Matomo Website Privacy Policy
Effective Date: 19 November 2025
This Privacy Policy replaces the earlier version published on this website.
We believe in openness, privacy and 100% data ownership. Matomo’s mission is to liberate analytics and we are passionate about measuring for success. These core values are ingrained into everything we do here at Matomo and that will never change.
This Policy describes the personal information (or personal data) we collect and process, how we use that information, our legal basis for doing so and the measures we take to protect it. It also covers whether and how that information may be shared and your rights and choices regarding the information you provide to us. We are committed to protecting personal data we process in accordance with applicable laws, including the New Zealand Privacy Act 2020 and Regulation (EU) 2016/679 of 27 April 2016 (“GDPR”).
This Privacy Policy applies to the information that we obtain through:
(a) your use of Matomo websites including their subdomains: demo.matomo.cloud, forum.matomo.org, developer.matomo.org, shop.matomo.org, plugins.matomo.org, ios.matomo.org, issues.matomo.org, glossary.matomo.org, themes.matomo.org, builds.matomo.org;
(b) any direct contact you make with our team via email, contact forms, newsletter subscriptions, surveys, or when you complete any online feedback forms;
(c) when you create, use and make purchases through your Matomo Marketplace account or download our software directly from our websites;
(d) when you interact with us via our social media accounts
(e) when you participate in our Matomo Partner Programme; or
(f) when you apply for a role advertised on our websites.
This Privacy Policy also applies to instances where we may receive your personal data from third-party service providers.
This Privacy Policy does not apply to the collection and processing of information in the Matomo Cloud-hosted service provided by us, which is covered by the Matomo Cloud Privacy Policy and Matomo Data Processing Addendum.
Definitions:
Whenever terms such as “controller”, “processor”, “processing” are used in this policy, they have the meaning consistent with the GDPR. “Personal information” and “personal data” are used interchangeably and mean any information relating to an identified or identifiable natural person.
This Privacy Policy explains:
New Zealand is considered by the European Commission as a country providing adequate protection; this means that the country ensures a level of protection of Personal Data equivalent to that guaranteed by the European Union (in accordance with the GDPR).
We are the data controller, or agency, in relation to the activities described in this Privacy Policy, unless stated otherwise.
If you have any questions about this Privacy Policy or you would like to access earlier versions of this Privacy Policy, please contact our privacy team at privacy@matomo.org.
(a) When you contact us via our websites or directly via email — for example, when you ask for support, send us sales enquiries, questions, comments, feedback or when you complete a survey, customer satisfaction questionnaire or report a problem.
Personal data processed: your identification data (first and last name), your contact details (email address), your job title if provided, the content of the message.
Purpose: We use this data to answer the queries we receive, to build business relationships, to analyse the types of queries we receive, to improve our customer management processes and to improve our products and services. If you do not provide your personal data, we will not be able to respond to you.
Legal bases: Consent (Art. 6(1)(a) GDPR); Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR).
(b) When you sign up to receive Matomo content or offers – for example, when you sign up to receive our guidebooks or participate in our masterclasses, when you subscribe to the newsletter, or consent to receiving marketing materials.
Personal data processed: we use your name, job title (if provided) and email address to deliver the resources you requested.
Purpose: We use your email address to provide the requested resources.
Legal basis: Consent (Art. 6(1)(a) GDPR)
You can always withdraw your consent to receive our marketing content by clicking ‘unsubscribe’ in the relevant emails or contacting privacy@matomo.org.
(c) When you create an account — when you register for and open an account on Matomo forum, or create an account on the Matomo Marketplace, we may ask you to provide us with the following personal data: your name, email address and details about your organisation. Additionally, when you use your Matomo Marketplace account to purchase premium plugins, we collect and process your username, password, payment information, phone number and physical address. As otherwise detailed in this Privacy Policy, we will process this information solely to provide you with the service you signed up for. If you do not provide your personal data, we would not be able to create the accounts and you would not be able to purchase plugins on the Matomo Marketplace.
Purpose: Account creation and management; order management.
Legal bases: Contractual/pre-contractual performance (Art. 6(1)(b) GDPR); Legitimate interest (Art. 6(1)(f) GDPR)
(d) When you download Matomo On-Premise – we collect and store the following information relating to your Matomo On-Premise software licence, which may in some cases include personal data: the IP address of the server where the instance is hosted, the client URL, the installed version of Matomo On-Premise, the server’s PHP and MySQL versions, the update release channel used, the database version and programming language, the time zone, number of websites tracked and the number of licensed authorised users.
Purpose: We use this information to manage our licensing, billing and customer support.
