Terms and Privacy for Netstudio Insights

By using Netstudio Insights, you agree to comply with and be bound by these Terms, including the Data Processing Agreement below. If you do not agree, do not use our service.

Who we are

Netstudio Insights is provided by Netstudio E.E., a limited partnership registered in Greece. Registered office: 49 Trapezountos St., 145 65 Agios Stefanos, Attica, Greece. General Commercial Registry (ΓΕΜΗ) No. 007975601000. VAT No. EL998658236, tax office ΚΕΦΟΔΕ Αττικής. Telephone: +30 210 800 4447. Email: info@netstudio.gr. Data Protection Officer: Emi Moundrou, dpo@netstudio.gr.

Service Overview

Netstudio Insights is a privacy-first analytics service built to help you understand your website’s performance while respecting your visitors' privacy. By using Netstudio Insights, you acknowledge and agree to the following:

• As Is: The service is provided "as is" and "as available" without warranties of any kind. Netstudio disclaims any liability for any direct, indirect, incidental, or consequential damages that may arise from your use of the service.
• Privacy by Design: We collect the minimum needed for your reports, replace identifiers with keyed hashes before storage, encrypt the stored data, and share nothing with third parties.
• No Directly Identifying Data: Names, email addresses, phone numbers and similar fields are discarded by the script in the browser and again by our collector. IP addresses and pseudonymous identifiers are processed as described in the Data Processing Agreement below and in the data facts on our home page.

Account Responsibility

Use the service in compliance with all applicable laws and regulations, including the duty to inform your visitors and to obtain any consent the law requires for the processing you configure. Session stitching without a cookie is off until you turn it on. If you turn it on, you instruct us to read the screen and viewport size and to store, for 7 days, a keyed hash of the IP address, browser headers and screen size even where the visitor has not accepted analytics cookies. You decide the lawful basis, you describe that technique in your notice to visitors, and you are solely responsible for that instruction, including any claim or fine that arises from it.

Privacy and Data Handling

Netstudio Insights is committed to safeguarding your data and your visitors' privacy. Here are the principles we uphold:

• Data Ownership: You retain full ownership of all data collected by the service. Netstudio does not claim any rights over your data.
• Data Processing: Your data will only be processed as described in these Terms, in compliance with the GDPR, Greek laws 4624/2019 and 3471/2006, and other applicable privacy laws.
• Data Security: We utilize encryption, backups, and other safeguards to ensure the confidentiality and security of your data.
• Pseudonymous Analytics: Visitor data is stored under pseudonymous identifiers, as set out in the Data Processing Agreement. We do not sell it, enrich it, or use it for any purpose other than your reports.

Data Processing Agreement

This section is the data processing agreement under Article 28 of the GDPR between you, as controller, and Netstudio E.E., identified above, as processor, for the personal data of your website's visitors that Netstudio Insights processes on your behalf.

Subject matter, duration, nature and purpose

Netstudio processes visitor data for the sole purpose of producing web and e-commerce analytics reports for you, for as long as you hold an account. The processing consists of receiving tracking requests from your website, sorting them into visits, enriching them with a coarse location and a device class, storing them, and presenting aggregated reports and an API to you.

Categories of data and data subjects

The data subjects are the visitors of your website and, where your website signs them in, your customers. Always processed: the page visited, its title and its referrer; the device class, browser and operating system; the country, region and city derived from the IP address; the consent state your banner reports; e-commerce events with their products and amounts; the visitor's IP address, deleted as described under Retention. Only if you turn session stitching on: the screen and viewport size, and a keyed hash of the IP address, browser headers and screen size, deleted after 7 days. Only with analytics consent: a keyed hash of a first-party cookie identifier and of your customer id. Names, email addresses, phone numbers and similar personal fields are discarded in the browser and by the collector and are not meant to be stored. Page addresses are stored as the browser reports them.

