Privacy Policy

Effective date: June 6, 2026

Last updated: July 11, 2026

This Privacy Policy explains how personal data is collected, used, stored, and protected when you visit and use the website 2keys.studio.

This Policy applies exclusively to the Two Keys Studio website and to the services provided through it. It does not apply to third-party websites, applications, or platforms that you may access through external links.

1. Data Controller

The data controller responsible for processing personal data is:

Marios Nakis

Trade Name: Two Keys Studio

VAT Number: 130330666 - KEFODE ATTIKIS

GEMI Number: 193992509000

Address: Anonimos 2 0, Punta, Poros 18020, Greece

Email: hello@2keys.studio

Phone: 6972177929

For any question regarding personal-data processing or to exercise any of your rights, you may contact us by email at:

hello@2keys.studio

2. Personal Data We May Collect

Depending on how you use the website, the following categories of personal data may be collected.

2.1 Contact Data

When you contact us by email or through another available communication channel, we may collect:

• full name,
• business name,
• email address,
• phone number,
• website or social-media links,
• information about your business or project,
• message content,
• files or materials you choose to send.

This information is used to respond to your request, assess a potential collaboration, and, where necessary, prepare a proposal or define the next steps.

2.2 Appointment-Scheduling Data

The website may include an external link to a booking page powered by Google Calendar.

If you choose to schedule an appointment, you may be asked to provide information such as:

• full name,
• email address,
• contact details,
• appointment date and time,
• any information you choose to include in the booking form.

The booking page is operated through a third-party service. Before submitting personal data, you are advised to review the privacy policy of the relevant platform.

2.3 Technical Data and Logs

When you visit the website, technical data may be collected where necessary for proper functionality, security, and troubleshooting, including:

• IP address,
• browser type,
• operating system,
• device type,
• access date and time,
• requested URL,
• referrer URL,
• technical security logs,
• server and CDN performance data.

2.4 Cookie-Consent Preferences

CookieYes CMP is used to store your cookie-consent preferences.

Depending on the configuration and use of the service, the following information may be recorded:

• consent ID,
• consent status,
• date and time of your selection,
• cookie categories you accepted or rejected,
• country or general geographic area.

This data is used to manage your preferences and document consent where required.

2.5 Google Analytics 4 Data

Only if you consent to the Analytics category, Google Analytics 4 may collect data such as:

• number of visits,
• pages viewed,
• visit duration,
• traffic source,
• basic website interactions,
• device type,
• browser,
• approximate geographic area,
• session statistics.

Google Analytics should not be used to transmit information such as your name, email address, or phone number.

2.6 Meta Pixel Data

Only if you consent to the Advertising category, Meta Pixel may process data such as:

• IP address and approximate geographic area,
• browser and device information,
• requested page and referrer URL,
• date and time of an interaction,
• PageView, ViewContent, Contact, and similar website events,
• the _fbp browser identifier.

This information may be used for advertising measurement, attribution, and audience or remarketing functions where configured. Two Keys Studio does not intentionally send names, email addresses, phone numbers, or form-field contents through these browser events.

2.7 Website Reality Check Data

When you use the Website Reality Check, the public website address you enter is sent through the Two Keys Studio server to Google PageSpeed Insights and the Chrome UX Report services so that a technical report can be prepared.

Recent technical reports may be cached for up to six hours to reduce duplicate requests. Cache files are removed after no more than 24 hours. Rate-limit records use a protected hash of the requesting IP address and are not used to identify visitors.

Running a check does not require a name, email address, or phone number.

If you separately request a human website review, you are directed to an external form operated through Google Forms. Information you choose to submit may include your name, business name, email address, optional phone number, website address, main concern, and message. Google may also process technical information, such as your IP address, browser, device, and interaction data, under the Google Privacy Policy.

Two Keys Studio uses the submitted information only to review your request, respond to you, assess a possible collaboration, and prepare relevant next steps. Responses may be stored in Google Forms and related Google Workspace services, such as Google Drive or Google Sheets, with access limited to authorised users. Submitting the form does not automatically add you to a marketing list.

3. Purposes of Processing

Personal data may be used for the following purposes:

• responding to questions or contact requests,
• assessing potential collaborations,
• preparing a proposal or providing requested information,
• scheduling and managing appointments,
• providing agreed services,
• improving website functionality and user experience,
• analysing website traffic, only after consent,
• measuring advertising performance, attributing visits or actions, and supporting audience functions, only after Advertising consent,
• managing cookie preferences,
• protecting the website against spam, abuse, and malicious activity,
• providing technical support and resolving issues,
• running the Website Reality Check and preventing repeated or abusive requests,
• complying with legal, tax, or accounting obligations,
• establishing, exercising, or defending legal claims where necessary.

4. Legal Bases for Processing

Depending on the circumstances, processing is based on one or more of the following legal grounds.

4.1 Your Consent

Consent is used for optional analytics and advertising cookies, pixels, tags, and related technologies. Analytics and Advertising consent can be granted or rejected independently.

You may withdraw your consent at any time through the:

Cookie Settings

link in the website footer.

4.2 Steps Taken Before Entering into a Contract

This applies when you contact us regarding a potential collaboration, request information, book an appointment, or request a proposal.

4.3 Performance of a Contract

This applies where personal-data processing is necessary to provide agreed services.

4.4 Legitimate Interests

This applies where processing is necessary for:

• website security,
• fraud or abuse prevention,
• technical operation,
• communication management,
• protection of legal rights,
• service improvement where this does not override users' rights and freedoms.

