Terms and conditions

These general terms and conditions apply to all services offered by Vizibly.

Article 1. General information and version

Vizibly
't Zanddorp 55
4335 AE Middelburg
The Netherlands
Chamber of Commerce (KvK): 68478143
VAT ID: NL002185007B14
Email: info@vizibly.nl
Phone: +31 6 282 064 10

These terms and conditions are version 2.1 and apply to all agreements concluded on or after September 5, 2026. An ongoing agreement remains subject to the version that was made available to the client when that agreement was entered into, except as provided in Article 25.

Article 2. Definitions

In these terms and conditions, the following definitions apply:

Vizibly: the sole proprietorship Vizibly, established in Middelburg, registered in the Trade Register (Handelsregister) under number 68478143.

Client: the legal entity or natural person acting in the course of a profession or business that enters into an agreement with Vizibly.

Agreement: the quotation or engagement confirmation accepted by the client, together with the associated annexes and these general terms and conditions.

Services: all work that Vizibly performs under the agreement.

Platform: an external advertising, measurement or publishing service of a third party, including Google Ads, Google Analytics, Google Search Console, Google Tag Manager, Meta Ads and Meta Business Manager.

Advertising account: an account with a platform in which advertisements, measurements or conversion data are managed.

Media budget: the amount that the client pays directly to a platform for displaying advertisements. The media budget is not a fee for Vizibly.

Engaged third party: a party engaged by Vizibly in the performance of the agreement, including specialists, suppliers and hosting providers.

In writing: by letter, by email or through another digital messaging channel that the parties use in the context of the agreement, including a messaging service such as WhatsApp.

GDPR: Regulation (EU) 2016/679 (General Data Protection Regulation).

Data processing annex: Annex 1 to these terms and conditions, which governs the processing of personal data by Vizibly on behalf of the client. The data processing annex forms part of these terms and conditions.

Article 3. Applicability and order of precedence

3.1 These terms and conditions apply to all quotations, offers and agreements between Vizibly and the client, and to the phase preceding them.

3.2 The client’s general terms and conditions are expressly rejected and do not apply, unless Vizibly has accepted their applicability in writing.

3.3 In the event of a conflict between documents, the following order of precedence applies, with the document listed first prevailing:

• a. the data processing annex (Annex 1 to these terms and conditions) insofar as the processing of personal data is concerned, or a data processing agreement concluded separately by the parties;
• b. the quotation or engagement confirmation accepted by the client;
• c. the service-specific annexes belonging to the agreement;
• d. these general terms and conditions.

3.4 If a provision of these terms and conditions is null and void or is annulled, the remaining provisions remain fully in force. In that case, the parties will consult in order to replace the provision concerned with a provision that comes as close as possible to its intent.

Article 4. Services

4.1 Vizibly offers online marketing services, including search engine optimization (SEO), SEO copywriting, technical optimization, link building, web design and website development, conversion optimization, setting up measurement and tagging, and managing advertisements on platforms including Google Ads and Meta Ads.

4.2 These services can be provided on a project basis or on a subscription basis, depending on the agreement with the client.

4.3 Vizibly is entitled to have the agreement performed in whole or in part by engaged third parties. In that case, Vizibly remains the client’s sole contracting party and is responsible for directing those third parties. Article 8 applies.

4.4 If Vizibly charges a fee for managing advertisements in addition to the media budget, that fee is communicated to the client in writing in advance and stated separately on the invoice.

Article 5. Quotations, agreements and additional work

5.1 All prices and rates are agreed in advance and are based on the specific quotation for the client. Quotations from Vizibly are non-binding and are valid for 30 days, unless stated otherwise. All amounts are exclusive of VAT, unless expressly stated otherwise.

5.2 Only the work expressly described in the quotation falls within the scope of the engagement.

5.3 Verbal commitments, presentations, forecasts, benchmarks, examples from other engagements, the results of a Quick Scan and offers from third parties do not bind Vizibly. Only the written quotation, the associated annexes and these terms and conditions determine the content of the agreement.

5.4 If the quotation includes a one-time configuration, start-up or setup, it is invoiced in advance and must be paid before the work starts.

5.5 Work that is not described in the quotation is additional work. Additional work is only carried out after the client’s written approval and is charged separately at the hourly rate stated in the quotation or, failing that, at the hourly rate communicated by Vizibly in writing in advance, exclusive of VAT, unless a fixed price has been agreed in advance.

5.6 Additional work includes in any event: work for a brand, domain, location, advertising account or platform other than those named in the quotation, and remedial work resulting from actions of the client or of a third party not engaged by Vizibly.

5.7 Each additional brand, domain or advertising account requires a separate scope, a separate media budget and a separate price agreement, and does not fall within the agreed fee.

Article 6. Payment

6.1 Invoices must be paid within 14 days of the invoice date, unless otherwise agreed in the quotation. This payment period is a strict deadline (fatale termijn).

