Privacy Policy
This Privacy Policy explains how Bizora processes personal data when you visit our website, create an account, use a workspace, contact us or make a payment. Bizora is built in the UK and used by businesses in many countries. This policy applies wherever you are, and section 10 sets out additional information for people in particular countries and regions.
1. Who is responsible for your data?
The controller for Bizora's own processing is FCB Digital Ltd trading as Bizora, a company registered in England and Wales under company number 17483665 ("Bizora", "we", "us" or "our"). Privacy requests and complaints: hello@bizora.co.uk. General support: support@bizora.co.uk.
If your employer or another organisation invites you to a Bizora workspace, that organisation normally decides why your personal data is entered into the workspace. It is generally the controller for that Customer Data, and Bizora processes it on the organisation's instructions. Ask the organisation about its own privacy notice and requests concerning records in its workspace.
2. Personal data we collect
| Data | Examples | Source |
|---|---|---|
| Account data | Name, email address, password hash, optional profile photograph, job title, email-update preference, phone number, time zone, locale and verification status. | You or your organisation. |
| Workspace data | Organisation name, companies, contacts, notes, deals and their values, follow-ups, logged calls, emails and meetings, custom fields your workspace defines and the values entered in them, roles, invitations and documents. | You, your team or an inviting organisation. |
| Spreadsheet imports | The contents of CSV files you upload to import companies and contacts. While you match columns and review the import, the file contents are held temporarily in your server session; they are discarded when you finish or cancel, after one hour, or when your session ends. Only the records you confirm are saved, and the uploaded file itself is not kept. | You. |
| Usage and security data | IP address, login times, session identifiers, rate-limit events, browser/request information and security logs. | Your browser and our systems. |
| Billing data | Stripe customer and subscription identifiers, plan, payment status, invoices and payment dates. We do not receive or store full card numbers. | Stripe and you. |
| Website analytics data (only with your consent) | Pages viewed on our public website, approximate location derived from a truncated IP address, device and browser type, referring page, Google Analytics, Microsoft Clarity and Meta Pixel cookie identifiers, Google advert click identifiers carried in the page address, clicks on our sign-up buttons, whether you completed registration (recorded on our public welcome page after you sign up, without your name or email address), and recordings of mouse movement, clicks and scrolling on our pages (with typed text masked). Not collected inside the Bizora application, sign-in or registration pages. | Your browser, through Google Analytics, Google Ads, Microsoft Clarity and the Meta Pixel, only after you accept cookies. |
| Newsletter sign-ups | Your email address, the page you signed up from, the sign-up wording you agreed to, when you signed up and confirmed, and whether you have unsubscribed. You can sign up without a Bizora account. Sign-ups not confirmed by email within 30 days are deleted. | You, through the sign-up form on our website and the confirmation email. |
| Support and feedback data | Messages, attachments and information you provide when requesting help, and feedback sent from inside the app, which we receive by email with your name, email address and the page you were on. | You. |
| Terms acceptance | The terms version and document fingerprint, acceptance time and whether you registered directly or joined by invitation. We do not collect an additional IP address for this record. | Your account-creation submission. |
| Referral programme | Referral code, linked account/workspace IDs, signup and reward status/times, reward amounts, qualifying invoice/charge IDs and a hash of Stripe's payment-card fingerprint. This is a fraud-control identifier, not a card number. | Your signup/code request, our systems and Stripe. |
The service is intended for ordinary business records. Do not upload or enter special-category or sensitive data (such as health information, racial or ethnic origin, religious beliefs, sexual orientation, biometric or genetic data, precise location or government identification numbers), criminal-offence data, identity documents or payment-card details. This applies to notes, documents and custom fields alike. Any proposed processing of such information requires a separate written assessment and agreement with us before upload.