4.5 Legal Obligations

This applies where processing is required by tax, accounting, or other applicable legislation.

5. Cookies and Similar Technologies

The website uses cookies and similar technologies.

Strictly necessary cookies are activated to support basic website functionality and store consent preferences.

Analytics cookies are activated only if you choose to accept them through the cookie banner.

Advertising cookies and Meta Pixel are activated only if you choose to accept the Advertising category through the cookie banner. Accepting Advertising is not conditional on accepting Analytics, and vice versa.

For detailed information about the cookies used, their duration, and how to manage them, please review the:

Cookie Policy

6. Google Analytics 4

The website uses Google Analytics 4 for traffic analysis only after the visitor consents to the Analytics category.

Google Analytics is used to understand:

• how many users visit the website,
• which pages are most relevant,
• where traffic comes from,
• how the website is used,
• which areas may require improvement.

Two Keys Studio does not seek to send directly identifying information through Google Analytics, such as names, email addresses, or phone numbers.

The retention period for user-level data in Google Analytics is set to:

14 months

The duration of individual analytics cookies is described in the Cookie Policy.

7. Meta Pixel

The website uses Meta Pixel only after the visitor provides Advertising consent.

Meta Pixel helps Two Keys Studio measure advertising performance, attribute visits or website actions to campaigns, and use audience or remarketing functions where configured. Consent-controlled browser events may include PageView, ViewContent, and Contact. Meta may receive technical data and the _fbp identifier described above.

Meta Platforms Ireland Limited may process this data as an independent controller or service provider, depending on the feature and context. More information is available in the Meta Privacy Policy and Meta Cookies Policy.

The _fbp cookie duration is described in the Cookie Policy. Data retained by Meta is handled according to the applicable Meta settings and policies.

8. Google Tag Manager

The website uses Google Tag Manager as a technical tag-management tool.

Google Tag Manager helps load and manage scripts such as Google Analytics 4 and Meta Pixel in accordance with the user's consent preferences.

Using Google Tag Manager does not mean that all tags are activated automatically. Analytics and Advertising tags are controlled independently through CookieYes CMP and the user's consent choices.

9. CookieYes CMP

The website uses CookieYes CMP for:

• displaying the cookie banner,
• storing consent preferences,
• managing cookie categories,
• changing or withdrawing consent,
• documenting consent where required.

You may change your choices at any time through the:

Cookie Settings

link in the website footer.

10. Website Fonts

The website uses locally served or system fonts. This helps minimise third-party requests connected to basic page rendering.

11. Recipients and Service Providers

Personal data may be shared or made accessible, only to the extent necessary, with providers that support website operation or service delivery, such as:

• hosting and CDN providers,
• email providers,
• Google services, including Google Analytics, Google Tag Manager, Google Calendar, Google Forms, Google Drive, Google Sheets, PageSpeed Insights, and the Chrome UX Report,
• Meta Platforms Ireland Limited for Meta Pixel and consent-controlled advertising measurement,
• CookieYes CMP,
• technical partners, only where required,
• accountants, legal advisers, or competent authorities where required by law or necessary to protect legal rights.

Depending on the service and context, these providers may act as processors or independent controllers.

12. International Data Transfers

Some providers may process personal data outside the European Economic Area.

Where required, such transfers are carried out using appropriate safeguards under applicable law, including:

• adequacy decisions,
• Standard Contractual Clauses,
• additional organisational or technical safeguards.

13. Data-Retention Periods

Personal data is retained only for as long as necessary for the purpose for which it was collected or for as long as required by applicable law.

Indicatively:

When retaining data is no longer necessary, the data is deleted or anonymised where technically and legally feasible.

14. Data Security

Reasonable technical and organisational measures are applied to protect personal data, including:

• HTTPS / SSL,
• access restrictions,
• strong passwords,
• two-factor authentication where available,
• system updates,
• basic backups,
• CDN and security controls,
• limited use of third-party tools,
• access management for accounts and data.

No method of data transmission or storage can guarantee absolute security.

15. Your Rights

Under applicable data-protection law, you may have the right to:

• access your personal data,
• correct inaccurate or incomplete data,
• request deletion,
• restrict processing,
• object to processing,
• request data portability,
• withdraw consent,
• lodge a complaint with the competent supervisory authority.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact:

hello@2keys.studio

Additional information may be requested to verify your identity before completing the request.

16. Supervisory Authority

For Greece, the competent supervisory authority is the:

Hellenic Data Protection Authority

You may contact the Authority if you believe that the processing of your personal data violates applicable data-protection law.

17. External Links

The website may contain links to third-party websites or services, such as booking platforms, social-media profiles, or client websites.

Two Keys Studio does not control and is not responsible for the content, security, or privacy practices of third-party websites.

You are advised to review the privacy policies of the relevant providers before submitting personal data.

18. Automated Decision-Making

At this time, no automated decision-making is used that produces legal effects or similarly significantly affects you.

19. Children's Data

The website and Two Keys Studio services are primarily intended for professionals and businesses.

We do not seek to collect personal data from children.

If you believe that a child has submitted personal data without appropriate authorisation, contact:

hello@2keys.studio

20. Changes to This Privacy Policy

This Policy may be updated when there are changes to:

• services,
• third-party tools,
• website functionality,
• data-processing practices,
• legal or technical requirements.

The latest version will be published on the website with an updated revision date.

21. Contact

For questions regarding this Policy or the processing of personal data:

Two Keys Studio

Marios Nakis

Email: hello@2keys.studio

Phone: 6972177929