6.2 In the event of late payment, the client owes, by operation of law and without any notice of default, the statutory commercial interest referred to in Article 6:119a of the Dutch Civil Code (Burgerlijk Wetboek) from the due date until the date of full payment.

6.3 In addition, the client owes extrajudicial collection costs of 15 percent of the outstanding principal, with a minimum of €150. This is without prejudice to the statutory minimum of €40 that is owed in any event under a commercial agreement.

6.4 The client is not entitled to suspend payment or to set it off against a claim that it believes it has against Vizibly. A complaint about the services or about an invoice does not suspend the payment obligation.

6.5 Vizibly is entitled to suspend the performance of the services and the granting of access to engaged third parties for as long as an invoice that is due remains unpaid, after prior written notice. In that case, Vizibly is not liable for missed results, lost campaign history or delay.

6.6 The media budget is paid by the client directly to the platform concerned, does not form part of the fee to Vizibly, and does not pass through Vizibly. Vizibly is not a party to that payment. Article 11 applies.

Article 7. Performance and cooperation of the client

7.1 Vizibly will endeavor to perform the services to the best of its ability and with care, in accordance with the standards of good workmanship.

7.2 The client provides, in good time, all information that is necessary for the performance of the agreement, and grants Vizibly and the third parties engaged by Vizibly, in good time and on an ongoing basis, the necessary access to, and rights in respect of, the systems and accounts required for the performance, including the website, the content management system, Google Analytics, Google Search Console, Google Tag Manager, Google Ads and Meta Business Manager.

7.3 If the client, or a party engaged by the client, does not carry out a request from Vizibly within five business days, the schedule shifts by the same period. The resulting delay, and the advertising budget spent during that period while the intended setup is not working, are at the client’s expense and risk.

7.4 If access is not granted, is withdrawn or is restricted, Vizibly is entitled to suspend the work. In that case, the subscription fee remains due and Vizibly is not liable for the resulting delay or missed results.

7.5 Vizibly is entitled to charge the additional costs resulting from this as additional work.

Article 8. Engagement of third parties

8.1 Vizibly is entitled to engage third parties in the performance of the agreement, including where that third party is established outside the Netherlands or outside the European Economic Area.

8.2 The client expressly agrees that the services may be performed in whole or in part by an engaged third party. Vizibly remains the client’s sole contracting party and remains responsible for directing and communicating with that third party.

8.3 Vizibly is liable for the conduct of engaged third parties in the same way as for its own conduct, subject to the limitations in Article 15. To that extent, the parties expressly derogate from Article 6:76 of the Dutch Civil Code.

8.4 Vizibly imposes on every engaged third party at least a confidentiality obligation equivalent to the one in Article 19, and requires that third party to cooperate in meeting the obligations that rest on the parties under Article 22.

8.5 If an engaged third party processes personal data on behalf of the client, only the provisions of Article 22 and of the data processing annex apply to that processing.

Article 9. Term and termination

9.1 Agreements are entered into for the term stated in the quotation. A separate term may apply to each service. Termination of one service does not affect the term of any other service.

9.2 An agreement for a fixed term cannot be terminated before the end of its term. The parties hereby expressly and unequivocally derogate from Article 7:408(1) of the Dutch Civil Code and from Article 7:411 of the Dutch Civil Code. This article contains an exhaustive arrangement for termination and for the settlement of accounts in the event of early termination.

9.3 If the engagement consists of several phases, the settlement set out per phase in the quotation applies in the event of early termination. Amounts already invoiced for completed or commenced phases remain fully due.

9.4 If the agreement includes an interim sign-off point, the following applies: if the client does not respond within the period stated in the quotation, Vizibly sends one written reminder. If there is still no response after that, the proposal submitted at that point is deemed approved. The schedule shifts for as long as approval is not given.

9.5 An agreement for an indefinite term can be terminated by either party in writing as of the end of a calendar month, subject to a notice period of one month, unless agreed otherwise.

9.6 When the agreement ends, the following applies:

• a. the advertising, measurement and tag accounts remain with the client and are not blocked, deleted or transferred to a third party;
• b. the access rights of Vizibly and of the engaged third parties are revoked within ten business days;
• c. campaign data and reports are delivered on request within ten business days, insofar as technically possible, and their delivery may be charged as additional work;
• d. only the provisions of the data processing annex apply to personal data.

Article 10. Results and guarantees

10.1 All services are performed on the basis of an obligation to use best efforts (inspanningsverbintenis) and not on the basis of an obligation to achieve a result (resultaatsverbintenis).

10.2 Because of the constant changes in search engine algorithms, in the policies and systems of platforms, in competition and in other external factors, Vizibly gives no guarantee of:

• a. specific positions in Google or other search engines;
• b. a certain level of traffic, number of inquiries or revenue;
• c. a certain cost per click, per lead or per conversion;
• d. a certain return on ad spend;
• e. a certain number of impressions or a certain ad position;
• f. a certain conversion rate;
• g. the approval of advertisements by a platform or the status of an advertising account;
• h. an exact timeline within which results become visible.

