Privacy Policy

Who we are

ArtisWeb Digital Agency is the data controller responsible for the personal data described on this page. We are a small digital studio registered in the Netherlands, working primarily with clients in the Netherlands and Greece.

• Controller: ArtisWeb Digital Agency
• Chamber of Commerce (KVK): 93937423
• VAT number: NL005053046B42
• Email: contact@artisweb.gr

Because we are a small operation, we are not required to appoint a Data Protection Officer. Any question about your data reaches a real person at the address above.

What we collect

We only collect personal data when you actively send it to us. There is no account to create, no newsletter sign-up and no hidden collection while you browse.

Information you type into a form

Our contact form asks for your name, email address and your message. Our quote request form additionally asks which services you are interested in and an optional budget range. All of these fields are voluntary, but we cannot reply to an enquiry without at least a name and an email address.

Please only include what is relevant to your project. There is no need to send us sensitive information such as health, financial or identity document details, and we ask that you don't.

Technical information sent with your submission

To keep our forms usable and free of automated abuse, each submission is accompanied by a small amount of technical context, which is included in the notification email we receive:

• Your IP address and browser user-agent string
• Your browser's language and time zone settings, and your screen viewport size
• The page you submitted from, its title, and the page you visited immediately before it
• The date and time of the submission, and how long the form was open before you sent it

The last of these is a spam signal: forms completed in under three seconds are almost always bots. We also include a hidden field that human visitors never see and never fill in.

Server logs

Like virtually every website, our hosting provider records standard server logs, which can include IP addresses, requested URLs and timestamps. These are generated automatically for security and reliability purposes and are not combined with anything else to build a profile of you.

Why we use it, and our legal basis

Under the General Data Protection Regulation we need a lawful basis for every use of your personal data. Ours are as follows.

To answer your enquiry and prepare a proposal

When you contact us about a project, we use your details to reply, ask follow-up questions and put together a quote. The legal basis is Article 6(1)(b) — taking steps at your request prior to entering into a contract — and, once we are working together, performance of that contract.

To prevent spam, fraud and abuse of our forms

We use the technical information above, together with rate limiting based on your IP address, to stop automated submissions from flooding our inbox. The legal basis is our legitimate interest under Article 6(1)(f) in keeping our own systems secure and functional. We have weighed this against your privacy and limited it to the minimum data needed for the purpose.

To meet our accounting obligations

Where a project goes ahead, the resulting invoices and correspondence form part of our business records. The legal basis is compliance with a legal obligation under Article 6(1)(c), principally Dutch tax law.

We do not use your data for automated decision-making or profiling, and we never sell it or share it for anyone else's marketing.

Cookies, analytics and tracking

We use Google Analytics, loaded with the Google tag, to understand which pages are useful and how visitors find us. It only runs if you accept in the cookie banner. Until then no Google script is loaded and no analytics cookie is set. You can change your mind at any time with the “Cookie settings” link in the footer.

If you accept, Google Analytics:

• Sets first-party cookies (_ga and _ga_<ID>) that last about 13 months, so that repeat visits can be counted
• Receives the pages you view, the page you came from, how long you stay, your browser, device type and screen size, and an approximate location (country and city) derived from your IP address. Google Analytics 4 does not log or store IP addresses

We have configured it so that:

• Advertising features, Google signals and ad personalisation are switched off, and no data is used for ads
• It never reads what you type into our forms
• Detailed visit data is kept for 2 months and then deleted; only aggregated, anonymous reports remain

The legal basis is your consent under Article 6(1)(a) GDPR and the ePrivacy rules on cookies. If you reject, or simply ignore the banner, nothing is loaded. If you later withdraw consent, analytics stops and we remove the Google Analytics cookies from your browser.

We store your choice in your browser’s local storage (aw-consent) so we do not ask again on every page. This is strictly necessary to respect your decision and contains nothing else.