Legal bases: Contractual/pre-contractual performance (Art. 6(1)(b) GDPR); Legitimate interest (Art. 6(1)(f) GDPR)
(e) When you apply for a role advertised on our website, we will collect the following personal data: your name, email address, country if provided, the role you are applying for and your CV and cover letter or message. Each form limits the collection of Personal Data to the strict minimum and indicates the mandatory or optional nature of responses by means of an asterisk.
Purpose: We use the personal data you provide to evaluate your application and communicate with you during the recruitment process. If you don’t provide your personal data, we would not be able to process your application.
Legal bases: Your consent (Art. 6(1)(a) GDPR), Contractual/pre-contractual performance (Art. 6(1)(b) GDPR)
(f) When you interact with us via social media, e.g., Meta (Facebook), GitHub, LinkedIn, Mastodon, Reddit, YouTube or X (formerly Twitter), or any other similar third-party page, your personal data is processed by the social media platform providers according to their privacy policies and processes. We process your personal data collected from social media, such as full name, business or personal email address, job title, company, telephone number and any other personal data you provide.
Purpose: We use the personal data to respond to your requests, develop a business relationship or send you direct marketing communications (subject to prior consent requirements where applicable). If we cannot use your personal data, we would not be able to respond to your requests, establish business relationships or send you marketing materials.
Legal bases: Legitimate interest (Art. 6(1)(f) GDPR); Your consent where applicable (Art. 6(1)(a) GDPR)
(g) We use data broker services to enrich our customer or prospective customer data - when you express interest in our product, sign up to our newsletter or other marketing materials, or are one of our customers, we work with a data broker services provider identified in Who we share your personal data with (section (b)) to help us know you better. This allows us to understand our customers’ requirements better, customise sales and marketing efforts and develop our products.
Personal data: The data broker services process your email address as data processors for us, and provide us with the following information, if they hold it, from their database: Company (your employer company name and corporate details), your job title, industry, office location (including city), business telephone number, business email address, LinkedIn URL. In some cases, we may receive information about your previous employers and titles.
Legal basis: We process this personal data on the basis of legitimate interest (Art. 6(1)(f) GDPR). Without the information we will not be able to customise our communications with you, to best meet your needs.
You can opt-out of data enrichment processing, by completing this form.
(h) Usage data - when you visit our site, we will store:the website you visited us from, the parts of our site you visit, the date and duration of your visit, your IP address which we store in full form in the server logs for 30 days for security reasons and which we anonymise on receipt for use in website analytics, information from the device (device type, operating system, screen resolution, language, nearest city and country you are located in, and web browser type) you used during your visit, and more. We process this usage data using our own analytics tool, Matomo Analytics, and we process the information for statistical purposes, to improve our site and to recognise and stop any misuse.
Legal basis: Your consent, if applicable (Art. 6(1)(a) GDPR) or legitimate interest (Art. 6(1)(f) GDPR).
You can opt out of being tracked by our Matomo Analytics instance below.
(i) Cookies and other trackers - we use cookies (small data files transferred onto computers or devices by websites) or similar technologies to make our websites function correctly and to understand how they are used. Some of these are essential for the site to function, while others (such as those used for analytics or performance) are only used where permitted by local privacy laws. You may deactivate or restrict the transmission of cookies or trackers by changing the settings of your web browser. Cookies that are already stored may be deleted at any time.
Refer to our Cookie Notice for more information.
Please be aware that some browsers can delete the opt-out cookie if you have not visited our website in anywhere between 7 days (Safari, Brave), 45 days (Firefox) or 400 days (Chrome) as of the date of this policy. These timeframes may be subject to change. If you are not a regular visitor to our websites and wish to opt-out of analytics use, please check the setting when you visit, to make sure the opt-out is still recognised by your browser.
(j) Partner data
When you become a Matomo partner, we process the following personal data: your contact and company details (e.g. name, email, phone number, company name and role) to manage the Partner Programme, provide services and support, and coordinate related activities.
We may also receive personal data about customers or leads from our trusted partners (e.g. resellers, referral partners, or support providers) for these purposes. We only accept such data where our partners confirm they are entitled to share it with us in line with applicable data protection laws and have provided appropriate transparency to the individuals concerned.
Legal bases: Contractual/pre-contractual performance (Art. 6(1)(b) GDPR); Legitimate interests (partner management, customer support) (Art. 6(1)(f) GDPR)
If the EU GDPR or UK GDPR is the law applicable to our processing of your data, you have the right of access to your Personal Data and to information regarding the processing of Personal Data by InnoCraft, the right to rectification/correction, erasure, restriction of processing and the right to object to the processing of your Personal Data. You have the right to object at any time to the processing of your personal data for direct marketing. You also have the right to receive your Personal Data in a structured, common and machine-readable format and to transmit it or have it transmitted to another controller. If you have given us your consent for processing your Personal Data, you also have the right to withdraw your consent at any time with effect for the future.
