Venue Partner Privacy Policy
Last updated: 17 March 2026
1. Who we are and how to contact us
Get Dizzy AI LTD ("Get Dizzy", "we", "us", "our") operates the Get Dizzy platform, a location-based venue discovery service available at getdizzy.ai and through our web-based application (the "Platform"). This includes the consumer-facing discovery service and the Venue Dashboard used by our venue partners.
We are the data controller for the personal data we collect and process about you when you register as a venue partner and use the Venue Dashboard. We have not appointed a Data Protection Officer as we are not required to do so under UK data protection law, but you can contact us about any privacy matter using the details below.
Company details:
- Registered company name: Get Dizzy AI LTD
- Company number: 17045871
- Registered address: 340 The Crescent, Colchester, England, CO4 9AD
- Privacy contact email: legal@getdizzy.ai
- ICO registration number: ZC096374
If you have any questions about this privacy policy or how we handle your personal data, please contact us at legal@getdizzy.ai.
2. What this policy covers
This privacy policy explains how we collect, use, store, and share personal data when you:
- Register as a venue partner on our Platform
- Manage your venue profile, deals, and content through the Venue Dashboard
- Subscribe to a paid plan and manage your billing
- Participate in our incentive programmes
- Submit testimonials or feedback
- Contact us for support
This policy applies to individuals who register and manage venue partner accounts. If you are a consumer using our Platform to discover venues and deals, please refer to our separate Consumer Privacy Policy.
A note on personal data in a B2B context: Most of the information you provide relates to your venue (business name, address, opening hours, deal descriptions). This is business information, not personal data. However, some data we collect does identify you as an individual (your name, email address, login activity) and is personal data protected by UK data protection law. This policy covers that personal data.
3. Information we collect about you
Information you provide to us
- Account information: Your name, email address, and password when you create a partner account.
- Business capacity confirmation: When you register, we record your confirmation that you are acting in the course of your trade, business, craft, or profession.
- Licensing confirmation: We record your confirmation that your venue holds all required licences to operate, including (where applicable) a valid premises licence under the Licensing Act 2003.
- Venue profile information: Your venue name, address, description, opening hours, cuisine categories, and outdoor space details. This is business information about your venue, not personal data about you as an individual.
- Content uploads: Images, menu PDFs, deal descriptions, and any other materials you upload to the Platform. Where these contain identifiable individuals, they may constitute personal data.
- Testimonials and feedback: If you submit a testimonial through the Venue Dashboard, we collect the text of your submission and your venue name for potential publication on the Get Dizzy website.
- Communications: Messages you send to us through email or other support channels.
Information we collect automatically
- Login and session data: When you log in, the date and time of access, and session activity within the Venue Dashboard.
- Device and technical data: Your IP address, browser type and version, operating system, and device type.
- Usage data: Pages you visit within the Venue Dashboard and how you interact with the Platform. This is collected by Vercel Analytics, which operates without cookies and does not store raw IP addresses. IP addresses are used only to derive country-level location data and are then discarded by Vercel.
Information collected through our payment provider
When you subscribe to a paid plan, your payment is processed by Stripe, a third-party payment provider. We do not receive or store your full card details, bank account numbers, or other financial payment credentials. Stripe handles all card processing directly and hosts billing records such as invoices and receipts. Our authorised staff may access these records through the Stripe dashboard for customer support and accounting purposes.
We store the following subscription-related data in our own systems to manage your account:
- Your Stripe customer identifier and subscription identifier
- Your subscription tier (Essential, Pro, or promotional tier) and current status (active, trialling, past due, cancelled, or inactive)
- Your billing interval (monthly or annual)
- Your current billing period end date and trial end date (if applicable)
- Whether your subscription is set to cancel at the end of the current period
- Promotional offer status (if applicable)
Stripe also processes webhook events to keep our records up to date, including notifications about successful payments, payment failures, and subscription changes. We do not store raw invoice data or detailed payment event logs in our database. For information about how Stripe handles your payment data, please see Stripe's privacy policy at stripe.com/privacy.