10.3 Statements about expected results, forecasts, benchmarks, sample calculations and results from other engagements are indicative and do not constitute a commitment or a guarantee.

10.4 What Vizibly does set out in writing is its way of working: the reporting frequency stated in the quotation, the number of evaluations stated there and the deliverables stated there.

Article 11. Media budget

11.1 The media budget is paid by the client directly to the platform. The client is responsible for the availability of the budget and for a valid, working payment method in the advertising account.

11.2 If the media budget is stopped, runs out or is not paid to the platform, the campaigns come to a halt. This is at the client’s expense and risk. In that case, the agreed fee to Vizibly remains payable in full.

11.3 An agreed monthly or daily budget is a target amount. Platforms may exceed daily budgets under their own methodology. Vizibly is not liable for overspending that falls within that methodology.

11.4 Vizibly is only liable for spent media budget if the spending is the direct result of a demonstrable configuration error by Vizibly or by an engaged third party, and only up to a maximum of €2,500 per event. The limitations of Article 15 continue to apply.

11.5 The client has access at all times to the costs in its own advertising accounts and monitors them itself. The client must report a suspected deviation to Vizibly in writing within five business days of its occurrence, failing which any right to compensation in that respect lapses.

11.6 The parties record who may pause or stop campaigns and within what period that happens. In the absence of such an arrangement, both the client and Vizibly are authorized to do so, with immediate notification to the other party.

Article 12. Accounts, ownership and access

12.1 All advertising, measurement and tag accounts are in the name of the client and remain so during and after the end of the agreement.

12.2 The client itself accepts the terms of the platforms concerned, links the payment method and enters the contact details requested by the platform, including the data protection contacts. Vizibly and the engaged third parties do not do so in their own name.

12.3 Vizibly and the third parties engaged by Vizibly receive user rights only. The client retains the administrator rights to its accounts at all times.

12.4 The client is and remains bound by the terms and the advertising policies of the platforms and indemnifies Vizibly against claims arising from content, advertising claims, prices or images supplied by the client.

12.5 When the agreement ends, Article 9.6 applies. Vizibly does not use any form of account blocking as a means of pressure.

Article 13. Platform risk

13.1 The platforms decide independently whether and how advertisements are displayed and give no guarantee of reach, placement or results. They may reject, restrict, suspend or terminate advertisements, campaigns and accounts.

13.2 Vizibly is not liable for the rejection, restriction, blocking, suspension or removal of advertisements, campaigns or accounts by a platform, nor for changes in the policies, terms, systems or algorithms of a platform, unless this is the direct result of Vizibly’s own error or of an error by an engaged third party.

13.3 If a platform communicates directly with the client as the account holder, the client informs Vizibly of this without delay.

13.4 Remedial work after an event as referred to in Article 13.1 is additional work, unless the final part of Article 13.2 applies.

Article 14. Measurement, baseline measurement and reporting

14.1 Before the work starts, Vizibly records a baseline measurement using the figures available at that time, stating the source and the period. The client confirms that baseline measurement in writing within five business days. The baseline measurement is the reference point for every assessment of results.

14.2 Reported figures come from the platforms and measurement tools of third parties. Discrepancies between sources are inherent in cookie consent, attribution models and the settings of those platforms. The platform’s report is decisive for assessment and settlement.

14.3 If the measurement setup is changed or cleaned up, the reported number of conversions may drop because actions that were previously counted more than once now count only once. Figures from before and after such a change are not automatically comparable. Vizibly records the new starting point in writing.

14.4 A valid and working consent solution on the client’s website, including keeping proof of consent, is a prerequisite for a reliable measurement setup and is the responsibility of the client. If it is missing, or does not work properly, Vizibly is not liable for the resulting measurement loss or for the advertising costs spent during that period.

Article 15. Liability

15.1 Vizibly is not liable for indirect damage, consequential damage, lost profits, lost savings, loss of goodwill, loss of data or damage due to business interruption.

15.2 Vizibly’s liability is limited, per event and per calendar year, to the higher of:

• a. the amount that the client paid to Vizibly in the three months preceding the event that caused the damage; or
• b. the invoice amount of the engagement to which the liability relates.

15.3 Vizibly is not liable for errors or shortcomings that result from incomplete or incorrect information provided by the client.

15.4 The limitations in this article also apply with regard to the conduct of engaged third parties, and do not apply if the damage is the result of intent or deliberate recklessness on the part of Vizibly.

15.5 The client indemnifies Vizibly against third-party claims relating to data, texts, images, advertising claims, prices or instructions supplied by the client, or to the client’s use of the services provided, unless the claim is the result of intent or deliberate recklessness on the part of Vizibly.

15.6 Notwithstanding the provisions of this article, the liability of the parties toward data subjects under Article 82 GDPR cannot be limited by contract. The allocation of liability between the parties with regard to the processing of personal data is governed by the data processing annex.

Article 16. Complaints and time limit for claims

16.1 The client must report a defect in the performance to Vizibly in writing and in detail within 30 days of its discovery.

