Last updated: 29 October 2026
This policy explains which data is processed when you use wwidgets.com, who is responsible for it, how long it is kept and how it is protected. It supplements our Privacy Policy and the data processing terms in section 6 of our Terms & Conditions. The Service is operated by WebWorks 101 OÜ, registry code 14816432, Sepapaja tn 6, 15551 Tallinn, Estonia.
1. Two kinds of data
- Account data is data about you as a customer: your account, your settings and your payments. For this data we are the controller.
- End-visitor data is data about the people who visit your websites and see your widgets. For this data you, the website owner, are the controller and we are your processor.
2. Account data
- Name, email address, password (stored only as a secure hash), language, time zone and account settings.
- Your websites (campaigns), widgets and their settings and content.
- Plan, payment history and invoice details. Card payments are handled by Stripe; we do not receive or store full card numbers.
- IP address, browser and device type, login times and security logs.
- Messages you send us and the service emails we send you.
The legal bases and purposes are described in the Privacy Policy.
3. End-visitor data
When you install the wwidgets.com pixel on a website, the following data about its visitors can be processed on your behalf, depending on the widgets you use:
- Impressions, clicks and conversions of your widgets, together with approximate location derived from the IP address, browser and device type, and the page on which the widget was shown.
- Lead form data: information visitors type into widgets such as email collectors, request collectors and feedback widgets (for example an email address, a name or a message). Which fields are collected is decided by you when you set up the widget.
- Consent logs (cookie consent widget, ww_consent): for every choice a visitor makes we store a consent ID (a random identifier), the action (first choice, change or withdrawal), the chosen categories, the text version, date and time (UTC), the page address (domain and path only), language, a masked IP address (IPv4 with the last octet set to 0; IPv6 only the first three groups), country code, device type, browser and operating system. These records contain no names, email addresses or full IP addresses.
- The widget also stores the visitor's choice in a cookie named ww_consent on your own domain, for the period you select (6 to 24 months).
4. Roles and responsibilities
- You decide which widgets run on your websites and which data they collect. You are responsible for informing your visitors, for having a lawful basis (including consent where required) and for answering requests from your visitors.
- We process end-visitor data only on your documented instructions, as set out in the data processing terms (section 6 of the Terms & Conditions), which serve as the data processing agreement under Art. 28 GDPR.
- We support you with requests from visitors, for example by letting you find, view and export consent records by consent ID.
- We do not use end-visitor data for our own advertising and we do not sell it.
5. Retention
- Account data: kept while your account exists. After you delete your account it is removed as described in our Data Deletion Policy. Invoices and payment records are kept for as long as accounting law requires.
- Widget statistics and lead data: kept as long as the widget or campaign exists, subject to the retention period of your plan, and removed when you delete the widget or campaign.
- Consent logs: kept for the period you choose (1, 2, 3 or 5 years; 3 years by default) and then deleted automatically every night. They remain after you delete a campaign, so that you can still prove consent, and are permanently deleted 30 days after you delete your account.
- Security logs: kept for a limited time.
6. Sub-processors and recipients
- Hosting provider: servers in Germany (European Union), where the Service and its database run.
- Stripe: payment processing. Stripe acts as an independent controller for payment data and may process data outside the EU under appropriate safeguards such as the EU Standard Contractual Clauses.
- Cloudflare, Inc.: content delivery and security; requests to our servers pass through its network.
We will announce planned changes to our sub-processors as described in the data processing terms.
7. Security measures
- Encrypted connections (TLS) between your visitors, your browser and our servers.
- Passwords stored only as secure hashes.
- IP addresses in consent logs are masked before they are stored.
- Records can be read only through your authenticated account or your API key; every export of consent records is recorded in your account's activity log.
- Access by our team only where needed to run and support the Service.
- Regular backups and hosting on servers in Germany.
No system is completely secure. If a personal data breach affects your data, we will notify you without undue delay, as set out in the data processing terms.
8. Your rights and contact
You can access, correct, export and delete most of your data in your account. For other requests, or for any question about this policy, email [email protected]. Visitors to your websites who want to exercise their rights regarding data collected by your widgets should contact the owner of that website.
WebWorks 101 OÜ, registry code 14816432
Sepapaja tn 6, 15551 Tallinn, Estonia