Incentive programme data
If you participate in our incentive programmes, we track your progress:
- Exclusive Credit: The number of days you have maintained an active Get Dizzy Exclusive deal within each 12-month billing cycle.
- Win a Free Month: Your completion status for each of the five marketing goals, including evidence submitted for admin approval.
Information we do not collect
- We do not collect your GPS location or track your physical movements
- We do not use advertising cookies, tracking pixels, or third-party analytics tools that create user profiles
- We do not ask for personal data about your staff, employees, or customers as part of registration or account management. However, personal data may be included in content you upload (for example, images that include identifiable individuals in the background). If you upload content that contains personal data of others, you are responsible for ensuring you have the necessary permissions or legal basis to share it with us for publication on the Platform.
Whether you are required to provide data
You are not legally obliged to provide us with your personal data. However, certain information is necessary for us to create and manage your partner account:
- If you do not provide your name, email address, and password, we cannot create a partner account for you.
- If you do not provide the business capacity and licensing confirmations described above, we may not be able to approve your venue submission.
- If you do not provide payment details to Stripe, you cannot start a paid subscription.
Providing venue profile information (business name, address, opening hours) is a contractual requirement under our Venue Partner Terms and is necessary for your listing to appear on the Platform.
4. How we use your information and our legal basis
Under UK data protection law, we must have a valid legal basis for processing your personal data. The table below explains each purpose for which we use your data and the legal basis we rely on.
| What we use your data for | Legal basis |
|---|---|
| Creating and managing your partner account | Contract performance - necessary to provide you with the service you signed up for |
| Managing your subscription, billing status, and any promotional offer status | Contract performance - necessary to manage the paid service you have subscribed to |
| Enabling you to create and manage your venue profile and deals through the Venue Dashboard | Contract performance - this is the core service we provide to venue partners |
| Tracking your progress in incentive programmes (Exclusive Credit, Win a Free Month) | Contract performance - these are contractual benefits available under your subscription |
| Reviewing and approving or rejecting venue submissions and deal submissions | Contract performance - the approval process is part of the service as described in our Venue Partner Terms |
| Reviewing testimonials submitted through the Venue Dashboard for accuracy and appropriateness | Legitimate interests - to maintain the quality and integrity of published content. Testimonials are only published with your permission. |
| Publishing approved testimonials on the Get Dizzy website | Consent - we only publish your testimonial with your permission, which you can withdraw at any time |
| Sending you service emails (subscription reminders, trial expiry notices, payment failure alerts, deal approval notifications) | Contract performance - these communications are necessary to operate the service |
| Sending you inactivity reminders if you haven't logged in for 30+ days | Legitimate interests - to help you stay engaged with your subscription. You can turn these off at any time in your Notification Preferences in the Venue Dashboard. |
| Sending you marketing emails about Platform features, partner tips, or promotional opportunities | Consent - we only send marketing emails where you have opted in during registration or later through your account settings. You can withdraw consent at any time by clicking the unsubscribe link in any marketing email or updating your preferences in the Venue Dashboard. Withdrawing marketing consent does not affect service emails (such as subscription reminders, payment alerts, and deal approval notifications), which are necessary to operate your account. |
| Collecting page view and usage data via Vercel Analytics | Legitimate interests - to understand how the Venue Dashboard is used and improve the service. Vercel Analytics does not use cookies or create personal profiles, so the impact on your privacy is minimal. |
| Recording your business capacity and licensing confirmations at registration | Legitimate interests - to maintain an evidential record that the partner relationship is entered into on a B2B basis and that the venue holds required licences |
| Preventing fraud, abuse, and unauthorised access to accounts | Legitimate interests - to protect the security of the Platform and our users |
| Enforcing our Venue Partner Terms and Conditions, including the deal accuracy process | Legitimate interests - to maintain Platform quality and protect consumers |
| Responding to your enquiries or support requests | Legitimate interests - to provide partner support and address your concerns |
| Complying with legal obligations (for example, responding to lawful requests from authorities) | Legal obligation - where we are required by law to process or disclose your data |
Where we rely on legitimate interests, we have carried out a balancing assessment to ensure our interests do not override your rights and freedoms. You can ask us for details of these assessments by contacting legal@getdizzy.ai.
