Legal
Privacy statement
This statement is about the data we ourselves decide on and use: your account details, your invoices, your message through the contact form, and your visit to tagyard.io.
If you measure with Tagyard, we also process data on your behalf. There you are the controller and we are the processor, and the data processing agreement applies. Not confusing those two roles is the whole point of this separation.
Who is responsible
Piex Commerce, Frans Halsstraat 19, 2162 CK Lisse, the Netherlands, Chamber of Commerce 93463480. Questions about your data go to [email protected].
We have no data protection officer; we are too small for that and our processing does not fall under the cases where one is required.
What we process, and why
Your account
Your email address, your name if you fill it in, an encrypted version of your password, and which role you have on which measurement server. We need that to let you log in and to determine what you may see.
Basis: performance of our contract with you.
Invoices and payments
Your company name, address, VAT number and the payments themselves. We see the payment and the invoice; your card details never reach us — those go straight to Stripe.
Basis: performance of the contract, and for the invoices themselves a legal obligation.
The contact form
Your name, your email address, and what you write. If you fill them in, also your company name and your measurement address. We use that to answer you and for nothing else — it does not put you on a mailing list.
Basis: our legitimate interest in replying to those who write to us.
Your visit to tagyard.io
We measure how this site is used, with three tools:
| what for | |
|---|---|
| Google Tag Manager | managing the measurement code on this site |
| Google Analytics 4 | how many people view which page, and where they come from |
| Microsoft Clarity | how pages are used: where people click and scroll, and recordings of sessions |
These three place cookies or read data from your device, and we only switch them on after you have given consent. If you do not consent, the site works as normal and we measure nothing about your visit.
Basis: your consent. You can withdraw it at any time.
Google Analytics and Clarity run through our own measurement server on a subdomain of tagyard.io — with the same product we sell. That changes nothing about your consent and nothing about your rights; it only means the requests pass by us before travelling on.
What Clarity does is worth naming, because it goes beyond counting: it records how a page is used. Text you type into a form is masked, so we do not see what you write.
The log files of our own servers
Our servers record which requests come in, with IP address, time and the address requested. We need that to find faults and recognise misuse.
Basis: our legitimate interest in a working and secure service.
How long we keep it
| data | period |
|---|---|
| account details | as long as your account exists, then three more months |
| invoices and related data | seven years, because Dutch tax law requires it |
| contact form messages | two years after the last contact |
| our server log files | at most ninety days |
| visitor statistics for tagyard.io | per the settings in Analytics and Clarity, at most fourteen months |
The retention of your traffic history in the product is a different thing and depends on your plan: three, twelve or twenty-four months. That is in the terms.
Who we share it with
Only with parties that carry something out for us, and only what is needed for that. Which ones those are is in the sub-processor list.
We do not sell your data and do not use it for advertising.
We hand data to an authority where the law obliges us to.
Where your data sits
Your measurement server and your traffic history sit with Hetzner, in Germany or Finland. None of that leaves the EU.
Two things are different, and that belongs here honestly:
- Stripe processes payments from Ireland and may pass data to Stripe in the United States.
- Google and Microsoft may process the visitor statistics for tagyard.io outside the EU.
Both rely on the EU-US Data Privacy Framework and on standard contractual clauses. For your visit to this site you can avoid it by not giving consent; for your measurement data in the product it does not arise, because that stays in Europe.
What you can ask for
You can ask us for access to your data, to have it corrected or deleted, to restrict the processing, or to receive it in a readable file. Where we process something on the basis of a legitimate interest, you can object. Consent you can always withdraw.
Send your request to [email protected]. We respond within a month.
If we cannot resolve it together, you can complain to the Dutch Autoriteit Persoonsgegevens, or to the supervisory authority in your own country. You have that right at all times, also without coming to us first.
How we secure it
Traffic goes over encrypted connections. Passwords are stored encrypted and never in readable form. Access to our systems is limited to those who need it. What you see in the product depends on your role, and invoices are visible only to the owner of the account.
The detailed description of the measures is in the data processing agreement.
Changes
We adjust this statement when our processing changes. The top of the page states when the current version came into force. On a material change we notify the accounts it affects.