3. Why we use personal data
| Purpose | Lawful basis |
|---|---|
| Administer your account and provide the service you order. | Contract where you contract with us personally. For staff using an organisation's account, our legitimate interests in administering that organisation's service. Hosted Customer Data is processed on the controller's instructions, as described below. |
| Record acceptance of the service terms. | Legitimate interests in evidencing our agreement and resolving contractual disputes. Acceptance records are retained during the relationship and for any justified period needed for related legal claims, subject to our retention and erasure process. |
| Attribute referrals, verify payment, grant or reverse rewards and enforce the five-reward limit. | Contract for individual programme participants; legitimate interests in administering business participants' rewards and preventing self-referral, duplicate-payment and refund abuse. Entering a referral code is optional and does not opt anyone into marketing. |
| Administer subscriptions and payment enquiries. | Contract for individual customers; legitimate interests in administering business customers' purchases for their staff contacts. |
| Keep accounting and tax records and comply with binding legal requests. | Legal obligation under applicable UK tax and accounting law, and applicable disclosure duties. |
| Authenticate users, prevent fraud and abuse, investigate incidents and protect service availability. | Legitimate interests in protecting users, customer records and our business. |
| Answer support requests and send essential service or security messages. | Contract for individual customers; legitimate interests in providing support and protecting business users. Mandatory legal notices rely on the relevant legal obligation. |
| Measure account and subscription totals for operating the service. | Legitimate interests in managing service capacity and business performance. These internal totals do not use website analytics cookies. |
| Understand how visitors use our public website so we can improve it. | Consent, given through our cookie banner. Analytics cookies are not set unless you accept, and you can withdraw consent at any time using Cookie settings. |
| Send optional product or marketing updates where you opt in. | Consent. You can withdraw it in your profile settings or by emailing hello@bizora.co.uk. Essential security and account messages are separate. |
| Send our newsletter to people who sign up on our website, and keep a record of their consent. | Consent, confirmed by clicking the link in our confirmation email. Every newsletter has an unsubscribe link, and you can also unsubscribe by emailing hello@bizora.co.uk. After you unsubscribe we keep your email address and the date only to make sure you are not emailed again. |
Name, email, password and workspace details are needed to create and administer an account; without the required information we cannot provide it. Profile photographs and marketing preferences are optional. We consider the effects of our legitimate interests on individuals and apply safeguards; you can ask about that assessment or object to this processing.
We do not sell personal data. We do not use Customer Data to train general-purpose AI models. We do not make decisions with legal or similarly significant effects solely by automated means.
4. Customer Data in workspaces
Workspace Owners and their organisation control the information they upload, including client and contact records. They are responsible for having a lawful basis, providing appropriate notices, respecting data-subject rights and setting suitable retention rules. Team Members may be able to view or download records according to workspace permissions.
Bizora processes Customer Data to host, secure, index where necessary for the service (including workspace search), display, import, export, back up, download and delete it according to the organisation's instructions and the service configuration. We may access Customer Data only where needed for support, security, legal compliance or service operations, subject to appropriate controls.
Workspaces can add their own custom fields to companies and contacts. The workspace decides what those fields collect and is responsible for using them lawfully. If a workspace moves to a plan with a lower custom field allowance, existing values are kept but cannot be edited; deleting a custom field removes its values from every record.
5. Service providers
We use carefully selected providers to operate Bizora. Current categories include:
- IONOS: hosting and database infrastructure, and IONOS Cloud Object Storage for document files. Our object storage is based in Germany.
- Stripe: checkout, recurring subscriptions, customer portal, payment processing, invoicing, payment authentication and fraud-related services.
- IONOS mail services: delivery of account confirmation, invitation, password-reset, security and other transactional email.
- Google (Google Analytics and Google Ads): website usage measurement on our public website pages, including the blog, only where you have accepted cookies. If you arrived from one of our Google adverts, Google Ads is also told when you complete registration, so we can see which adverts work; it receives a random reference for the sign-up, never your name or email address. Google advertising cookies are not set: the advert click identifier is carried in the page address instead. Google signals and ad personalisation are switched off. Google may process this data in the United States; see Google's Privacy Policy. Google Analytics is not used inside workspaces and does not receive Customer Data.
- Microsoft (Microsoft Clarity): session recordings and heatmaps of our public website pages, only where you have accepted cookies, so we can see where the website is hard to use. Text typed into form fields is masked. Microsoft may process this data in the United States; see Microsoft's Privacy Statement. Clarity is not used on sign-in or registration pages or inside workspaces and does not receive Customer Data.
- Meta (Meta Pixel): measuring our Facebook and Instagram adverts on our public website pages, only where you have accepted cookies. Meta receives the pages you view, clicks on our sign-up buttons, cookie identifiers, your IP address and browser details. Meta Platforms Ireland Limited acts as a joint controller with us for this collection and may transfer data to the United States; see Meta's Privacy Policy. The Meta Pixel is not used on sign-in or registration pages or inside workspaces and does not receive Customer Data.