5. Cookies and similar technologies
Our Platform uses very few cookies and tracking technologies compared to most online services. Under the Privacy and Electronic Communications Regulations 2003 (PECR), cookies that are not strictly necessary for the service require your consent before being set.
Cookies
| Type | What | Purpose | Consent required? |
|---|---|---|---|
| Third-party cookies | Google Maps cookies (NID, 1P_JAR, CONSENT, APISID, SID, and similar) | Set by Google when the map view loads (if the Venue Dashboard includes map functionality), to render the map correctly and prevent abuse of the Maps service. Google may also use this data for its own purposes as described in Google's privacy policy. | Yes. These cookies are not essential to the core service and require your consent before being set. |
Browser local storage (data stored in your browser)
Strictly necessary items (no consent required):
| What | Purpose |
|---|---|
| Authentication token | Keeps you logged in to your partner account (managed by Supabase) |
What we do not use
- No advertising cookies or tracking pixels
- No third-party analytics cookies (Vercel Analytics is entirely cookieless)
- No Facebook Pixel, Google Analytics, Hotjar, or similar profiling tools
Managing cookies and storage: You can control cookies through your browser settings. You can also clear localStorage through your browser's developer tools or by clearing site data in your browser settings.
For full details, please see our separate Cookie Policy.
6. Who we share your data with
We share your personal data only where necessary and only with the following categories of recipients.
Service providers who help us run the Platform:
| Provider | What they do | Data they may access | Location | Role |
|---|---|---|---|---|
| Supabase | Hosts our database and manages user authentication | Account data, venue profile data, deal data, incentive programme data | United States | Data processor |
| Vercel | Hosts our website and provides cookieless analytics | IP address (used to derive country-level location, then discarded), page view data | United States | Data processor |
| Provides the Maps service (if used in the Venue Dashboard) | IP address, device data (via Google Maps JavaScript API) | United States | Independent controller for some processing (see below) | |
| Stripe | Processes subscription payments and hosts billing records | Subscription and billing data as described in section 3 | United States | Data processor for payment processing on our behalf; independent controller for Stripe's own fraud prevention and regulatory compliance purposes |
| Resend | Sends emails on our behalf (subscription reminders, notifications, support) | Email address, name | United States | Data processor |
Most of our service providers process your data only on our instructions and are bound by data processing agreements. The exceptions are Google and Stripe, which each act as independent data controllers for some of the data they process. Google determines its own purposes for some data collected through Google Maps (such as security and abuse prevention). Stripe determines its own purposes for fraud prevention and regulatory compliance. For details, please see Google's privacy policy at policies.google.com/privacy and Stripe's privacy policy at stripe.com/privacy.
Consumers: Your venue name, address, description, opening hours, deal descriptions, images, and other content you upload are displayed publicly on the consumer-facing Platform. This is the core purpose of the service. We do not share your personal account details (name, email, login data) with consumers.
Law enforcement and regulators: We may disclose your data where we are legally required to do so, for example in response to a court order or a binding request from a regulatory authority.
Business transfers: If Get Dizzy AI LTD is acquired, merges with another company, or sells all or part of its assets, your personal data may be transferred as part of that transaction. The legal basis for this processing is our legitimate interest in being able to complete a corporate transaction. We will notify you of any such transfer before it takes place and will ensure the terms of your subscription are not materially worsened.
We do not sell your personal data to anyone.
7. Analytics data we provide to you
Through the Venue Dashboard, we provide you with analytics about how consumers interact with your venue listing and deals on the Platform. This section explains how that data is handled.
What we provide: Aggregated counts such as venue profile views, deal views, deal clicks, favourites, and crawl additions. The level of detail depends on your subscription tier.
What we do not provide: We do not share individual consumer personal data with you. You will not see the names, email addresses, locations, or any other identifying information of individual consumers.