To the extent any U.S. state privacy act applies to our processing of your personal information, your rights may include a right to access, correct, delete, opt-out of certain processing, right to portability, right to opt-in for sensitive data processing, right against automated decision-making or other rights provided for under applicable laws.
We can only identify you through your email address and we can only adhere to your request and provide information if we have Personal Data about you through you having made contact with us directly and/or your use of our site and/or service. We cannot provide, rectify or delete any data that we store on behalf of our users or customers. If you wish to exercise your rights in relation to personal data processed by a publisher or a website using Matomo Analytics, please contact the publisher first.
To exercise any of the rights mentioned in this Privacy Policy and/or in the event of questions or comments relating to the use of Personal Data you may contact our privacy team: privacy@matomo.org
InnoCraft may request additional information to verify your identity before responding to your request. We will respond within thirty (30) days, unless a shorter response period is prescribed by the applicable law or extensions are necessary because of the number or complexity of requests.
In addition, you have the right to lodge a complaint with a data protection authority or a supervisory authority responsible for protecting your privacy rights, e.g.:
We also collect and maintain aggregated, anonymised information which we may retain indefinitely to protect the safety and security of our websites, improve our Services or comply with legal obligations.
If you have any concerns about the security of your personal data, please contact us immediately using the contact details provided below.
The version of this Privacy Policy in force is the one that applies on the date of your use of our websites or services described in this Policy.
If you wish to communicate directly with our Data Protection Officer (for instance, if you have a particularly sensitive matter), please contact them by post, as email communication may be vulnerable to security risks
Please state in your request that your concern relates to the company InnoCraft.
External Data Protection Officer
ePrivacy GmbH
represented by Prof. Dr. Christoph Bauer
Burchardstraße 14, 20095 Hamburg
Germany
This Privacy Policy applies to the information that we obtain through:
(a) your use of Matomo websites including their subdomains: demo.matomo.cloud, forum.matomo.org, developer.matomo.org, shop.matomo.org, plugins.matomo.org, ios.matomo.org, issues.matomo.org, glossary.matomo.org, themes.matomo.org, builds.matomo.org;
(b) any direct contact you make with our team via email, contact forms, newsletter subscriptions, surveys, or when you complete any online feedback forms;
(c) when you create, use and make purchases through your Matomo Marketplace account or download our software directly from our websites;
(d) when you interact with us via our social media accounts
(e) when you participate in our Matomo Partner Programme; or
(f) when you apply for a role advertised on our websites.
This Privacy Policy also applies to instances where we may receive your personal data from third-party service providers.
This Privacy Policy does not apply to the collection and processing of information in the Matomo Cloud-hosted service provided by us, which is covered by the Matomo Cloud Privacy Policy and Matomo Data Processing Addendum.
Definitions:
Whenever terms such as “controller”, “processor”, “processing” are used in this policy, they have the meaning consistent with the GDPR. “Personal information” and “personal data” are used interchangeably and mean any information relating to an identified or identifiable natural person.
This Privacy Policy explains:
- Who we are
- What personal data we collect, when we receive it and how we use it
- Opt-out of website tracking
- Legal bases
- Your rights
- Children’s privacy
- Who we share your personal data with
- International transfers
- Retention of data
- How we protect your personal data
- Automated decision-making including profiling
- Privacy Policy changes
- Contact us
Who we are
We are InnoCraft Limited (InnoCraft, we), a New Zealand registered company (NZBN 6106769), established by the creators of Matomo Analytics. Our offices are located at 7 Waterloo Quay, PO Box 625, 6140 Wellington, New Zealand.New Zealand is considered by the European Commission as a country providing adequate protection; this means that the country ensures a level of protection of Personal Data equivalent to that guaranteed by the European Union (in accordance with the GDPR).
We are the data controller, or agency, in relation to the activities described in this Privacy Policy, unless stated otherwise.
If you have any questions about this Privacy Policy or you would like to access earlier versions of this Privacy Policy, please contact our privacy team at privacy@matomo.org.
What personal data we collect, when we receive it and how we use it
We will never sell your personal data to anyone.
To provide you the best possible experience on our websites and deliver our services to you, we collect and process certain personal data as follows:(a) When you contact us via our websites or directly via email — for example, when you ask for support, send us sales enquiries, questions, comments, feedback or when you complete a survey, customer satisfaction questionnaire or report a problem.
Personal data processed: your identification data (first and last name), your contact details (email address), your job title if provided, the content of the message.
Purpose: We use this data to answer the queries we receive, to build business relationships, to analyse the types of queries we receive, to improve our customer management processes and to improve our products and services. If you do not provide your personal data, we will not be able to respond to you.