Our obligations as processor

1. We process visitor data only on your documented instructions. Your configuration is an instruction only where a control is on. Session stitching without a cookie is off unless you enable it. Before it can be enabled we warn you that reading the screen size and storing that hash may require consent under the ePrivacy rules, and that we do not decide whether it is lawful on your site. If you enable it anyway, that enablement is your documented instruction and we process it only within that instruction. You are solely responsible for its lawfulness and for a visitor notice that matches it. To the extent permitted by law, you indemnify Netstudio against claims, fines, damages and reasonable defence costs arising from that instruction or from a notice that does not match it, except to the extent caused by our acting outside the instruction or by our failure to apply the security measures in this agreement. We may suspend the feature if we become aware that the instruction is unlawful.
2. Every person we authorise to process the data is bound by a duty of confidentiality.
3. We apply the security measures stated in the data facts on our home page: TLS in transit, storage on an encrypted volume with the key on a second encrypted volume, per-account access by invitation only, support access that is read-only and logged, and an information security management system certified to ISO/IEC 27001:2022.
4. We engage sub-processors only as listed below.
5. We assist you, taking into account the nature of the processing, in answering requests from data subjects and in your own compliance work, including data protection impact assessments.
6. We notify you without undue delay after becoming aware of a personal data breach affecting your data.
7. At the end of the service, or earlier at your request, we delete your visitor data, or hand it to you first if you ask, unless the law requires us to keep it.
8. We make available the information needed to demonstrate compliance with this agreement and allow for audits, including inspections, conducted by you or an auditor you mandate, on reasonable notice.

Sub-processors

Visitor data is hosted and processed on the infrastructure of UpCloud Oy, Finland, in a data centre inside the European Union. Storage, processing and backups all remain on that infrastructure. We do not pass visitor data to any other party.

For your own account, meaning the people who sign in to the dashboard, we process names and email addresses to run the account and to send login links and invitations. If you choose to sign in with Google, Google receives that sign-in request under its own terms.

Transfers

Visitor data does not leave the European Union. Geolocation uses an offline database on our own server; the IP address is never sent to its publisher or to anyone else.

Retention

IP address: deleted within 24 hours on every session. Keyed hash of IP address, browser headers and screen size: 7 days, and only if you have turned session stitching on. First-party cookie: 395 days on the visitor's device, set only with analytics consent and not refreshed on later visits. Events and sessions: for your plan's data retention period, and deleted on request. The collector's request logs: 7 days.

Limitations of Liability

To the extent permitted by law, Netstudio shall not be liable for any direct, indirect, incidental, or consequential damages, including but not limited to loss of profits, revenue, or data, arising out of:

1. Your use or inability to use the service.
2. Errors, bugs, or interruptions in the service.
3. Unauthorized access to your data.

By choosing to use Netstudio Insights, you accept full responsibility for the risks associated with the service.

At the same time we promise to do our best to be worthy of that trust and provide a quality and secure platform for your hosted analytics.

Intellectual Property

The "Netstudio Insights" name, logo, and associated trademarks are the property of Netstudio. You agree not to copy, modify, or falsely associate the service with another entity.

All rights to the service's design, functionality, and software belong to Netstudio. You may not reverse-engineer, duplicate, or exploit any part of the service without express permission.

Changes to the Service or Terms

Netstudio reserves the right to modify or discontinue the service at any time without prior notice. Additionally, we may update these Terms as needed. We will notify users of significant changes through our website or other communication channels. Continued use of the service after such changes constitutes acceptance of the revised Terms.

Data Security - ISO/IEC 27001:2022 Certification

As part of our ongoing efforts to protect the information we manage, Netstudio E.E. is certified according to the ISO/IEC 27001:2022 standard. You can download the certificate from here.

Governing Law

These Terms are governed by and construed in accordance with the laws of Greece. Any dispute arising from these Terms is subject to the exclusive jurisdiction of the courts of Athens, Greece.

Contact Us

If you have questions or concerns about these Terms, please contact us at info@netstudio.gr, or by post at the address under Who we are. For data protection matters, including any request about personal data, write to our Data Protection Officer at dpo@netstudio.gr.

Thank you for trusting Netstudio Insights to power your website analytics!