such as response rate or average rating) are informational and do not by themselves determine access to platform features or produce legal effects.

10.9. Exercising Your Rights

To exercise any of your rights, you may:

1. Use the built-in platform functions (data export, account deletion, preferences management).
2. Send a request by email to privacy@viuzi.com, stating:
   • Your full name and email address associated with your account.
   • The right you wish to exercise.
   • Any additional information that facilitates the processing of your request.

Response period: We will respond to your request within a maximum period of one (1) month from receipt. This period may be extended by a further two (2) months for complex or high-volume requests, and you will be informed of this within the first month.

Free of charge: Exercising these rights is free of charge. However, where requests are manifestly unfounded or excessive (in particular because of their repetitive character), the Controller may charge a reasonable fee or refuse to act on the request, pursuant to Article 12.5 of the GDPR.

Identity verification: To protect your privacy, we may request additional information to verify your identity before processing your request.

10.9bis Right to Notification (Art. 19 GDPR)

Atbion will communicate any rectification, erasure or restriction of processing carried out pursuant to Articles 16, 17 and 18 to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The User will have the right to be informed of those recipients upon request.

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, pursuant to Article 32 of the GDPR:

11.1. Technical Measures

11.2. Organisational Measures

11.3. Data Protection Impact Assessments (DPIA)

Atbion OÜ conducts Data Protection Impact Assessments pursuant to Article 35 of the GDPR for high-risk processing activities, including: (a) large-scale processing of geolocation data; (b) processing of financial and payment data; (c) automated content moderation using artificial intelligence (Amazon Rekognition and Amazon Comprehend); (d) international data transfers. The results of DPIAs are available to the supervisory authority (Andmekaitse Inspektsioon) upon request.

12.1. Types of Cookies Used

12.2. Cookie Management

When accessing the web platform for the first time, you will be shown a cookie consent banner allowing you to:

• Accept all cookies.
• Reject non-essential cookies.
• Customise your cookie preferences by category.

You may modify your cookie preferences at any time via the cookie settings panel accessible from the platform.

For full information on cookies and similar technologies, please consult our Cookie Policy.

12.3. Mobile Application

The Viuzi mobile application for iOS and Android does not use browser cookies, but employs similar local storage technologies (secure device storage) to manage authentication and user preferences. These technologies are strictly necessary for the operation of the application.

The Platform is restricted to adults acting in a professional capacity or as representatives of legal entities. If it is detected that an account is operated by a minor, it will be terminated immediately.

Pursuant to Articles 33 and 34 of the GDPR:

Pursuant to Article 33(5) of the GDPR, Atbion OÜ maintains an internal register of all personal data breaches, including those that do not require notification to the supervisory authority.

14.1. Notification to the Supervisory Authority

In the event of a personal data breach, we will notify the Andmekaitse Inspektsioon (Estonian Data Protection Authority) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely that the breach will result in a risk to the rights and freedoms of natural persons.

14.2. Notification to Data Subjects

Where the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, we will communicate the breach to the data subject without undue delay, describing:

• The nature of the breach.
• The contact details of the privacy contact point.
• The likely consequences of the breach.
• The measures taken or proposed to address the breach and mitigate its effects.

Affected data subjects will be notified via email to their registered address and via in-application notification, within 72 hours of confirmation of the breach, or as soon as reasonably practicable. The notification will include specific guidance on protective measures that the data subject may take.

Communication to data subjects will not be required where the conditions of Article 34(3) of the GDPR are met: (a) the data was encrypted, (b) subsequent measures have been taken that eliminate the risk, or (c) it would involve a disproportionate effort, in which case a public communication will be made.

If you consider that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority:

Without prejudice to the foregoing, if you reside in another EU/EEA Member State, you may also lodge a complaint with the supervisory authority of your country of habitual residence, place of work or the place of the alleged infringement. For example, if you reside in Spain, you may lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

We recommend that, before lodging a complaint with the supervisory authority, you contact us at privacy@viuzi.com so that we can attempt to resolve your concern directly and satisfactorily.

We reserve the right to amend this Privacy Policy at any time to adapt it to legislative, case-law or processing practice developments.

In the event of material changes:

1. We will notify you with a minimum of 30 days' notice before the changes take effect, through:
   • A prominent notice on the platform.
   • An email to the address registered in your account.
   • A push notification on the mobile application (if you have notifications enabled).
2. We will publish the updated version of the Privacy Policy on the platform with the date of the latest update.
3. We will request fresh consent where the changes affect processing based on consent.

For processing based on consent (Article 6(1)(a) of the GDPR), changes will always require an explicit affirmative action by the user. Tacit acceptance through continued use applies only to changes to processing based on the performance of a contract or legitimate interests.

Continued use of the platform after the changes take effect will be deemed acceptance of those changes in relation to such processing, without prejudice to your right to delete your account at any time.

This Privacy Policy is governed by:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, GDPR).
• The Isikuandmete kaitse seadus (Estonian Personal Data Protection Act), which supplements and develops the GDPR at national level.
• Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive), transposed into Estonian law.
• Any other applicable European Union or Republic of Estonia legislation on personal data protection.

For users established in Spain, Organic Law 3/2018 of 5 December on Personal Data Protection and the Guarantee of Digital Rights (LOPDGDD) will apply in a supplementary capacity to the extent it is applicable alongside the GDPR.

For any query, exercise of rights or complaint relating to the processing of your personal data, you may contact us through:

We commit to responding to all requests within the maximum period established by the GDPR (one month, extendable to three months for complex cases).