Legal bases: Consent (Art. 6(1)(a) GDPR); Contract performance and pre-contractual requests (Art. 6(1)(b) GDPR).
(b) When you sign up to receive Matomo content or offers – for example, when you sign up to receive our guidebooks or participate in our masterclasses, when you subscribe to the newsletter, or consent to receiving marketing materials.
Personal data processed: we use your name, job title (if provided) and email address to deliver the resources you requested.
Purpose: We use your email address to provide the requested resources.
Legal basis: Consent (Art. 6(1)(a) GDPR)
You can always withdraw your consent to receive our marketing content by clicking ‘unsubscribe’ in the relevant emails or contacting privacy@matomo.org.
(c) When you create an account — when you register for and open an account on Matomo forum, or create an account on the Matomo Marketplace, we may ask you to provide us with the following personal data: your name, email address and details about your organisation. Additionally, when you use your Matomo Marketplace account to purchase premium plugins, we collect and process your username, password, payment information, phone number and physical address. As otherwise detailed in this Privacy Policy, we will process this information solely to provide you with the service you signed up for. If you do not provide your personal data, we would not be able to create the accounts and you would not be able to purchase plugins on the Matomo Marketplace.
Purpose: Account creation and management; order management.
Legal bases: Contractual/pre-contractual performance (Art. 6(1)(b) GDPR); Legitimate interest (Art. 6(1)(f) GDPR)
(d) When you download Matomo On-Premise – we collect and store the following information relating to your Matomo On-Premise software licence, which may in some cases include personal data: the IP address of the server where the instance is hosted, the client URL, the installed version of Matomo On-Premise, the server’s PHP and MySQL versions, the update release channel used, the database version and programming language, the time zone, number of websites tracked and the number of licensed authorised users.
Purpose: We use this information to manage our licensing, billing and customer support.
Legal bases: Contractual/pre-contractual performance (Art. 6(1)(b) GDPR); Legitimate interest (Art. 6(1)(f) GDPR)
(e) When you apply for a role advertised on our website, we will collect the following personal data: your name, email address, country if provided, the role you are applying for and your CV and cover letter or message. Each form limits the collection of Personal Data to the strict minimum and indicates the mandatory or optional nature of responses by means of an asterisk.
Purpose: We use the personal data you provide to evaluate your application and communicate with you during the recruitment process. If you don’t provide your personal data, we would not be able to process your application.
Legal bases: Your consent (Art. 6(1)(a) GDPR), Contractual/pre-contractual performance (Art. 6(1)(b) GDPR)
(f) When you interact with us via social media, e.g., Meta (Facebook), GitHub, LinkedIn, Mastodon, Reddit, YouTube or X (formerly Twitter), or any other similar third-party page, your personal data is processed by the social media platform providers according to their privacy policies and processes. We process your personal data collected from social media, such as full name, business or personal email address, job title, company, telephone number and any other personal data you provide.
Purpose: We use the personal data to respond to your requests, develop a business relationship or send you direct marketing communications (subject to prior consent requirements where applicable). If we cannot use your personal data, we would not be able to respond to your requests, establish business relationships or send you marketing materials.
Legal bases: Legitimate interest (Art. 6(1)(f) GDPR); Your consent where applicable (Art. 6(1)(a) GDPR)
(g) We use data broker services to enrich our customer or prospective customer data - when you express interest in our product, sign up to our newsletter or other marketing materials, or are one of our customers, we work with a data broker services provider identified in Who we share your personal data with (section (b)) to help us know you better. This allows us to understand our customers’ requirements better, customise sales and marketing efforts and develop our products.
Personal data: The data broker services process your email address as data processors for us, and provide us with the following information, if they hold it, from their database: Company (your employer company name and corporate details), your job title, industry, office location (including city), business telephone number, business email address, LinkedIn URL. In some cases, we may receive information about your previous employers and titles.
Legal basis: We process this personal data on the basis of legitimate interest (Art. 6(1)(f) GDPR). Without the information we will not be able to customise our communications with you, to best meet your needs.
You can opt-out of data enrichment processing, by completing this form.
(h) Usage data - when you visit our site, we will store:the website you visited us from, the parts of our site you visit, the date and duration of your visit, your IP address which we store in full form in the server logs for 30 days for security reasons and which we anonymise on receipt for use in website analytics, information from the device (device type, operating system, screen resolution, language, nearest city and country you are located in, and web browser type) you used during your visit, and more. We process this usage data using our own analytics tool, Matomo Analytics, and we process the information for statistical purposes, to improve our site and to recognise and stop any misuse.
Legal basis: Your consent, if applicable (Art. 6(1)(a) GDPR) or legitimate interest (Art. 6(1)(f) GDPR).
