Privacy policy

This policy explains what personal data NS Web Studio collects through this website, why, how long it’s kept and what rights you have over it. It’s written to comply with the EU General Data Protection Regulation (GDPR) and Greek data protection law.

The short version: I collect what you send me and almost nothing else, I don’t sell or share it, and you can ask me to delete it at any time.

1. Who is responsible

NS Web Studio, operated by Nikol Salpisti, Athens, Greece.

For anything relating to your personal data, write to info@nswebstudio.com. I handle these requests personally.

2. What data is collected

When you send a project brief or contact form

• Your name and email address
• Your business name and website address, if you provide them
• The country you’re based in
• Whatever you write in the free-text fields

When you email directly

• Your email address, name and the content of your message

When you become a client

• Billing details, including business address and VAT number where applicable (processed via our authorized accounting partner)
• Records of what was agreed, delivered and invoiced
• Any credentials you share so I can do the work — hosting, domain, analytics access

Automatically, when you visit

• Standard server logs: IP address, browser type, pages visited, timestamp
• Analytics data via Google Analytics 4 (pages visited, time on site, approximate location based on anonymized IP), collected only if you explicitly consent to performance cookies.

3. Why, and on what legal basis

What for	Legal basis under GDPR
Replying to your enquiry and preparing a proposal	Steps taken at your request before entering a contract (Art. 6(1)(b))
Delivering a project you’ve commissioned	Performance of a contract (Art. 6(1)(b))
Invoicing and keeping accounting records	Legal obligation under Greek tax law (Art. 6(1)(c))
Keeping the website secure and working	Legitimate interest (Art. 6(1)(f))
Analytics	Consent (Art. 6(1)(a))

I do not use your data for marketing unless you specifically ask to be added to a mailing list, and there currently isn’t one.

4. How long it’s kept

• Enquiries that don’t become projects: 12 months, then deleted
• Client project records: for the duration of the project plus 5 years
• Invoices and accounting records: For the legally required period under Greek tax law
• Server logs: 30 days, then overwritten
• Access credentials you shared: deleted at project handover

5. Who else sees it

Your data is not sold, rented or shared for marketing. It is processed by a small number of service providers who are necessary to run the business:

• GrServer / MyTophost — website and email hosting, Greece
• External accounting partner — invoicing, payments and tax compliance, Greece

Each of these acts as a data processor under a written agreement and may only use your data to provide their service to me.

6. Transfers outside the EU

All of the providers listed above process data within the European Economic Area. No transfers outside the EEA take place.

7. Cookies and analytics

This website uses strictly necessary cookies for its basic functionality. In addition, we use Google Analytics 4 to understand how visitors interact with the site and improve our services. Google Analytics sets performance cookies to track behavior across pages.

These performance cookies are only set if you explicitly accept them through our cookie consent banner when you first arrive. You can change your preferences or withdraw your consent at any time using the preferences button on the screen. For more information on how Google handles your data, please see Google’s Privacy Policy.

8. Your rights

Under GDPR you have the right to:

• Ask what personal data I hold about you and receive a copy
• Have inaccurate data corrected
• Have your data deleted, where no legal obligation requires me to keep it
• Restrict or object to how it’s processed
• Receive your data in a portable format
• Withdraw consent at any time, where processing is based on consent

Email info@nswebstudio.com and I’ll respond within one month, usually much sooner. There’s no charge.

If you’re not satisfied with how I’ve handled a request, you can complain to the Hellenic Data Protection Authority (dpa.gr), or to the supervisory authority in your own EU country.

9. Security

The site runs over HTTPS with a valid certificate. Access to the systems holding your data is protected by strong, unique passwords and two-factor authentication. Client credentials are stored in an encrypted password manager and deleted at handover. I’m one person, which means fewer people have access to your data than at almost any agency.

10. Changes

If this policy changes, the updated version appears here with a new date at the top. If the change is significant and affects existing clients, I’ll email you about it rather than expecting you to notice.