- Professional advisers and authorities: where disclosure is necessary for legal, accounting, regulatory or security purposes.
International transfers
Bizora is operated from the UK and workspace data is hosted in Europe, with document storage in Germany. If you use Bizora from another country, your personal data is transferred to, stored in and processed in the UK and the European Economic Area, which may have different data protection laws from those where you live. Some providers, such as Stripe and Google, may also process data in the United States or other countries.
Where the law requires a transfer mechanism, we rely on adequacy decisions (for example, the EU's adequacy decision for the UK and the UK's adequacy regulations for the EEA), the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or another lawful mechanism, with supplementary safeguards where appropriate. Where the law of your country requires your consent to an international transfer and no other basis applies, we will ask for it. Ask us for further information about relevant safeguards.
6. Payments and Stripe
If you enter a referral code at signup, we link the new workspace to its referrer and check qualifying payments with Stripe. We show the referrer aggregate pending/reward counts and storage totals, not your name, email or payment details; those counts may allow them to infer that a person they referred has qualified. No separate referral-tracking cookie is set and we do not upload address books or send referral messages. Payment-card fingerprint hashes remain personal data used internally to detect repeated cards. We retain the referral ledger while administering rewards and enforcing lifetime limits, subject to a documented necessity review, applicable legal claims and rights requests; deleting an account from normal view does not itself erase this ledger.
Stripe processes card and payment information when you purchase a paid plan or add-on. Stripe may create a customer record, payment method reference, invoice, subscription and payment-risk signals. Bizora receives identifiers and status needed to provide paid access, but card details are handled by Stripe. Stripe may act as an independent controller for purposes such as fraud prevention and meeting its legal obligations; see Stripe's Privacy Policy.
Stripe webhooks send signed billing events to Bizora so we can reconcile subscription status. We do not treat an unconfirmed local billing record as proof of paid access. Payment failures, cancellations or expired subscriptions may reduce access to paid allowances after the applicable paid period.
7. Security and storage
We use measures including password hashing, prepared database queries, CSRF protection, organisation-scoped access, role checks, authenticated document downloads, signed Stripe webhooks, rate limiting and HTTPS requirements for production. Documents are not served as executable public files.
No internet service is completely secure. You must protect credentials, use suitable team permissions and maintain independent backups. Application, database, storage, session, temporary-upload and backup encryption depends partly on the hosting configuration and provider settings. Do not treat a website HTTPS certificate alone as proof that every stored copy is encrypted.
8. Retention
We retain account and workspace information while the account or contractual relationship exists. We retain billing and transaction records for as long as necessary to meet tax, accounting, fraud-prevention and legal obligations. Security logs, support records, backups and deleted documents may be retained for limited periods for security, recovery, dispute and compliance purposes.
Exact retention periods depend on the data type, legal requirements, workspace instructions and operational backup cycles. To request account closure or deletion, contact hello@bizora.co.uk. Some data may need to be retained or anonymised where the law requires it or where needed to establish, exercise or defend legal claims.
Removing a company or closing an account initially disables access; this is not complete erasure. Names, contact details and document metadata may remain until a separate erasure process is completed. Individual contact deletion removes the current database record. Document deletion removes its current database contents and requests removal of the current object; failed storage deletions require retry. Historic object versions and backups are handled separately. Ask us to coordinate an erasure request with the workspace controller.
Invitation links expire after seven days, account/email-confirmation links after 24 hours and password-reset links after one hour; expiry prevents their use but does not itself delete the associated database records. Retention decisions for those records consider completion of verification, abuse investigations and any outstanding request. For support and complaints, we consider when the matter is resolved and any continuing legal need; for accounting records, the statutory record-keeping obligation and any open tax enquiry apply.
9. Your rights
Depending on the circumstances and applicable law, you may have the right to request access, correction, deletion, restriction, portability or objection, and to withdraw consent where processing relies on consent. You may also object to direct marketing. These rights are not absolute and exceptions can apply.
We handle requests from everyone in the same way, wherever you live, and we will also honour any additional rights the law of your country gives you. You can make a request yourself or through an authorised agent or representative where your law allows; we may ask the agent for proof of authority and ask you to confirm your identity. We will not treat you less favourably, for example by charging a different price or providing a lower-quality service, because you exercised your privacy rights.
