Privacy Policy

1. Data Controller

The controller of your personal data is Dominik Mizerski, operating a sole proprietorship (jednoosobowa działalność gospodarcza) under the business name "Dominik Mizerski Mizzart", based in Warsaw, Poland, VAT ID (NIP): 5214175509, REGON: 545409804, operating the Mizzart service and its related applications, available at mizzart.com and associated domains. For privacy-related matters, contact: kontakt@mizzart.com.

2. Scope and Purpose of Data Processing

The data we process depends on which part of the Mizzart ecosystem you use.

A. Contact form (www.mizzart.com)

• Data collected: first and last name, email address, phone number (optional), company or agency name (optional), message content.
• Enquiry source information: we append to the message the address of the page you entered the site on during your visit, and the referring site (e.g. Google) or the value of the utm_source parameter from the address. This is used solely to establish which pages and sources enquiries come from. This information is temporarily kept in the browser's session memory (sessionStorage) and is not used for profiling or for tracking users between visits.
• Purpose and legal basis: handling your enquiry, conducting correspondence, and analysing which pages and sources enquiries come from. The legal basis is the legitimate interest of the Controller (Art. 6(1)(f) GDPR).

B. Statistical and technical data (www.mizzart.com and app.mizzart.com)

• Data collected: IP address, approximate location, time spent in the application, number of visits, browser type, operating system type, and technical information about the device and session.
• Purpose and legal basis: ensuring security, protection against bots and DDoS attacks, optimising application performance, and maintaining statistics. The legal basis is the legitimate interest of the Controller (Art. 6(1)(f) GDPR). Statistical data is anonymised as a rule; personal data may be associated primarily with the IP address.

C. Account and client panel data (panel.mizzart.com)

• Data collected: login and security credentials, including email address, password stored as a cryptographic hash (bcrypt), session identifiers, two-factor authentication data, and login history including failed attempts.
• Purpose and legal basis: providing access to the client panel, authentication, account management, service delivery, and system security. The legal basis is the performance of a contract or steps taken prior to entering into a contract (Art. 6(1)(b) GDPR) and the legitimate interest of the Controller (Art. 6(1)(f) GDPR).

D. Project, tour, and ticket data (panel.mizzart.com)

• Data collected: property listing data including location, area, description, photos and files, route and viewpoint data, 3D model technical data, and the content of messages, tickets, and project tags.
  
  In the course of providing the service, the Model or source materials may capture elements present in the property, including personal items, documents, photos, likenesses, or other data. The Client is responsible for preparing the property prior to the scanning session, in particular for removing or covering any data or elements they do not wish to appear in the Tour.
• Purpose and legal basis: delivering and maintaining 3D virtual tour services, communicating with the client, and handling tickets. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR) and the legitimate interest of the Controller (Art. 6(1)(f) GDPR).

E. Settings, consents, and room statistics

• Data collected: email notification preferences, onboarding status, accepted consent records with timestamps, and aggregated data on tour views and activity, such as number of sessions, viewing duration, and country or region.
• Purpose and legal basis: the legal basis for processing is: performance of a contract for account management and service preferences; consent to contact regarding the service and optional consent to email notifications about project status; the legitimate interest of the Controller for recording granted consents; and the legitimate interest of the Controller for statistics, security, and service quality analysis.
• Room statistics are aggregated as a rule and are not intended to directly identify individual visitors to the tour.

F. Local browser storage

The app.mizzart.com application may store certain preferences locally in the user's browser, such as view, panel, statistics, or performance settings. The client panel at panel.mizzart.com also uses essential cookies and session mechanisms for login and security. This data remains on the user's device or browser session until deleted or expired.

3. Technical Security

The Controller applies technical and organisational measures to protect personal data, including encrypted HTTPS connections, session protection mechanisms, form and login security, login attempt rate limiting, storage of passwords exclusively as cryptographic hashes, and automatic expiry of inactive sessions.

• session stored in an httpOnly cookie, inaccessible to JavaScript,
• CSRF token for every data-mutating operation,
• login attempt throttling based on IP hash,
• passwords stored exclusively as bcrypt hashes,
• invalidation of all sessions upon password change,
• automatic expiry of inactive sessions,
• all communication exclusively over encrypted HTTPS connections.