16.2 The client must report objections to an invoice in writing and in detail within 14 days of the invoice date. An objection does not suspend the payment obligation.

16.3 After a report as referred to in Article 16.1, the parties will consult. Vizibly is given a reasonable period to remedy a defect before the client invokes other legal remedies.

16.4 Any claim of the client lapses if the client has not brought legal proceedings within twelve months after discovering the damage or after the moment it reasonably should have discovered it, and in any event twenty-four months after the event that caused the damage.

Article 17. Force majeure

17.1 In the event of force majeure, Vizibly is not obliged to fulfill any obligation.

17.2 Force majeure includes, among other things: disruptions of the internet, telecommunications or other infrastructure, power outages, government measures, changes in laws or regulations, changes in the policies, terms, systems or algorithms of platforms, suspension or termination of accounts other than through the actions of Vizibly, and failures of suppliers and engaged third parties insofar as these cannot be attributed to Vizibly.

17.3 During force majeure, Vizibly’s obligations are suspended. If the force majeure lasts longer than two months, either party may rescind the agreement, without either party becoming liable to pay compensation.

Article 18. Intellectual property and rights of use

18.1 All materials supplied by Vizibly, including texts, designs, analyses, code, ad copy, images, campaign structures and measurement setups, become the property of the client after full payment insofar as the rights of use are concerned.

18.2 Until full payment has been made, Vizibly grants only a revocable license to use those materials. If the client is in default, Vizibly is entitled to suspend that license.

18.3 The underlying techniques, methods and tools that Vizibly uses remain the intellectual property of Vizibly. Vizibly has the right to apply the knowledge and techniques it has gained to other engagements as well, provided that no confidential information of the client is disclosed to third parties in doing so.

18.4 The license terms of the third parties concerned continue to apply to third-party components and open source software.

18.5 The practical transfer of the repository, hosting, domain names and accounts takes place as described in the quotation. If nothing has been agreed on this, Vizibly will cooperate in a reasonable transfer after full payment, and may charge the work involved as additional work.

Article 19. Confidentiality

19.1 Both parties are obliged to keep confidential all confidential information that they have obtained from each other in the context of their agreement. This obligation remains in force after the end of the agreement.

19.2 Vizibly may share confidential information with third parties it has engaged, provided that they are bound by an equivalent confidentiality obligation.

19.3 Vizibly will only use client data in anonymized form for case studies, unless the client has given express consent for this.

Article 20. References

20.1 Unless the client expressly objects, Vizibly has the right to include the client in a public client list and to mention the client as a reference in marketing materials.

20.2 An objection is made known in writing. In that case, Vizibly removes the mention within a reasonable period.

Article 21. Work by third parties on the client’s website and systems

21.1 Vizibly is not responsible for the availability, speed, security, updates or configuration of the client’s website and systems, insofar as these are managed by the client itself or by a party not engaged by Vizibly.

21.2 Vizibly is not liable for the consequences of changes made by the client or by such a party, including:

• a. negative effects on search engine positions, traffic or revenue;
• b. the complete or partial failure of measurement, tracking codes, tags or pixels;
• c. the loss of historical measurement data;
• d. forms, landing pages or thank-you pages not functioning properly.

21.3 Vizibly is not liable for advertising costs that continue to accrue while the website, a landing page, a form or the measurement is not working properly through no fault of Vizibly.

21.4 Remedial work resulting from the provisions of this article is additional work.

21.5 The client notifies Vizibly in advance of intended changes to the website or to the measurement setup. Vizibly strongly advises against making changes without prior consultation, particularly where SEO, measurement or conversion-related elements are concerned.

21.6 If Vizibly performs work in a system that is managed by a third party, the client ensures that a working backup is available before that work begins. Vizibly is not liable for damage arising from conflicts with plugins, themes, settings or updates that have been installed or changed by third parties.

Article 22. Processing of personal data

22.1 If, in the performance of the agreement, Vizibly processes personal data on behalf of the client, the client is the controller and Vizibly is the processor within the meaning of the GDPR. That processing is governed by Annex 1 to these terms and conditions (the data processing annex). The data processing annex forms an integral part of these terms and conditions and thus of the agreement, and applies between the parties as the contract referred to in Article 28(3) GDPR. A separately signed data processing agreement is not required for this.

22.2 If, for a specific engagement, the parties wish to make different or additional arrangements on the processing of personal data, they record these in a separate written data processing agreement. In the event of a conflict, that separate agreement takes precedence over the data processing annex.

22.3 The data processing annex governs in any event: the subject matter, the duration, the nature and the purpose of the processing, the type of personal data, the categories of data subjects, the rights and obligations of the client, the security measures, the sub-processors engaged, transfers outside the European Economic Area, assistance with requests from data subjects and with data breaches, and the return or deletion of data at the end of the agreement.