Anonymisation: We provide analytics in aggregated form and design them to avoid identifying individual consumers. In some cases, depending on context (for example, at venues with low visitor numbers), analytics data may still be capable of identifying individuals under data protection law. If so, we will put appropriate data processing arrangements in place, which may include entering into a data processing agreement with affected venue partners and ensuring there is a valid legal basis for the data sharing under UK data protection law. We will notify affected partners and update this policy before any such change takes effect.
If this changes: If we introduce features in the future that involve sharing consumer personal data with venue partners (for example, a messaging feature or targeted offer tools), we will put appropriate data processing arrangements in place before those features go live and will update this policy accordingly.
8. International data transfers
Several of our service providers are based in the United States, which means your personal data is transferred outside the United Kingdom.
When we transfer personal data outside the UK, we ensure it is protected by appropriate safeguards as required by UK data protection law. The specific safeguards in place for each provider are:
Providers certified under the UK Extension to the EU-US Data Privacy Framework (DPF):
| Provider | DPF certified | Covers |
|---|---|---|
| Stripe | Yes | EU-US DPF, UK Extension, Swiss-US DPF |
| Yes | EU-US DPF, UK Extension, Swiss-US DPF | |
| Vercel | Yes | EU-US DPF, UK Extension, Swiss-US DPF |
The Data Privacy Framework provides an adequate level of protection for personal data transferred from the UK to certified US organisations, as recognised by the UK government.
Providers relying on Standard Contractual Clauses (SCCs):
| Provider | Transfer mechanism |
|---|---|
| Supabase | UK Addendum to EU Standard Contractual Clauses, incorporated into their Data Processing Agreement |
| Resend | UK Addendum to EU Standard Contractual Clauses, incorporated into their Data Processing Agreement |
For providers relying on SCCs, we have reviewed the transfer arrangements to ensure they provide appropriate protection for your data in light of US law and the specific nature of the data being transferred.
If you would like further details about the safeguards we use for any specific provider, please contact us at legal@getdizzy.ai.
9. How long we keep your data
We keep your personal data only for as long as we need it for the purposes set out in this policy. The specific retention periods are:
| Data type | How long we keep it |
|---|---|
| Account data (name, email, login credentials) | For as long as your account is active, plus up to 30 days in a soft-delete recovery period if you delete your account, after which it is permanently removed |
| Business capacity and licensing confirmations | For as long as your account is active, plus 6 years after account closure (to match the standard limitation period for contractual and civil claims under the Limitation Act 1980) |
| Venue profile data (business name, address, description, opening hours, categories) | For as long as your account is active. Removed from the consumer-facing Platform when your account is closed, subject to the content licence wind-down in our Venue Partner Terms (section 7.3) |
| Content uploads (images, menus, deal descriptions) | For as long as your account is active. Removed from the Platform and our active marketing channels within 30 days of account closure, subject to the content licence provisions in our Venue Partner Terms (section 7.3) |
| Subscription and billing metadata (tier, status, billing dates, billing interval, promotional offer status) | For as long as your account is active. After account closure, we retain this data for up to 2 years for customer support and dispute resolution purposes. We may retain a minimal subset of billing metadata (subscription tier, billing dates, and amounts) for up to 6 years after account closure where necessary to comply with financial record-keeping obligations under UK tax law. Stripe separately retains financial transaction records in accordance with their own retention policies and applicable financial record-keeping requirements. |
| Incentive programme progress (Exclusive Credit days, Win a Free Month goals) | For as long as your account is active. After account closure, retained for up to 12 months to resolve any outstanding credits or disputes. |
| Testimonials | Published testimonials remain on the Get Dizzy website until you withdraw permission or close your account, at which point they are removed within 30 days. Draft or rejected testimonials are deleted within 30 days of account closure. |
| Communications and support data | 2 years from the date of the last communication |
| Analytics data (Vercel) | Up to 26 months (managed by Vercel; no raw IP addresses or personal identifiers stored) |
| Security logs (failed login attempts, rate limit data) | Between 1 hour and 7 days depending on the type of security event |
When a retention period expires, we either delete the data securely or anonymise it so it can no longer identify you.