You can opt out of being tracked by our Matomo Analytics instance below.
(i) Cookies and other trackers - we use cookies (small data files transferred onto computers or devices by websites) or similar technologies to make our websites function correctly and to understand how they are used. Some of these are essential for the site to function, while others (such as those used for analytics or performance) are only used where permitted by local privacy laws. You may deactivate or restrict the transmission of cookies or trackers by changing the settings of your web browser. Cookies that are already stored may be deleted at any time.
Refer to our Cookie Notice for more information.
Opt-out of website tracking
You may choose to prevent this website from aggregating and analysing the actions you take here. Doing so will protect your privacy, but will also prevent us from learning from your actions and creating a better experience for you and other users.Please be aware that some browsers can delete the opt-out cookie if you have not visited our website in anywhere between 7 days (Safari, Brave), 45 days (Firefox) or 400 days (Chrome) as of the date of this policy. These timeframes may be subject to change. If you are not a regular visitor to our websites and wish to opt-out of analytics use, please check the setting when you visit, to make sure the opt-out is still recognised by your browser.
(j) Partner data
When you become a Matomo partner, we process the following personal data: your contact and company details (e.g. name, email, phone number, company name and role) to manage the Partner Programme, provide services and support, and coordinate related activities.
We may also receive personal data about customers or leads from our trusted partners (e.g. resellers, referral partners, or support providers) for these purposes. We only accept such data where our partners confirm they are entitled to share it with us in line with applicable data protection laws and have provided appropriate transparency to the individuals concerned.
Legal bases: Contractual/pre-contractual performance (Art. 6(1)(b) GDPR); Legitimate interests (partner management, customer support) (Art. 6(1)(f) GDPR)
Your Rights
Data subject rights vary depending on the applicable privacy laws. We are based in New Zealand and governed by the New Zealand Privacy Act and any privacy laws that apply to the processing because of their extra-territorial effect (e.g. EU GDPR, UK GDPR).If the EU GDPR or UK GDPR is the law applicable to our processing of your data, you have the right of access to your Personal Data and to information regarding the processing of Personal Data by InnoCraft, the right to rectification/correction, erasure, restriction of processing and the right to object to the processing of your Personal Data. You have the right to object at any time to the processing of your personal data for direct marketing. You also have the right to receive your Personal Data in a structured, common and machine-readable format and to transmit it or have it transmitted to another controller. If you have given us your consent for processing your Personal Data, you also have the right to withdraw your consent at any time with effect for the future.
To the extent any U.S. state privacy act applies to our processing of your personal information, your rights may include a right to access, correct, delete, opt-out of certain processing, right to portability, right to opt-in for sensitive data processing, right against automated decision-making or other rights provided for under applicable laws.
We can only identify you through your email address and we can only adhere to your request and provide information if we have Personal Data about you through you having made contact with us directly and/or your use of our site and/or service. We cannot provide, rectify or delete any data that we store on behalf of our users or customers. If you wish to exercise your rights in relation to personal data processed by a publisher or a website using Matomo Analytics, please contact the publisher first.
To exercise any of the rights mentioned in this Privacy Policy and/or in the event of questions or comments relating to the use of Personal Data you may contact our privacy team: privacy@matomo.org
InnoCraft may request additional information to verify your identity before responding to your request. We will respond within thirty (30) days, unless a shorter response period is prescribed by the applicable law or extensions are necessary because of the number or complexity of requests.
In addition, you have the right to lodge a complaint with a data protection authority or a supervisory authority responsible for protecting your privacy rights, e.g.:
- New Zealand: Office of the Privacy Commissioner: https://www.privacy.org.nz/about-us/contact/
- UK: Information Commissioner’s Office: https://ico.org.uk/global/contact-us/
- EU: select the appropriate authority from the list provided by European Data Protection Board https://edpb.europa.eu/about-edpb/board/members_en
- Australia: Office of the Australian Information Commissioner: https://www.oaic.gov.au/about-us/contact-us/
- Rest of the world: please contact us on privacy@matomo.org and we can provide you with the details of the appropriate authority.