22.4 By entering into the agreement, the client grants general written authorization within the meaning of Article 28(2) GDPR for the engagement of the sub-processors named in the data processing annex. If Vizibly adds or replaces a sub-processor, it notifies the client of this in writing at least thirty days before the intended effective date. The client may object in writing, stating reasons, within fourteen days of that notification. An objection is well-founded if, in the reasonable opinion of the client, the change leads to a lower level of protection for the data subjects. The consequences of a well-founded objection are governed by the data processing annex.

22.5 If personal data is transferred to, or made accessible to, a party outside the European Economic Area, this only takes place with a valid safeguard as referred to in Chapter V of the GDPR. If there is no adequacy decision of the European Commission for the country concerned, the transfer is based on the standard contractual clauses adopted by the European Commission, supplemented by an assessment of the transfer situation. The data processing annex states the safeguard used for each sub-processor. The client may request a copy of it.

22.6 Remote access from a country outside the European Economic Area counts as a transfer within the meaning of Article 22.5, even if the data itself remains stored within the European Economic Area.

22.7 Vizibly notifies the client of a personal data breach without undue delay and no later than 24 hours after becoming aware of it, so that the client can meet its own statutory notification deadline.

22.8 The client warrants that there is a valid legal basis for the processing and, where required, valid consent for cookies, tracking codes and advertising tags on its website, and that it has a correct and complete privacy policy of its own.

22.9 Vizibly takes appropriate technical and organizational measures to secure personal data. Those measures are described in the data processing annex.

22.10 For processing in which Vizibly itself determines the purpose and the means, including its own records, its client contact and the accounts of its client dashboard, Vizibly is a controller in its own right. The data processing annex does not apply to that processing. Vizibly informs data subjects about it in its own privacy policy.

Article 23. Non-solicitation of engaged third parties

23.1 During the term of the agreement and for twelve months thereafter, the client is not permitted, without the prior written consent of Vizibly, to enter into an agreement, directly or through an affiliated company, with a third party that Vizibly engaged in the performance of the agreement, for work similar to the work under this agreement.

23.2 In the event of a breach of Article 23.1, the client must compensate Vizibly for the loss it suffers as a result.

Article 24. Applicable law and disputes

24.1 All agreements between Vizibly and the client are governed by Dutch law.

24.2 Disputes are submitted to the competent court in the district in which Vizibly is established, unless mandatory law provides otherwise.

24.3 The provisions of Article 24.1 and Article 24.2 also apply to disputes arising from the pre-contractual phase and to claims in tort (onrechtmatige daad) related to the agreement.

24.4 The parties will first make every possible effort to settle a dispute by mutual consultation.

Article 25. Amendment of these terms and conditions

25.1 Vizibly is entitled to amend these general terms and conditions if there is an objective reason for doing so, namely:

• a. a change in laws or regulations or in binding case law;
• b. a change in the terms, policies or systems of platforms or suppliers on which the services depend;
• c. a demonstrable change in the cost structure;
• d. a technical or organizational necessity.

25.2 An amendment is announced to the client in writing and takes effect 30 days after that announcement.

25.3 If the amendment materially disadvantages the client, the client may terminate the agreement as of the date on which the amendment takes effect, without any costs being charged for this.

25.4 An ongoing agreement remains subject to the version that was made available to the client when that agreement was entered into, unless an amendment is based on one of the grounds listed in Article 25.1.

Annex 1. Processing of personal data (data processing annex)

This annex belongs to the general terms and conditions of Vizibly, version 2.1, and governs the processing of personal data by Vizibly on behalf of the client, as referred to in Article 22 of those terms and conditions. Where this annex refers to “the agreement,” this means the agreement between Vizibly and the client to which the general terms and conditions apply. Where it refers to “the terms and conditions,” this means the general terms and conditions of Vizibly.

1. Definitions

1.1 In this annex, the following definitions apply:

• a. GDPR: Regulation (EU) 2016/679 (General Data Protection Regulation);
• b. personal data: the personal data that Vizibly processes on behalf of the client in the context of the agreement, as described in Article 3 of this annex;
• c. sub-processor: another processor engaged by Vizibly within the meaning of Article 28(2) and (4) GDPR;
• d. data breach: a personal data breach as referred to in Article 4 GDPR;
• e. EEA: the European Economic Area.

1.2 In this annex, terms that are defined in the GDPR have the meaning given to them by the GDPR.

2. Roles and scope

2.1 For the processing described in Article 3, the client is the controller and Vizibly is the processor.

2.2 This annex covers only the processing described in Article 3. It does not cover:

• a. the data of the client’s contact persons that Vizibly processes to create and manage accounts for its client dashboard and for the use of that dashboard;
• b. the data of the client and its contact persons that Vizibly processes for its own records, invoicing, client contact and statutory retention obligations;
• c. processing that took place before the agreement was concluded, including an exploratory scan or analysis in the offer phase;
• d. processing by parties with which the client itself has a legal relationship, including the providers of the measurement, tag and advertising platforms and the client’s hosting provider.

For the processing under a and b, Vizibly is itself the controller. It informs data subjects about this in the privacy policy on vizibly.nl.

