Legal

Data processing terms

Last updated 5 November 2026. These data processing terms form part of our Terms of Service. They apply where Welt Analytics SRL (“Welt Analytics”, “we”) processes personal data on behalf of a customer (“you”), as your processor under Article 28 GDPR. Where we decide how and why personal data is used, our Privacy Policy applies instead.

1. What we process for you

  • Subject matter and purpose. Hosting and delivering the blog we publish for you, and any other part of the service where you decide what personal data goes in, such as content you ask us to publish.
  • Nature of the processing. Storing, publishing, delivering and securing pages, and deleting the data when the service ends.
  • People concerned. Visitors to your blog, and people named in content you give us or ask us to publish.
  • Types of personal data. Connection data, such as IP address, browser and device details and request records, and any personal data in that content.
  • Duration. For as long as we provide the service to you, and until the data is deleted as described in section 8.

2. Your instructions

We process this personal data only on your documented instructions. These terms, the Terms of Service and the settings you choose in the service are your instructions. We do not use the data for our own purposes. If the law requires us to process it in another way, we tell you first, unless that law forbids it. If we think an instruction breaks data protection law, we tell you.

You are responsible for having a lawful basis for the processing and for giving the people concerned the information the law requires.

3. Confidentiality

Only people who need the data to run the service can access it, and they are bound to confidentiality.

4. Security

We take appropriate technical and organizational measures to protect the data, as Article 32 GDPR requires. For example, connections are encrypted and access is limited to the people who need it. We review these measures as the service changes.

5. Sub-processors

You give us general authorization to use other processors (sub-processors) to help provide the service, such as hosting, infrastructure, security, email delivery and font delivery providers. We give customers the current list on request. Write to support@weltanalytics.com.

We tell you in advance, by email or in the product, before we add or replace a sub-processor. You can object to the change before it applies. If you object, we will look for a solution with you in good faith. If we cannot find one, you can cancel the affected service before the change applies.

Each sub-processor is bound by a written contract with data protection duties that protect the data at least as well as these terms. We remain responsible to you for its work.

6. Transfers outside the EEA

Where a sub-processor processes the data outside the European Economic Area, the transfer rests on an adequacy decision of the European Commission or on the European Commission's standard contractual clauses (Article 46(2)(c) GDPR), with extra safeguards where needed.

7. Helping you meet your duties

  • If someone asks us to exercise their data protection rights for data we process for you, we pass the request to you, and we help you answer it as far as we reasonably can.
  • We tell you without undue delay after we become aware of a personal data breach that affects the data, and we give you the information we have so you can meet your own notification duties.
  • We help you, as far as we reasonably can with the information we have, with security, breach notification, data protection impact assessments and prior consultation with a supervisory authority (Articles 32 to 36 GDPR).

8. When the service ends

When the service ends, you choose whether we return the data or delete it. We return it through the article export described in the Terms of Service. When that export period is over, or sooner if you ask us to delete it, we delete the personal data we process for you, unless the law requires us to keep it. Copies in backups are deleted when those backups expire.

9. Information and audits

We make available the information you need to show that these terms are met. If that information is not enough, you, or an independent auditor bound to confidentiality, can audit our compliance with these terms. Audits need reasonable notice, take place during business hours, and happen no more than once a year, unless a supervisory authority requires one or after a personal data breach.

10. How these terms fit with the Terms of Service

If these terms conflict with the Terms of Service on the processing of personal data, these terms apply. The Terms of Service govern everything else, including liability and the law that applies.

11. Changes

We may update these terms as the Terms of Service describe. The date at the top is the date of this version.