EuroMetrics.eu — Privacy-First Web Analytics for Europe

1. Data Controller

The data controller responsible for processing your personal data is:

Ioffe & Friends Associação Cultural
Praceta da Quinta da Bela Vista 133, 1 Esq.
4400-261 Vila Nova de Gaia, Portugal
Tax ID (NIF): 516787276
Email for privacy inquiries: privacy@eurometrics.eu

2. Scope and Application

This Privacy Policy applies to all personal data collected through the EuroMetrics.eu platform, including the website, dashboard, tracking services, API, and any related services.

Ioffe & Friends Associação Cultural is committed to protecting the privacy of its users in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and Portuguese Law No. 58/2019 of August 8.

Important distinction: EuroMetrics operates two categories of data processing:

Account data — personal data of EuroMetrics customers (you), described in this policy;
Analytics data — anonymized, aggregated website visitor data collected by our tracking script on behalf of our customers. This data is not personal data as defined by GDPR, as it contains no cookies, no personally identifiable information, and no cross-site tracking.

3. Personal Data We Collect

3.1. Data Provided by the User (Account Data)

Identification data: name, email address, company name (optional);
Authentication data: access credentials (email and encrypted password);
Billing data: information necessary for invoicing and payment processing (processed by our payment provider);
Communication data: messages sent through support channels.

3.2. Automatically Collected Data

Browsing data: IP address (anonymized), browser type, operating system, pages visited on eurometrics.eu;
Usage data: features used, session duration, interactions with the platform;
We do not use cookies for tracking on our marketing website. Essential cookies are used only for authentication within the dashboard.

3.3. Analytics Data (Collected on Behalf of Customers)

When website owners install the EuroMetrics tracking script on their websites, we collect anonymized, non-personal visitor data on their behalf, including:

Page URLs and referrer URLs;
Browser type and operating system (without fingerprinting);
Screen resolution and device type;
Country of origin (derived from anonymized IP — IP addresses are never stored);
Custom events configured by the website owner.

This analytics data:

Contains no cookies and requires no consent banners;
Contains no personally identifiable information;
Cannot be used to identify or track individual visitors;
Is stored in an isolated database per customer — never co-mingled with other customers' data;
Never leaves the European Union — all processing and storage occurs exclusively in EU data centers.

4. Purpose and Legal Basis for Processing

Purpose	Legal Basis (GDPR)
Account creation and management	Performance of contract (Art. 6(1)(b))
Providing analytics services	Performance of contract (Art. 6(1)(b))
Billing and payment processing	Performance of contract (Art. 6(1)(b))
Service improvement and bug fixing	Legitimate interest (Art. 6(1)(f))
Security and fraud prevention	Legitimate interest (Art. 6(1)(f))
Legal compliance	Legal obligation (Art. 6(1)(c))
Marketing communications	Consent (Art. 6(1)(a)) — only with explicit opt-in

5. Data Sharing and Third Parties

We share personal data only with the following categories of processors, all of which are EU-based or operate under GDPR requirements:

Payment processors: for subscription billing (no card data is stored on our servers);
Email service providers: for transactional emails (account confirmation, password reset);
Hosting providers: EU-based infrastructure providers where data is stored.

We do not:

Sell, rent, or trade personal data to any third party;
Share data with advertising networks;
Use any US-based subprocessors for analytics data processing;
Transfer any analytics data outside the European Union.

6. Data Storage and Retention

6.1. Location

All data is stored exclusively in European Union data centers. No data is transferred to, processed in, or accessible from jurisdictions outside the EU/EEA.

6.2. Retention Periods

Account data: retained for the duration of the account plus 12 months after deletion;
Billing data: retained for 10 years as required by Portuguese tax law;
Analytics data: retained according to the customer's subscription plan (6 to 24 months), then automatically and permanently deleted;
Support communications: retained for 24 months after the last interaction.

7. Data Subject Rights

Under GDPR, you have the following rights regarding your account data:

Right of access: obtain confirmation and access to your personal data;
Right to rectification: correct inaccurate or incomplete data;
Right to erasure: request deletion of data ("right to be forgotten");
Right to restriction: restrict processing under certain circumstances;
Right to data portability: receive data in a structured, machine-readable format;
Right to object: object to processing for direct marketing or legitimate interest purposes;
Right to withdraw consent: at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@eurometrics.eu. We will respond within a maximum of 30 days.

Note regarding analytics data: Since analytics data collected by the EuroMetrics tracking script contains no personal data, GDPR data subject rights do not apply to it. Website visitors cannot be identified from this data.

8. Cookie Policy

8.1. EuroMetrics Marketing Website (eurometrics.eu)

Our marketing website uses no tracking cookies. We practice what we preach.

The only cookie used is NEXT_LOCALE, a strictly necessary functional cookie that stores your preferred language selection. This cookie contains no personal data — only a language code (e.g., "en", "de"). It is exempt from consent requirements under Article 5(3) of the ePrivacy Directive as it is strictly necessary to provide a service explicitly requested by the user.

8.2. EuroMetrics Dashboard (app.eurometrics.eu)

The dashboard uses only strictly necessary cookies for:

Session authentication: maintaining your logged-in state;
Security tokens: CSRF protection.

No analytics, marketing, or third-party cookies are used. No cookie consent banner is required.

8.3. EuroMetrics Tracking Script (installed on customer websites)

The EuroMetrics tracking script uses zero cookies. It does not set, read, or transmit any cookies whatsoever. This is a core design principle of our service.

9. Security Measures

Ioffe & Friends Associação Cultural implements technical and organizational measures to protect personal data:

Encryption of data in transit (TLS 1.3) and at rest (AES-256);
Secure authentication with encrypted passwords (bcrypt/Argon2);
Role-based access control;
Tenant data isolation — each customer's analytics data is stored in a separate, isolated database;
Monitoring and intrusion detection;
Regular backups and disaster recovery plan;
Periodic security audits.

10. Data Breach Notification

In the event of a personal data breach that may pose a risk to the rights and freedoms of data subjects, Ioffe & Friends Associação Cultural will notify the Portuguese Data Protection Authority (CNPD) within 72 hours and, where necessary, inform affected data subjects.

11. Children's Data

The EuroMetrics.eu platform is intended exclusively for users aged 18 or older. We do not knowingly collect data from minors. If you become aware that a minor has provided personal data, please contact us so we can proceed with its deletion.

12. Changes to This Privacy Policy

This policy may be updated periodically. Significant changes will be communicated through the platform or via email with a minimum of 30 days' notice. The date of the last update is indicated at the beginning of this document.

13. Right to Lodge a Complaint

Without prejudice to any other administrative or judicial remedies, you have the right to lodge a complaint with the competent supervisory authority:

Portuguese Data Protection Authority (CNPD)
Rua de São Bento, n.º 148-3.º
1200-821 Lisbon, Portugal
Phone: +351 213 928 400
Website: www.cnpd.pt

14. Contact Information

For any questions regarding the protection of your personal data, please contact us:

Email: privacy@eurometrics.eu
Address: Praceta da Quinta da Bela Vista 133, 1 Esq., 4400-261 Vila Nova de Gaia, Portugal