4. Recipients of Personal Data

Personal data is not sold. Data is not passed to third parties for their own marketing purposes. To operate the service, applications, and infrastructure, data may be processed by the following providers:

• SeoHost — website, application, and database hosting, and email services,
• Cloudflare — file storage, DNS, CDN, anti-bot and anti-DDoS protection, Turnstile, and statistical/analytical services,
• other IT, accounting, legal, postal, or administrative service providers, where necessary for the delivery of services or fulfilment of the Controller's legal obligations.

5. Data Retention

• contact form data — for as long as necessary to handle the enquiry, no longer than 2 years from the last contact, unless ongoing cooperation justifies longer retention,
• account and authentication data — for the duration of the cooperation and until the limitation period for claims expires,
• project and tour data — for the period during which the Project is active, the public link is maintained, or the Client relationship exists; thereafter for up to 1 year, unless longer retention is necessary for pursuing or defending claims, fulfilling legal obligations, or is otherwise agreed between the parties,
• login attempt logs (including IP hashes and timestamps) — maximum 90 days from the event,
• correspondence and tickets — until the matter is resolved and the limitation period for any claims expires,
• statistical and technical data — in identifiable form for no longer than 12 months, thereafter in aggregated or anonymised form indefinitely for trend analysis and service improvement,
• administrative activity log — a record of who changed or deleted data in the system and when, together with the name of the entity the operation concerned — for 12 months from the event. Such an entry is also created when we act on an erasure request: the record itself is deleted, and only the information that the operation was performed remains in the log. The legal basis is the controller's legitimate interest in accountability and security of processing (Art. 6(1)(f) in conjunction with Art. 32 GDPR),
• data stored locally in the browser — until deleted by the user or the relevant session expires.

6. Your Rights

In connection with the processing of your personal data, you have the following rights:

• the right to access your data and receive a copy of it,
• the right to rectification of your data,
• the right to erasure of your data,
• the right to restriction of processing,
• the right to object to processing,
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal,
• the right to data portability — in cases provided for by the GDPR,
• the right to lodge a complaint with a supervisory authority. In Poland: the President of the Personal Data Protection Office (uodo.gov.pl). If you are based in another EU/EEA country, you may also contact your local data protection authority.

To exercise your rights, contact us at: kontakt@mizzart.com.

The Controller responds to personal data requests without undue delay, and in any event within one month of receipt, unless the GDPR permits an extension of that period.

6B. Voluntary Nature of Data Provision

Providing your data is voluntary, but may be necessary to handle your enquiry, create an account, deliver a service, prepare a project, or send a reply. Failure to provide data may prevent contact, service delivery, or access to the Client Panel.

6C. International Transfers of Personal Data

As a result of using services provided by external suppliers — in particular Cloudflare — technical data may be processed outside the European Economic Area. In such cases, the Controller applies the safeguards required by the GDPR, in particular standard contractual clauses, adequacy decisions, or other legally permitted transfer mechanisms.

7. Cookies and Tracking Technologies

Mizzart websites and applications do not use marketing cookies for user profiling. Only technical and security mechanisms are used, including session cookies for the client panel, localStorage for saving interface preferences, and Cloudflare Turnstile to protect forms against spam and bots. Cloudflare may store essential technical information in accordance with the Cloudflare Privacy Policy.

On mizzart.com we use Cloudflare Web Analytics to measure traffic (page views, visited pages, referrer, country, device and browser type, and page load performance). The tool does not store cookies or localStorage data on the user's device, does not create an identifier that recognises the user across visits, and is not used for profiling. Data is processed in aggregated form on the basis of the Controller's legitimate interest (Art. 6(1)(f) GDPR) in analysing traffic and improving the website.

The contact form uses the browser's sessionStorage, where the page of first entry and the referring source are kept for the duration of the current session (see section 2.A). This data expires when the browser tab is closed and reaches us only in the content of the message sent by the user.

If Mizzart introduces marketing or analytics cookies requiring consent in the future, users will be informed and will be able to give or refuse consent before such cookies are used.

8. Changes to This Privacy Policy

In the event of significant changes, we will notify you by email or via a notice in the panel. The updated effective date will be indicated at the top of this document.

9. Contact

If you have any questions about the protection of your personal data, contact us at: kontakt@mizzart.com.