Send requests to hello@bizora.co.uk. We may request proportionate information to verify your identity and will coordinate workspace-data requests with the relevant controller. We respond without undue delay and normally within one month. Where the law permits an extension of up to two further months for complexity or the number of requests, we will explain the reason within the initial month. Requests are normally free. Withdrawing consent does not affect processing lawfully carried out before withdrawal. The right to object to direct marketing is absolute.
Data protection complaints
If you are unhappy with our handling of personal data, email hello@bizora.co.uk with your concern and how we can contact you. No special form or legal wording is required. We will acknowledge your complaint within 30 days, make appropriate enquiries without undue delay, keep you informed and explain the outcome and any action taken. This complaints process is separate from the deadline for a data-rights request.
You also have the right to complain to the UK Information Commissioner's Office: make a complaint to the ICO, telephone 0303 123 1113, or write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. The ICO normally asks that you raise your concern with the organisation first. This does not remove your other legal rights.
If you live outside the UK, you can also complain to the data protection authority in your country or region; see section 10. Where your law provides a right to appeal our decision on a rights request, reply to our response with the word "Appeal" and we will review the decision and tell you the outcome, and how to contact your regulator if you remain unhappy.
10. Additional information for your country or region
The rights and protections in this policy apply to everyone. The table below adds information required in some places. If your country is not listed, you can still use every right described above and complain to your local data protection authority.
| Where you are | Additional information |
|---|---|
| European Economic Area | The EU General Data Protection Regulation (GDPR) applies alongside this policy, with the same lawful bases and rights described in sections 3 and 9. You can complain to the supervisory authority where you live or work; see the list of EU data protection authorities. |
| Switzerland | The Federal Act on Data Protection applies. You can contact the Federal Data Protection and Information Commissioner. |
| United States | In the last 12 months we have collected the categories described in section 2: identifiers and contact details, account and professional information, commercial and billing information, and internet activity (website analytics only with consent, and security logs). We do not draw inferences to build profiles. We use them for the purposes in section 3 and disclose them only to the providers in section 5. We do not sell personal information, share it for cross-context behavioural advertising, use it for targeted advertising or profiling with legal effects, or use sensitive personal information beyond what is needed to provide the service. Depending on your state, you may have the right to know, access, correct, delete and obtain a copy of your personal information, to opt out of sale, sharing and targeted advertising, and to appeal a refusal. Website analytics cookies are only set if you accept them, and you can withdraw that choice at any time in Cookie settings. |
| Canada | The Personal Information Protection and Electronic Documents Act and applicable provincial laws apply. Your information may be stored and processed outside Canada, where it may be accessible to courts and authorities under local law. You can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner. |
| Australia and New Zealand | The Australian Privacy Principles and the New Zealand Privacy Act 2020 apply. Personal information is disclosed to providers in the UK, the EEA and the United States, as described in section 5. You can complain to the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner. |
| Brazil | The Lei Geral de Proteção de Dados (LGPD) applies, including your rights to confirmation of processing, access, correction, anonymisation, portability, deletion and information about sharing. You can complain to the Autoridade Nacional de Proteção de Dados. |
| India | The Digital Personal Data Protection Act 2023 applies as it comes into force. You can contact us at hello@bizora.co.uk to access, correct, complete or erase your data, nominate another person to exercise your rights, or raise a grievance. If we do not resolve your grievance, you may approach the Data Protection Board of India. |
| South Africa | The Protection of Personal Information Act applies. You can complain to the Information Regulator. |
| Japan, Singapore, South Korea and other countries | Local laws, such as Japan's Act on the Protection of Personal Information and Singapore's Personal Data Protection Act, may give you additional rights. Contact us to exercise them, or complain to your local data protection authority. |
Some countries restrict transfers of personal data abroad or require data to stay in the country. If you are subject to such rules, check that using a UK and European service is permitted before adding personal data to Bizora, and contact us if you need more information.
11. Children
Bizora is a business service intended for adult users. You must be at least 18, or the age of majority where you live if that is higher, to create an account. Do not upload children's personal data to the service. Contact us if you believe such data has been submitted so we can work with the relevant controller to address it.
12. Changes and contact
We may update this policy when our service, providers or legal obligations change. We will publish the new version and highlight material changes where appropriate.
Privacy questions and requests: hello@bizora.co.uk.