Privacy Policy

Who we are

ArtisWeb is the data controller responsible for the personal data described on this page. We are a small digital studio registered in the Netherlands, working primarily with clients in the Netherlands and Greece.

• Controller: ArtisWeb
• Chamber of Commerce (KVK): 93937423
• Email: contact@artisweb.gr

Because we are a small operation, we are not required to appoint a Data Protection Officer. Any question about your data reaches a real person at the address above.

What we collect

We only collect personal data when you actively send it to us. There is no account to create, no newsletter sign-up and no hidden collection while you browse.

Information you type into a form

Our contact form asks for your name, email address and your message. Our quote request form additionally asks which services you are interested in and an optional budget range. All of these fields are voluntary, but we cannot reply to an enquiry without at least a name and an email address.

Please only include what is relevant to your project. There is no need to send us sensitive information such as health, financial or identity document details, and we ask that you don't.

Technical information sent with your submission

To keep our forms usable and free of automated abuse, each submission is accompanied by a small amount of technical context, which is included in the notification email we receive:

• Your IP address and browser user-agent string
• Your browser's language and time zone settings, and your screen viewport size
• The page you submitted from, its title, and the page you visited immediately before it
• The date and time of the submission, and how long the form was open before you sent it

The last of these is a spam signal: forms completed in under three seconds are almost always bots. We also include a hidden field that human visitors never see and never fill in.

Server logs

Like virtually every website, our hosting provider records standard server logs, which can include IP addresses, requested URLs and timestamps. These are generated automatically for security and reliability purposes and are not combined with anything else to build a profile of you.

Why we use it, and our legal basis

Under the General Data Protection Regulation we need a lawful basis for every use of your personal data. Ours are as follows.

To answer your enquiry and prepare a proposal

When you contact us about a project, we use your details to reply, ask follow-up questions and put together a quote. The legal basis is Article 6(1)(b) — taking steps at your request prior to entering into a contract — and, once we are working together, performance of that contract.

To prevent spam, fraud and abuse of our forms

We use the technical information above, together with rate limiting based on your IP address, to stop automated submissions from flooding our inbox. The legal basis is our legitimate interest under Article 6(1)(f) in keeping our own systems secure and functional. We have weighed this against your privacy and limited it to the minimum data needed for the purpose.

To meet our accounting obligations

Where a project goes ahead, the resulting invoices and correspondence form part of our business records. The legal basis is compliance with a legal obligation under Article 6(1)(c), principally Dutch tax law.

We do not use your data for automated decision-making or profiling, and we never sell it or share it for anyone else's marketing.

Cookies, analytics and tracking

This website sets no cookies at all. We deliberately built it without them, which is also why you have not been shown a cookie banner — there is nothing to consent to.

Specifically, this site contains:

• No Google Analytics, and no other analytics or heat-mapping tool
• No advertising or conversion pixels, including no Meta or LinkedIn pixel
• No tag manager, session recorder or A/B testing script
• No embedded videos, maps, comment widgets or social media feeds
• No third-party web fonts — our typefaces are served from our own domain, so nothing is requested from an outside font provider while you read

The one exception to "no third parties" is the email service that delivers your form submission to us, described in the next section. Links to our Instagram, LinkedIn and Facebook profiles are ordinary outbound links: nothing is loaded from those platforms unless you click through, at which point their own privacy policies apply.

Who else sees your data

Your enquiry is read by the ArtisWeb team and nobody else. We use a small number of service providers (processors) that handle data strictly on our instructions:

ZeptoMail (Zoho Corporation)

Delivers the notification email containing your form submission to our inbox. Zoho acts as our transactional email processor under a data processing agreement.

Our web hosting provider

Hosts this website and the small script that receives form submissions, and maintains standard server logs.

Our email provider

Stores the mailbox in which your message sits once it arrives.

Beyond these, we will only disclose personal data if we are legally required to do so, or where it is necessary to establish or defend a legal claim. We do not sell personal data, and we have never received a request to hand it over.

Where your data is stored

We keep your data within the European Economic Area wherever our providers offer it, and we use European data centre regions for email delivery where available. Some of our providers are part of international groups, so a transfer outside the EEA cannot be entirely ruled out. Where that happens, it is covered by the European Commission's Standard Contractual Clauses or another safeguard recognised under Chapter V of the GDPR. You are welcome to ask us for details.

How long we keep it

We do not keep personal data for longer than we need it.

Enquiries that don't lead to work

Deleted from our inbox within 24 months of our last exchange, or sooner if you ask.

Client project correspondence

Kept for the duration of our working relationship and for a reasonable period afterwards, in case you return to us about the same work.

Invoices and accounting records

Kept for seven years, as Dutch tax law requires.

Anti-spam rate-limiting records

Your IP address is stored only as an irreversible cryptographic hash, never as a readable address, and the associated timestamps expire automatically within an hour.

Server logs

Rotated and deleted by our hosting provider on their standard short-term schedule.

How we protect it

This site is served entirely over HTTPS, so everything you type into a form is encrypted in transit. Our form endpoint accepts requests only from our own domain, limits how much data it will accept, rejects anything that isn't a well-formed submission, and rate-limits by hashed IP address. Access to our inbox is protected by strong, unique credentials and two-factor authentication.

No system is perfectly secure, and we won't pretend otherwise. If a breach ever affected your rights, we would notify the Dutch Data Protection Authority within 72 hours and tell you directly where the law requires it.

Your rights

Because we process your data in the EU, you have the following rights, free of charge, at any time:

• Access — ask for a copy of the personal data we hold about you
• Rectification — have inaccurate or incomplete data corrected
• Erasure — ask us to delete your data, where we have no overriding obligation to keep it
• Restriction — ask us to pause our use of your data while a question is resolved
• Portability — receive the data you gave us in a structured, machine-readable format
• Objection — object to processing we base on legitimate interests
• Withdraw consent — where we ever rely on consent, withdraw it without affecting what came before

To exercise any of these, email contact@artisweb.gr. We will respond within one month, as the GDPR requires, and usually much sooner. We may ask a question or two to confirm it is really you before we act on a request.

If you are unhappy with how we have handled your data, we would like the chance to put it right. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your own EU country of residence.

Children's privacy

Our services are aimed at businesses, and this site is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us their details, please let us know and we will delete them.

Changes to this policy

We will update this page if the way we handle personal data changes — for example if we ever add analytics or a new service provider. The date at the top always reflects the current version. If a change materially affects your rights, we will say so clearly rather than quietly editing the text.

How to reach us

Questions about this policy, or about your data, are always welcome. Email contact@artisweb.gr and mention "privacy" in the subject line so it reaches the right person quickly.