10. Your rights
Under UK data protection law, you have the following rights over your personal data:
Right of access: You can ask us for a copy of the personal data we hold about you.
Right to rectification: You can ask us to correct any inaccurate or incomplete data. You can also update most of your information directly through the Venue Dashboard.
Right to erasure (right to be forgotten): You can ask us to delete your personal data. You can also delete your account directly through the Venue Dashboard settings, which triggers a 30-day recovery period before permanent deletion in case you change your mind. If you submit a formal erasure request to us rather than using the self-service deletion option, we will action the deletion within one month and will not apply the 30-day recovery period. There may be limited circumstances where we need to retain certain data beyond deletion (for example, to comply with a legal obligation or for the establishment, exercise, or defence of legal claims).
Right to restrict processing: You can ask us to temporarily stop processing your data in certain circumstances, for example while we verify the accuracy of your data following a dispute.
Right to data portability: Where we process your data on the basis of your consent or our contract with you, and that processing is carried out by automated means, you can ask us to provide your data in a structured, commonly used, machine-readable format so you can transfer it to another service.
Right to object: You can object to our processing of your data where we rely on legitimate interests as our legal basis. You also have an absolute right to object to direct marketing at any time.
Right to withdraw consent: Where we process your data based on your consent (for example, publishing your testimonial or sending marketing emails), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.
Automated decision-making: We do not carry out automated decision-making (including profiling) that produces legal or similarly significant effects for venue partners.
How to exercise your rights: Contact us at legal@getdizzy.ai. We will respond within one month. In some cases we may need to verify your identity before acting on your request.
Right to complain: If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk
- Telephone: 0303 123 1113
- Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the chance to address your concerns before you contact the ICO, so please reach out to us first if you can.
11. Account deletion
You can delete your partner account at any time through the Venue Dashboard settings. When you request deletion:
- Your venue listing and deals are removed from the consumer-facing Platform
- Your access to the Venue Dashboard ends
- Your account enters a 30-day recovery period during which you can contact us to reverse the deletion
- After 30 days, your personal data is permanently deleted in accordance with the retention periods set out in section 9
- Content uploads (images, menus) are removed from the Platform and our active marketing channels within 30 days, subject to the content licence provisions in our Venue Partner Terms (section 7.3)
- Published testimonials are removed from the Get Dizzy website within 30 days
If you submit a formal erasure request to legal@getdizzy.ai instead of using the self-service option, we will action the deletion within one month and will not apply the 30-day recovery period. We may retain limited data where required by law or for the establishment, exercise, or defence of legal claims, as set out in the retention periods in section 9.
12. Security
We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it. These include:
- Encrypted data transmission (HTTPS/TLS) across the entire Platform
- Secure password hashing (we never store your password in plain text)
- Authentication tokens stored locally on your device, not in cookies
- Rate limiting on login attempts to prevent brute-force attacks
- CSRF (cross-site request forgery) protection
- Role-based access controls limiting who within our team can access your data
- Regular security reviews of our codebase and infrastructure
While we take all reasonable steps to protect your data, no system is completely secure. We encourage you to use a strong, unique password for your Get Dizzy account and to keep your login details confidential.
13. Links to other websites
Our Platform may contain links to third-party services (such as Google Maps and Stripe). This privacy policy applies only to our Platform. When you follow a link to another website, their own privacy policy applies. We encourage you to read the privacy policies of any website you visit.
14. Changes to this policy
We may update this privacy policy from time to time to reflect changes to our practices, technology, or legal requirements.
Where changes are significant, we will notify you by email (using the address linked to your partner account) before the changes take effect.
We encourage you to review this policy periodically. The "last updated" date at the top of this page tells you when it was most recently revised.
15. Contact us
If you have any questions, concerns, or requests regarding this privacy policy or your personal data, please contact us:
- Email: legal@getdizzy.ai
- Post: Get Dizzy AI LTD, 340 The Crescent, Colchester, England, CO4 9AD
We aim to respond to all enquiries as soon as reasonably practicable, and to all formal data subject requests within one month as required by law.