2.3 Vizibly does not process the personal data for its own purposes. If Vizibly wishes to use the outcomes of processing for a purpose of its own, including a benchmark or a publication, it does so only with the prior written consent of the client and only with anonymized outcomes.

3. Which processing, for what purpose and for how long

3.1 Which of the processing operations below take place follows from the services agreed in the quotation or engagement confirmation. Processing that does not follow from these does not take place.

3.2 The nature of the processing consists of accessing, analyzing, structuring, storing, forwarding and erasing. The purpose is to provide the agreed services and to report on them to the client.

3.3 The processing lasts as long as the agreement lasts. Vizibly’s access to the client’s accounts and properties ends when the agreement ends. Data stored in Vizibly’s client dashboard is returned or deleted when the agreement ends, in accordance with Article 11 of this annex. The client itself determines the retention periods within its platforms, in the settings of those platforms. The retention periods at sub-processors follow from the settings and terms of those service providers.

3.4 The parties acknowledge that no special categories of personal data within the meaning of Article 9 GDPR and no data relating to criminal convictions within the meaning of Article 10 GDPR are requested. A free text field or an upload option on a form may be used by a data subject on their own initiative for such data; the parties will endeavor to limit this. The client informs Vizibly in writing as soon as the nature of the data requested changes.

4. Processing only on instructions

4.1 Vizibly processes the personal data only on the basis of written instructions from the client, including with regard to transfers to a country outside the EEA, unless a statutory provision that applies to Vizibly requires it to process the data. In that case, Vizibly informs the client in advance, unless that legislation prohibits this.

4.2 The quotation or engagement confirmation, this annex and a plan or strategy document approved in writing by the client count as the instructions of the client.

4.3 Additional or different instructions are given in writing by the client’s contact person. A verbal instruction is confirmed in writing within five business days; without that confirmation, Vizibly is not obliged to carry out the instruction.

4.4 If Vizibly believes that an instruction infringes the GDPR, it notifies the client of this immediately and may suspend performance until the client has responded in writing. Vizibly is not liable for the consequences of that suspension.

4.5 Vizibly submits to the client in writing, in advance, any change to what is measured, to which events count as conversions and to which recipients personal data is passed on. Such changes are only implemented after the client has approved them.

5. Confidentiality

5.1 Vizibly keeps the personal data confidential and does not provide it to third parties, except insofar as this is necessary for the performance of the agreement, follows from this annex or is required by law.

5.2 Vizibly ensures that every person who, under its responsibility, has access to the personal data, including engaged third parties and sub-processors, is bound by a duty of confidentiality.

5.3 Vizibly grants access to the personal data only to persons who need that access for their work, and no further than that work requires.

5.4 The duty of confidentiality remains in force after the end of the agreement.

5.5 If a third party, including a government authority, demands the disclosure of or access to the personal data, Vizibly informs the client of this without delay, unless this is prohibited by law, and provides no more than it is legally required to provide.

6. Security

6.1 Vizibly takes appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as referred to in Article 32 GDPR.

6.2 Vizibly is a sole proprietorship. It does not have an ISO certification, a SOC 2 attestation, continuous monitoring by an external security team or periodic penetration tests by a third party. Where such measures are present in the chain, they come from the engaged service providers.

6.3 As of the date of this version, the following measures are in place:

• a. access to systems containing personal data through personal accounts, without shared login credentials, with two-factor authentication and with passwords stored in a password manager;
• b. access according to the principle of least privilege; access to the client’s Google Analytics and Google Search Console is through a Vizibly account with read-only access, unless otherwise agreed in writing for a specific engagement;
• c. the database with performance and dashboard data is located in a data center within the European Union, with row-level access control, encrypted storage and encrypted transport (TLS);
• d. the connection tokens used to maintain the connection with the client’s platforms are additionally stored in encrypted form, with the key kept outside the database;
• e. the websites built by Vizibly and the client dashboard are only accessible over HTTPS; forms have server-side validation and measures against automated abuse; a Content Security Policy applies to the client dashboard;
• f. the error monitoring is set up without personal data and without session recordings; login attempts on the client dashboard are logged and rate-limited;
• g. the work devices have full disk encryption, automatic locking and current security updates; no personal data of the client is stored on removable media; exports are only made for a specific engagement and are deleted afterward;
• h. where possible, only aggregated outcomes are stored in the client dashboard, and no data at visitor level;
• i. the source code is kept under version control, the database is backed up automatically by the service provider, and the dashboard data is derived data that, if lost, can be retrieved again from the client’s source systems.

6.4 Vizibly may change these measures, provided that the level of security does not decrease as a result. It notifies the client of material changes in writing.

6.5 The client itself is responsible for the security of the systems, accounts and environments that it manages itself or has managed by a party other than Vizibly, including the hosting, the maintenance, the updates and the plugins of its website, insofar as these have not been expressly assigned to Vizibly.

7. Sub-processors

7.1 In Article 22.4 of the terms and conditions, the client has given Vizibly general authorization to engage sub-processors. The procedure for adding or replacing a sub-processor is set out in that article.

