Data processing agreement
Last updated October 10, 2026
This agreement explains how Loomduct processes personal data on your behalf, as Article 28 of the GDPR requires. It is part of our Terms of service and applies automatically when you use Loomduct. You don’t need to sign anything.
1. The parties and their roles
You, the customer, are the controller of the personal data about your visitors and users that you send to Loomduct. We, Evangelos Yfantis, trading as Loomduct, are your processor. Our contact details are in the Terms of service.
2. What we process
| Purpose | Collecting, storing and analyzing analytics data, and showing you reports, so you can understand how people use your sites and apps. |
|---|---|
| People involved | Visitors of your sites and apps, and your users if you identify them. |
| Types of data | Pages viewed, referrers and campaign tags, browser, operating system and device type, screen size and language, approximate location (country, region, city), time on page and scroll depth, anonymous visitor and session ids, events and properties you send, and user ids if you identify users. IP addresses are used only in memory and never stored. |
| Special data | None. You agree not to send it. |
| Duration | As long as your account is active, then until the data is deleted as described in section 8. |
3. Your instructions
We process the data only to provide Loomduct to you, following your documented instructions: these terms and the settings you choose in the dashboard. If we believe an instruction breaks the GDPR, we will tell you. If the law requires us to process data in another way, we will tell you first, unless the law forbids it.
4. Confidentiality
Everyone who can access the data on our side is bound by confidentiality and only accesses it when needed to run, support or secure the service.
5. Security
We protect the data with technical and organizational measures, including:
- encrypted connections (HTTPS) for all traffic;
- no storage of IP addresses, and anonymous visitor ids made with a random secret that is deleted every day;
- data stored on servers in the EU, with access limited to the people who need it, protected by strong passwords and keys;
- firewalls, regular updates and monitoring of our systems;
- regular backups, kept in the EU;
- data of each customer kept separate by project.
6. Subprocessors
You allow us to use the service subprocessors listed on our Subprocessors page. They are the only companies that handle your visitors’ data, and each one is bound by a data processing agreement with the same level of protection as this one. The other companies we use, for email, payments and support, only handle data about our own account holders and never see your visitors’ data. We stay fully responsible to you for the work of our subprocessors.
We will tell you by email at least 7 days before we add or replace a subprocessor. In an emergency, for example if a provider suddenly stops working or has a security problem, we may switch first and tell you as soon as we can. If you have a reasonable objection, tell us within those 7 days. If we can’t solve it, you can cancel and we will refund any prepaid fees for the time left.
7. Helping you
- Requests from people: we help you answer requests to access, correct or delete data, for example by deleting a visitor’s data when you ask us.
- Data breaches: we tell you without undue delay, and within 48 hours of becoming aware of a breach that affects your data, with the information you need to meet your own duties.
- Assessments: we give you reasonable help with data protection impact assessments and talks with authorities.
8. Deleting data
You can export your data, and delete data or projects, at any time in the dashboard. When your account is closed, we delete your data within 30 days, and from backups within 30 more days, unless the law requires us to keep it.
9. Audits
We give you the information you need to show that we meet this agreement. If you need more, you can ask for an audit with 30 days’ notice, once a year, at your cost, done in a way that protects other customers’ data and our security.
10. Transfers outside the EU
Analytics data is stored only in the EU. Our CDN may pass a visitor’s request through an edge server outside the EU, close to that visitor, without storing it. Where that counts as a transfer, it is covered by the European Commission’s Standard Contractual Clauses.
11. Liability and contact
The limits of liability in our Terms of service apply to this agreement, as far as the GDPR allows. Questions? Email legal@loomduct.com.