Loading image...

Data Processing Notice

Transparent information about how we process your personal data

This Data Processing Notice provides detailed information about our data processing activities as required under Article 13 and 14 of the GDPR. Last updated: July 16, 2025

Processing Activities Overview

Summary of all personal data processing activities

Kief Studio Analytics Platform

Legitimate Interest

Purpose: Proprietary analytics for website optimization, user experience improvement, performance monitoring

Data Categories: Usage data, session data, anonymized visitor patterns

Recipients: Kief Studio analytics team only

Retention: 2 years (auto-deleted), 6 months (anonymized)

Google Analytics 4

Consent

Purpose: Website traffic analysis, user behavior tracking

Data Categories: Usage data, technical data, IP addresses (anonymized)

Recipients: Google LLC (separate from Tag Manager)

Retention: 26 months (Google's standard retention)

Microsoft Clarity

Consent

Purpose: User behavior analysis, heatmaps, session recordings

Data Categories: User interactions, masked personal data

Recipients: Microsoft Corporation (standalone service)

Retention: 30 days

Plausible Analytics

Consent

Purpose: Privacy-focused website analytics

Data Categories: Aggregated usage data (no personal data)

Recipients: Self-hosted (analytics.kiefstudio.io)

Retention: Indefinite (aggregated data only)

Contact & Lead Management

Contract / Legitimate Interest

Purpose: Responding to inquiries, providing services, business relationship management

Data Categories: Contact details, communication content, business requirements

Recipients: Internal team, CRM systems, email service providers

Retention: 3 years after last contact or as required for legal obligations

Marketing & Communications

Consent

Purpose: Newsletter delivery, marketing communications, service updates

Data Categories: Email address, name, preferences, engagement data

Recipients: Email marketing platforms, analytics providers

Retention: Until consent is withdrawn or subscriber opts out

Security & Fraud Prevention

Legitimate Interest

Purpose: Security monitoring, fraud prevention, system protection

Data Categories: IP addresses, access logs, security events, device fingerprints

Recipients: Security service providers, internal security team

Retention: 12 months for security logs, 90 days for access logs

Third-Party Data Processors

External organizations that process personal data on our behalf

Google LLC

Services: Google Analytics 4, Google Tag Manager

Location: United States

Safeguards: Adequacy Decision, Google Ads Data Processing Terms

Data Processing Agreement: View DPA

Microsoft Corporation

Services: Microsoft Clarity

Location: United States

Safeguards: Adequacy Decision, Microsoft Data Protection Addendum

Data Processing Agreement: View DPA

Plausible Analytics

Services: Privacy-focused web analytics

Location: European Union (self-hosted)

Data Processing: GDPR compliant by design, no personal data

Host: analytics.kiefstudio.io (our infrastructure)

Web Hosting Providers

Services: Website hosting, CDN, security services

Location: Various (EU and US)

Safeguards: Standard Contractual Clauses, Adequacy Decisions

Purpose: Website delivery and performance

International Data Transfers

Transfers to Third Countries

United States: Google Analytics, Microsoft Clarity

Safeguards:

EU-US Data Privacy Framework
Standard Contractual Clauses (SCCs)
Adequacy decisions where applicable
Additional safeguards and encryption

Data Localization

EU Processing: Plausible Analytics (self-hosted)

Data Minimization: Only necessary data is transferred

Anonymization: IP addresses anonymized where possible

Retention Limits: Automatic deletion after retention periods

Data Retention Schedule

Analytics Data

Google Analytics 4: 26 months
Microsoft Clarity: 30 days
Plausible Analytics: Indefinite (aggregated only)
Server logs: 90 days

Business Data

Contact forms: 3 years
Newsletter subscriptions: Until unsubscribe
Customer data: 7 years (legal requirement)
Security incidents: 12 months

Data is automatically deleted when retention periods expire. You can request earlier deletion by exercising your right to erasure through our Data Subject Rights page.

Security Measures