7.2 As of the date of this version, Vizibly engages the following sub-processors. Which of them are actually involved in an engagement follows from the agreed services.

7.3 For processing outside the EEA by these sub-processors, the safeguard is the standard contractual clauses adopted by the European Commission or a certification under the EU-U.S. Data Privacy Framework, as included in the data processing terms of the service provider concerned. Vizibly provides a copy or a reference on request.

7.4 In the event of a well-founded objection as referred to in Article 22.4 of the terms and conditions, the parties will consult. Vizibly does not engage the sub-processor concerned for as long as the objection has not been resolved. If the parties do not reach a solution within thirty days and the service concerned cannot reasonably be provided without that sub-processor, either party may terminate the relevant part of the agreement as of the date on which the change would take effect. The client still owes the fee for the work performed up to that moment. Neither party has any further claims against the other.

7.5 By written agreement, Vizibly imposes on each sub-processor essentially the same data protection obligations as those set out in this annex. Vizibly remains fully liable to the client for the performance of those obligations by the sub-processor, in accordance with Article 28(4) GDPR. On request, Vizibly provides a copy of the arrangements with a sub-processor insofar as they concern data protection; commercially confidential information may be redacted.

7.6 The providers of the measurement, tag and advertising platforms, including Google Ireland Limited (Google Analytics, Google Search Console, Google Tag Manager, Google Ads) and Meta Platforms Ireland Limited, and the client’s hosting provider are not sub-processors of Vizibly. The client has its own legal relationship with those parties and accepts their terms itself.

7.7 If Vizibly engages a person who, under Vizibly’s responsibility, performs work for the client and in doing so gains access to personal data, Vizibly gives notice of this in accordance with the procedure in Article 22.4 of the terms and conditions, and the same obligations apply to that person as to Vizibly.

8. Transfers outside the EEA

8.1 Vizibly processes the personal data within the EEA, except insofar as stated otherwise in Article 7 or the client instructs otherwise in writing.

8.2 A transfer to a country outside the EEA, including making personal data remotely accessible to a party outside the EEA, only takes place in accordance with Chapter V GDPR. For a country without an adequacy decision of the European Commission, Vizibly uses the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914) and carries out a documented assessment of the circumstances of the transfer. The client may request a copy of those documents; commercially confidential information may be redacted.

8.3 The client hereby instructs Vizibly to carry out the transfers that follow from Article 7, on the basis of the safeguard stated there.

8.4 If, in the opinion of Vizibly, a safeguard is no longer adequate, Vizibly informs the client without delay and the parties will consult on additional measures or on ending the transfer concerned.

9. Assistance with data subject rights and with security

9.1 Taking into account the nature of the processing, Vizibly assists the client in responding to requests from data subjects under Chapter III GDPR. If Vizibly itself receives a request from a data subject, it forwards that request within two business days to the client’s contact person, without responding to the data subject on the substance.

9.2 At the written request of the client, Vizibly provides, within five business days, the data and the cooperation needed to handle a request from a data subject, including looking up, providing, correcting, restricting or deleting personal data.

9.3 Taking into account the nature of the processing and the information available to Vizibly, Vizibly assists the client in complying with the client’s obligations under Articles 32 through 36 GDPR. This assistance includes in any event information about the security measures taken, the information the client needs to assess and report a data breach, and information for a data protection impact assessment or a prior consultation of the supervisory authority.

9.4 Standard assistance falls within the agreed fee. Assistance that by its nature or scope goes beyond what reasonably fits within the services counts as additional work and is charged, after a prior written order from the client, at the rate for additional work stated in the agreement. Vizibly makes the expected scope known in advance.

10. Data breaches

10.1 Vizibly reports a data breach to the client’s contact person, by email and by phone, without undue delay and no later than 24 hours after becoming aware of it.

10.2 The report contains, insofar as available, the information listed in Article 33(3) GDPR: the nature of the data breach, where possible including the categories and the estimated number of data subjects and data records concerned; the contact details for more information; the likely consequences; and the measures taken or proposed. If not all information is available at the same time, Vizibly reports without delay what is known and supplements the report without undue delay.

10.3 Vizibly does not report a data breach to the supervisory authority or to data subjects on its own initiative and makes no statements about it to third parties, unless the client requests this in writing or Vizibly is required to do so by law.

10.4 Vizibly takes reasonable measures without delay to limit the data breach and to prevent recurrence, keeps a record of every data breach and makes that record available to the client on request.

11. Return, deletion and revocation of access

11.1 After the end of the agreement, Vizibly, at the client’s choice, erases all personal data or returns it, and deletes existing copies.

11.2 The client makes that choice known in writing within thirty days after the end of the agreement. If no choice is made, Vizibly proceeds to deletion after a written reminder.

11.3 Vizibly carries out the chosen action within thirty days of receiving the choice, or of the expiry of the period in Article 11.2, and confirms in writing that it has been carried out.

11.4 Data is returned in a common, machine-readable file format, insofar as technically possible. A return that by its nature or scope goes beyond a standard export counts as additional work in accordance with Article 9.4.