Children’s Privacy
Our websites and products are not intended for children or minors. We do not knowingly collect children’s or minors’ personal data. Any accounts created by a child or a minor without parental consent and brought to our attention will be deleted as required by law.Who We Share Your Personal Data With
A. Processors
We use a limited number of trusted external service providers for certain technical data processing and/or service offerings. These processors are carefully selected and meet high data protection and security standards. We share with them only the information that is required for the services provided and we contractually bind them to treat any information we share with them as confidential and to process personal data only according to our instructions.| Recipient | Purpose of processing | Our legal basis for processing | Data location and security | Personal data collected by the third party | Privacy Terms |
|---|---|---|---|---|---|
| Aut O’Mattic A8C Ireland Ltd. | Akismet - anti-spam solution | Legitimate interest: protecting Matomo Forum from spam reviews and inquiries | EU/US | IP address and approximate location Browser and device metadata Website usage data Content submitted by users (e.g., comments, form submissions) |
Processing covered by DPA available on request |
| AlwaysData S.à r.l., | Secure infrastructure for website servers, databases and logs | Contract (customers, potential customers) Legitimate interest (other data subjects):
|
Europe, France | IP address (stored for 30 days for security reasons), contact information provided via forms, subscriptions or queries | Processing covered by DPA |
| Atlassian Pty Limited and Atlassian, Inc | Company work management | Legitimate interest:
|
USA | Name, email address, role of customers | Processing covered by DPA |
| Amazon Web Services EMEA SARL, Luxembourg | Content delivery (CDN) and protection against malicious traffic (WAF) | Contract:
|
Worldwide; Visitors are sent to a server closest to their region (traffic from the EU stays in the EU). | Request Data (IP address, browser type, operating system, the URL) | Processing covered by DPA |
| Amazon Web Services EMEA SARL, Luxembourg | Matomo Analytics instance hosting for Matomo websites operated by InnoCraft | Consent (where required); or Legitimate interest (where permitted):
|
EU | Matomo Analytics usage data relating to our websites (see section “Usage Data”) | Processing covered by DPA |
| Calendly LLC | To book calls with customers, prospective customers or applicants | Contract | USA | Name, email, time zone and date of appointment | Processing covered by DPA |
| ChartMogul Ltd | Customer relationship management analytics | Legitimate interest
|
Germany | B2B customer/prospect: job title, name, phone number, email address. | Processing covered by DPA |
| Communiteq B.V. (previously Discourse Hosting) | To enable users to create an account on Matomo forum and participate in the forum. | Contract | Germany | Account information (e.g., username, last login date, registration IP, messages); session and device information; activity and usage data | Processing covered by DPA (available on request) |
| Descript, Inc. | AI-powered content creation and media editing and transcription tool | Consent | USA | Identifiers (name, email, role) Voice, image, statements, contextual data (which may include special categories of data) |
Processing covered by DPA available on request |
| Dovetail Research Pty Ltd | To transcribe, summarise, and process your feedback given in video interviews using AI tools | Consent | Australia and the EU | Video recording of the interview, transcript, contact details, personal information given during the interview | Processing covered by DPA (available on request) including AI terms |
| Employ, Inc. (previously Lever) | To receive job applications and reply to applicants | Contract | USA | All candidate information, resume, references, when staff come onboard after recruitment (successful candidates): Job application details (email, name, CV/resume, IP address), etc. | Processing covered by DPA |
| HappyScribe Ltd. | Transcription of calls with customers and prospective customers | Consent | Ireland | Name, email address, role of customers | Link |
| Help Scout, PBC | To receive and reply to your messages after you contact us | Consent:
|
USA | Message sent, name, email, if included in the email: contact address, job title, company name, company contact details | Processing covered by DPA |
| HubSpot, Inc. | To send marketing materials To receive webinar signup confirmation, reminder and follow-up emails |
Consent | EU | Processing covered by DPA | |
| HubSpot, Inc. | CRM system | Legitimate interest:
|
EU | Name, email, job title, company name, company contact details, sale details, account type, number of authorised users, requirements, account activation, etc. | Processing covered by DPA |
| Intuition Machines | Authorisation | Legitimate interest
|
USA | IP address numbers, device information | Processing covered by DPA |
| Magentrix Corporation | Partner management platform | Contract:
|
Canada | Partner contact details; Customer contact details (where permitted) |
Processing covered by DPA (available on request) |
| Microsoft France SAS | Use Microsoft 365 to manage workflows, files and documentation; email correspondence; meetings and scheduling | Consent:
|
France, EU | Name, email address, mailing address, telephone number, department, role, company name; Correspondence; Associated Matomo account; Billing address, subscriptions and payment history | Processing is covered by DPA (available on request) |
| Productboard, Inc | To collate and process product and services feedback | Legitimate interest:
|
USA | Work title and company name, any personal data included in the feedback | Processing is covered by DPA (available on request) |
| Slack Technologies Limited (Ireland) | Used for internal company communications | Legitimate interest:
|
USA | Name, email address, mailing address, telephone number, department, role, company name; Correspondence; Associated Matomo account; Billing address, subscriptions and payment history; |
Processing covered by DPA |