Apart from that, this site contains:

• No heat-mapping or session-recording tool
• No advertising or conversion pixels, including no Meta or LinkedIn pixel
• No A/B testing script
• No embedded videos, maps, comment widgets or social media feeds
• No third-party web fonts — our typefaces are served from our own domain, so nothing is requested from an outside font provider while you read

The other third party involved is the email service that delivers your form submission to us, described in the next section. Links to our Instagram, LinkedIn and Facebook profiles are ordinary outbound links: nothing is loaded from those platforms unless you click through, at which point their own privacy policies apply.

Who else sees your data

Your enquiry is read by the ArtisWeb Digital Agency team and nobody else. We use a small number of service providers (processors) that handle data strictly on our instructions:

Zoho CPaaS (Zoho Corporation)

Delivers the notification email containing your form submission to our inbox. Zoho acts as our transactional email processor under a data processing agreement.

Google (Google Ireland Limited)

Provides Google Analytics, only if you accept analytics cookies. Google acts as our processor under its data processing terms. Data may be transferred to the United States under the EU–US Data Privacy Framework, to which Google is certified.

Our web hosting provider

Hosts this website and the small script that receives form submissions, and maintains standard server logs.

Our email provider

Stores the mailbox in which your message sits once it arrives.

Beyond these, we will only disclose personal data if we are legally required to do so, or where it is necessary to establish or defend a legal claim. We do not sell personal data, and we have never received a request to hand it over.

Where your data is stored

We keep your data within the European Economic Area wherever our providers offer it, and we use European data centre regions for email delivery where available. Some of our providers are part of international groups, so a transfer outside the EEA cannot be entirely ruled out. Where that happens, it is covered by the European Commission's Standard Contractual Clauses or another safeguard recognised under Chapter V of the GDPR. You are welcome to ask us for details.

How long we keep it

We do not keep personal data for longer than we need it.

Enquiries that don't lead to work

Deleted from our inbox within 24 months of our last exchange, or sooner if you ask.

Client project correspondence

Kept for the duration of our working relationship and for a reasonable period afterwards, in case you return to us about the same work.

Invoices and accounting records

Kept for seven years, as Dutch tax law requires.

Anti-spam rate-limiting records

Your IP address is stored only as an irreversible cryptographic hash, never as a readable address, and the associated timestamps expire automatically within an hour.

Server logs

Rotated and deleted by our hosting provider on their standard short-term schedule.

How we protect it

This site is served entirely over HTTPS, so everything you type into a form is encrypted in transit. Our form endpoint accepts requests only from our own domain, limits how much data it will accept, rejects anything that isn't a well-formed submission, and rate-limits by hashed IP address. Access to our inbox is protected by strong, unique credentials and two-factor authentication.

No system is perfectly secure, and we won't pretend otherwise. If a breach ever affected your rights, we would notify the Dutch Data Protection Authority within 72 hours and tell you directly where the law requires it.

Your rights

Because we process your data in the EU, you have the following rights, free of charge, at any time:

• Access — ask for a copy of the personal data we hold about you
• Rectification — have inaccurate or incomplete data corrected
• Erasure — ask us to delete your data, where we have no overriding obligation to keep it
• Restriction — ask us to pause our use of your data while a question is resolved
• Portability — receive the data you gave us in a structured, machine-readable format
• Objection — object to processing we base on legitimate interests
• Withdraw consent — where we ever rely on consent, withdraw it without affecting what came before

To exercise any of these, email contact@artisweb.gr. We will respond within one month, as the GDPR requires, and usually much sooner. We may ask a question or two to confirm it is really you before we act on a request.

If you are unhappy with how we have handled your data, we would like the chance to put it right. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your own EU country of residence.

Children's privacy

Our services are aimed at businesses, and this site is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us their details, please let us know and we will delete them.

Changes to this policy

We will update this page if the way we handle personal data changes — for example if we add a new tool or service provider. The date at the top always reflects the current version. If a change materially affects your rights, we will say so clearly rather than quietly editing the text.

How to reach us

Questions about this policy, or about your data, are always welcome. Email contact@artisweb.gr and mention "privacy" in the subject line so it reaches the right person quickly.