11.5 By way of derogation from Article 11.1, personal data is retained insofar as a statutory provision requires Vizibly to retain it, including the tax retention obligation for the accounting records. That exception applies only to the data covered by the retention obligation and for the duration of that obligation. Articles 5 and 6 continue to apply to that data.

11.6 When the agreement ends, Vizibly revokes, within ten business days, all access rights to the client’s systems and accounts that were granted to Vizibly and to its sub-processors, and confirms this in writing. The accounts themselves remain the client’s and remain available to the client. Vizibly does not block those accounts in any way.

12. Information, audit and record

12.1 Vizibly makes available to the client all information necessary to demonstrate compliance with Article 28 GDPR, and enables audits by the client or by an auditor mandated by the client.

12.2 Vizibly responds to an audit request in the first instance by providing the requested information in writing within twenty business days, including a description of the measures taken and the current list of sub-processors.

12.3 If the client reasonably considers that information insufficient, it may have an on-site or remote audit carried out, subject to the following: no more than once per calendar year, and in addition whenever there is a concrete indication of non-compliance or a data breach has occurred; with at least thirty days’ written notice; during office hours and without unnecessary disruption of Vizibly’s business operations; by the client itself or by an independent auditor who is not a competitor of Vizibly and signs a confidentiality agreement in advance; and focused exclusively on the processing covered by this annex, not on data of other clients of Vizibly.

12.4 The costs of an audit, including the reasonable hours of Vizibly, are borne by the client. If the audit reveals a material shortcoming on the part of Vizibly, the costs of that audit are borne by Vizibly. Vizibly implements the reasonable and necessary points for improvement from an audit report within a reasonable period to be determined in consultation.

12.5 Vizibly keeps a record of the categories of processing activities that it carries out for the client, in accordance with Article 30(2) GDPR, and makes that record available on request to the client and to the supervisory authority. Data relating to other clients may be redacted in it.

13. Obligations of the client

13.1 The client warrants that:

• a. the processing it assigns to Vizibly has a valid legal basis within the meaning of Article 6 GDPR and is otherwise lawful;
• b. where required, it has valid consent from data subjects for placing and reading cookies and similar technologies and for sharing data with measurement and advertising platforms, and that it keeps proof of that consent;
• c. it has an up-to-date, complete and correct privacy policy that describes the processing, the parties engaged and any transfer outside the EEA;
• d. it gives its instructions to Vizibly in accordance with Article 4;
• e. it informs Vizibly in good time and in full of changes to its website, measurement setup, forms or systems that affect the processing;
• f. the personal data that it provides to Vizibly has been obtained lawfully and that it is entitled to provide that data to Vizibly.

13.2 The client is and remains the holder of the measurement, tag and advertising accounts that are in its name, accepts the terms of the platforms concerned itself and links the payment method itself. Vizibly and its sub-processors receive user rights only.

13.3 Vizibly is not liable for damage arising from the client’s failure to comply with this article. The client indemnifies Vizibly against third-party claims arising from such a failure, including claims by data subjects and the supervisory authority, unless those claims are the result of intent or deliberate recklessness on the part of Vizibly.

14. Liability

14.1 The limitations of liability in Article 15 of the terms and conditions apply to the performance of this annex, subject to this article.

14.2 The liability toward data subjects under Article 82 GDPR cannot be excluded or limited between the parties. A data subject may hold any party involved in the processing liable. This article governs only the relationship between the parties.

14.3 If a party has paid a data subject full compensation for the damage suffered, it may recover from the other party the part of the compensation that corresponds to the other party’s share of the liability, in accordance with Article 82(5) GDPR.

14.4 The limitations of liability do not apply if the damage is the result of intent or deliberate recklessness on the part of Vizibly.

14.5 Each party itself bears any administrative fine imposed on it by the supervisory authority, unless the fine is the direct result of intent or deliberate recklessness on the part of the other party.

15. Term, survival and contact

15.1 This annex applies for as long as the agreement lasts. The provisions that by their nature are intended to survive, including Articles 5, 11 and 14, remain in force after that, and this annex continues to apply for as long as Vizibly still holds personal data of the client.

15.2 If Vizibly materially fails to comply with this annex and does not remedy this within a reasonable period of no more than one month after a written notice of default, the client may instruct Vizibly to suspend the processing in whole or in part and may end the agreement for the relevant part.

15.3 If the client insists on an instruction that, in the opinion of Vizibly, infringes the GDPR, and the parties do not reach agreement on this within thirty days after the notification referred to in Article 4.4, Vizibly may end the agreement for the relevant part.

15.4 The contact person for Vizibly is R. de Clerck, reachable at info@vizibly.nl and +31 6 282 064 10. The contact person for the client is the person who accepted the quotation or engagement confirmation on behalf of the client, unless the client designates a different contact person in writing. A change of contact person is notified in writing and does not require an amendment to this annex.

15.5 Vizibly has not appointed a data protection officer.