| Twilio, Inc. | To send you our newsletter emails after you sign up | Consent | USA | Name and email address | Processing covered by DPA and BCR |
| Typeform SL | To create online quizzes for leads and customers to voluntarily respond | Consent | EU, USA | Name and email address | Processing is covered by DPA (available on request) |
| Usercentrics GmbH (Germany) | Consent management platform | Legal requirement | EU |
Consent Data (Consent ID, Consent Number, Timestamp of the Consent, Opt-in or Opt-out, Banner Language, Customer Setting, Template Version) Device data (HTTP Agent, HTTP Referrer) IP address Geolocation |
Processing is covered by DPA (available on request) |
| Userlike UG | To be able to chat with you | Consent | Germany | IP Address, chat transcript, email address, browser, operating system, device, number of page requests, number of page visits, referrer, URL (where the chat originated), questionnaire before and after the chat (optional), chat topic, chat status (new, pending, closed), chat evaluation after the chat, duration of the chat, ate of the chat, geolocation (voluntary, optional), media files shared by the contact with the operator during the chat | Processing covered by DPA |
| UXtweak j.s.a. | To collect user/customer feedback | Consent | Slovakia | Name, email, job title, company, feedback | Processing covered by DPA |
| Yousign SAS | Management of document and contract signature process | Contract | France | Identification: Name, first name Contact: Email, postal address, phone number Professional: Job title, company Connection: Document name, metadata, legal log, IP address, data subject ID | Processing covered by DPA |
| Vanta, Inc. | Compliance management tool | Contract:
|
USA | Visitor metadata (IP address, browser and device information, referrer URL, timestamp) Access request and activity (name, email, company, NDA status, access history, pages viewed resources downloaded, actions taken) |
Processing is covered by DPA (available on request) |
| Zoho Corporation Pvt. Ltd. | To host customer feedback surveys | Legitimate interest:
|
EU | Customer email and feedback | link (DPA available on request) |
B. Third-party services we use
When you visit our websites, or purchase products or services, we use the following third-party services providers who collect and process your data as data controllers or joint controllers with us. These providers may collect personal data beyond the data we collect about you and act as independent controllers when you interact with them. Please refer to the privacy policies of these third parties for full information about what personal data these third parties collect about you, how they process the data, on what legal basis and how to exercise your data subject rights against them.
| Recipient | Purpose of processing | Our legal basis for processing | Data location and security | Examples of personal data collected by the third party | Third-party Privacy Policy |
|---|---|---|---|---|---|
| Cognism Limited | To enable customer and prospective customer data enrichment in B2B (business to business) context. This is to enable us to tailor our communications with you to better fit your needs and to better understand our customer base. | Legitimate interest
|
UK, Croatia (EU) | Company (employer company and company details), Job Title, Industry, Office location (including city), Business telephone number, Business email address, LinkedIn URL. In some cases, we may receive from Cognism information about your previous employers and titles. You can opt out of Cognism Data processing or opt out from us enriching your data by completing this form. |
Cognism Privacy Policy |
| Google Ads operated by Google Ireland Limited (EU) and Google LLC (USA) | To promote our services using non-personalised ads and measure aggregated ad performance. | Consent (for cookies/online identifiers, where required). | EU, USA | Device information, location, interaction data, browsing behaviour, Google Click Identifier (GCLID). | Google Privacy |
| LinkedIn Ads operated by LinkedIn Ireland Unlimited Company (EU) and LinkedIn Corporation (USA) | To promote our services on LinkedIn and generate sales leads. We only receive personal data when individuals voluntarily submit a LinkedIn Lead Gen Form; otherwise we receive only aggregated ad performance data. | Legitimate interest - sales and marketing | EU, USA | Name, email address, company, role, any custom fields in the form, timestamp, ad campaign name Aggregated ad performance metrics | LinkedIn Privacy Policy |
| Microsoft Ads operated by Microsoft Ireland Operations Ltd (EU) and Microsoft Corporation (USA) | To promote our services using non-personalised ads and measure aggregated ad performance. | Consent (for cookies/online identifiers, where required). | EU, USA | Conversion data (e.g. Microsoft Click Identifier — MSCLKID), device and browser metadata, location, interaction data | Microsoft Privacy Statement |
| PayPal Pte. Ltd. (PayPal Braintree) | To receive payments | Contract | USA, Singapore | Username, password, names, e-mail, payment information, phone number, billing address | PayPal Privacy Policy |
| Youtube (operated by Google LLC) | Social media content provision and interactions
To embed video files on our websites. We use Privacy Enhanced Mode to prevent your viewing of the embedded content being used to personalise your YouTube browsing experience |
Legitimate interest (content creation and user interaction)
or Consent (if required for specific processing, e.g., embedding content on our website) |
USA | At minimum your IP address, data processing in local storage and possibly cookies. If you are logged into Google account, Google may merge this action with your account. | Google Privacy Policy |
C. When you instruct us to transfer data to third parties
Looker Studio Integration: We provide the Matomo Connector (the “Connector”), designed to facilitate the seamless integration of your Matomo On-Premise account data with Looker Studio. If you choose to activate or use the Matomo Connector, please be aware of the following:
- Data Export: When you activate the Matomo Connector, all data stored within your Matomo account will be exported to Looker Studio. This transfer is initiated by you and is under your control.
- Data Privacy: Once your data is exported to Looker Studio, it will be governed by the applicable Looker Studio terms of service and policies provided by Google. We strongly advise you to review these terms and policies and understand the implications before initiating the data transfer.
- Privacy Considerations: Transferring data, especially visitor data, to external platforms can have privacy implications. It's crucial to ensure that you have the necessary permissions and have considered the privacy ramifications of such a transfer.
- Exclusive Connector Use: To ensure the security and privacy of your data, we recommend exclusively using the Matomo Connector for this integration. Avoid using third-party connectors or tools for Looker Studio that claim compatibility with Matomo, as we cannot vouch for their security or data handling practices.
International transfers
We may transfer your personal data to New Zealand on the basis of an adequacy decision. For the processors and third-party services mentioned above, we may transfer your personal data to a third country (i.e. outside the European Union (EU), the United Kingdom or the European Economic Area (EEA)). In such cases, we ensure that these transfers are made to countries which meet the transfer conditions under applicable privacy laws. For example, if GDPR applies, the European Commission has issued an adequacy decision, confirming an adequate level of protection under Article 45 of GDPR in such third countries. Where we transfer data from the EEA to third countries without an adequacy decision, we use the EU Standard Contractual Clauses and implement supplementary measures where needed. Where we transfer data from the UK, we use the UK IDTA or the UK Addendum to the EU SCCs.
Further information on this matter is available upon request at the following email address: privacy@matomo.org.
Retention of data
We will retain your information for as long as your account is active, as necessary to provide you with the services or as otherwise specified in this Policy. We will also retain and use this information as necessary for the purposes set out in this Policy and to the extent necessary to comply with our legal obligations, resolve disputes, enforce our agreements and protect our legal rights.We also collect and maintain aggregated, anonymised information which we may retain indefinitely to protect the safety and security of our websites, improve our Services or comply with legal obligations.
How We Protect Your Personal Data
Data security is important to us. We process your personal data securely, using appropriate technical and organisational measures designed to protect your data from unauthorised access, disclosure, alteration or loss. Some of the measures applied by InnoCraft include: the use of secure cloud infrastructure compliant with a number of information security standards, access controls, bug bounty programme, data encryption in-transit and at-rest, security risk monitoring and response and availability controls.If you have any concerns about the security of your personal data, please contact us immediately using the contact details provided below.
Automated decision-making including profiling
We do not engage in automated decision-making or profiling.
Privacy Policy changes
We may update this Policy from time to time. If we do, we’ll let you know about any material changes, either by notifying you on the website or by sending you an email. Once published on this website, the amended Privacy Policy will be effective as of the Effective Date stated above.The version of this Privacy Policy in force is the one that applies on the date of your use of our websites or services described in this Policy.
Contact us
If you have any questions or concerns regarding this Privacy Policy or how your personal data is processed, please contact us by emailing privacy@matomo.org or via the contact form: matomo.org/contact.
If you are based in New Zealand, you can write to us at our registered address: InnoCraft Limited, 7 Waterloo Quay, PO625, 6140 Wellington, New Zealand, Attention: Privacy Officer.
We aim to respond to your inquiries as soon as reasonably possible. If you wish to give us feedback on how we have handled your request, please let us know. We are always trying to improve.
EU Representative
Because InnoCraft is located outside of the EU and UK, the InnoCraft team has named a representative of controllers or processors not established in the EU or the EEA and in the UK (Art. 27 GDPR):
- If you are a resident of the EU or the EEA, you can contact:
ePrivacy Holding GmbH
Burchardstraße 14
20095 Hamburg
Germany
www.eprivacy.eu/en/legal - If you are a resident of the UK, you can contact:
UK Representative Service for GDPR Ltd.
7 Savoy Court
London WC2R 0EX
United Kingdom
www.eprivacy.eu/en/legal
If you wish to communicate directly with our Data Protection Officer (for instance, if you have a particularly sensitive matter), please contact them by post, as email communication may be vulnerable to security risks
Please state in your request that your concern relates to the company InnoCraft.
External Data Protection Officer
ePrivacy GmbH
represented by Prof. Dr. Christoph Bauer
Burchardstraße 14, 20095 Hamburg
Germany