Stats4U - Free Counters

What this agreement is for

When you embed the counter on your site, personal data of your visitors is collected there. You decide on the purposes and means of that processing and are therefore the controller within the meaning of Art. 4(7) GDPR. The provider processes that data solely on your instructions and is a processor within the meaning of Art. 4(8) GDPR.

For that relationship Art. 28(3) GDPR requires a contract. This is it. You need it for your own documentation — in particular for your record of processing activities and towards your supervisory authority.

Save or print this page. It carries a version number and a date and is therefore the version that applies to your period of use.

1. Parties and formation

1.1 Processor (the “processor”):

LW IT Solutions Company Lukas Wójcik, al. Tadeusza Kościuszki 80/82, lok. 301, 90-437 Łódź, Poland, NIP: PL7252266190, REGON: 369859995, e-mail: stats4u@lukaswojcik.com.

1.2 Controller (the “controller”) is the natural or legal person who embeds the counter code supplied by Stats4U on a website they operate or are responsible for.

1.3 This agreement is formed as soon as the controller embeds the counter code and applies from that moment. It is concluded in electronic form; this satisfies the written form required by Art. 28(9) GDPR.

1.4 The version published at www.stats4u.net/dpa governs. It carries a version number and a date. The controller should save the version applicable to its period of use.

1.5 This agreement prevails over the terms of service in all questions of processing on behalf of a controller.

2. Subject matter, nature and purpose of the processing

2.1 Subject matter: the collection, evaluation and provision of access figures for the controller's website (visitor counter and statistics).

2.2 Nature of the processing: collection, recording, organisation, storage, adaptation, retrieval, use, aggregation, erasure.

2.3 Purpose: audience measurement for the controller's website and presentation of the results on the associated statistics page.

2.4 Duration: indefinite, for as long as the counter code is embedded. The individual retention periods follow from section 11.

2.5 Place of processing: the processor's server in Łódź, Poland. Processing outside the European Union takes place only as set out in section 12.

3. Type of data and categories of data subjects

3.1 Categories of data subjects: visitors to the controller's website, and the controller itself where it has provided an e-mail address.

3.2 Type of personal data:

• IP address — to determine country and city and as an input to the daily hash; not stored in the statistics, but held for 14 days in the web server access log,
• daily hash (salted, 16 bytes) — to recognise a visitor within a single day; retained for 2 days,
• user agent — browser, operating system, detection of automated requests; only the result of the evaluation is stored,
• the address of the controller's page that was called up — retained for 400 days,
• referrer — domain only, retained for 400 days,
• browser language setting — only the result of the evaluation is stored, retained for 400 days,
• IP addresses and ranges excluded by the controller — in plain text, until withdrawn by the controller,
• names and daily counts of events defined by the controller itself — retained for 400 days,
• e-mail address of the counter owner, where provided — solely to send the administration link.

3.3 The counter sets no cookies and reads nothing from the visitor's device.

3.4 Special categories of personal data under Art. 9 GDPR are not the subject of this agreement. Through the design of its page addresses and event names, the controller ensures that no such data is transmitted.

3.5 The current overview, generated from the system configuration, is in the privacy policy. Where it differs from 3.2, it is the more accurate statement.

4. The controller's right to give instructions

4.1 The processor processes personal data solely on documented instructions from the controller, unless required to do otherwise by Union or Member State law. In that case the processor informs the controller of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.

4.2 This agreement, the terms of service and the settings chosen by the controller for its counter constitute documented instructions — in particular the visibility of the statistics, excluded addresses, events and the e-mail address provided.

4.3 Further instructions are given by the controller in text form to stats4u@lukaswojcik.com, quoting its counter number. The processor confirms receipt.

4.4 If the processor considers an instruction to be unlawful, it informs the controller without undue delay. It may suspend execution until the instruction is confirmed or amended.

4.5 The processor need not carry out instructions whose implementation is technically or economically impossible or unreasonable for it. The service is provided free of charge; the processor does not owe individual technical adaptations. In that case the controller may terminate under section 15.

5. Obligations of the processor

5.1 The processor processes the data only for the purposes named in section 2 and does not release it for its own purposes, for advertising or for building user profiles.

5.2 It does not sell data and does not pass raw data to third parties, save as provided in this agreement or as required by law.

5.3 It implements the technical and organisational measures under Art. 32 GDPR; they are described in Annex 1.

5.4 It binds all persons who have access to the data under its instructions to confidentiality, unless they are already under a statutory duty of confidentiality (section 6).

5.5 It assists the controller in accordance with sections 8 and 9.

5.6 It rectifies, erases or restricts the processing of the data on the controller's instructions.

5.7 It has not appointed a data protection officer; there is no obligation to do so under Art. 37 GDPR. The contact point for all questions under this agreement is the address given in 1.1.

5.8 The processor is not established in a third country; no representative under Art. 27 GDPR is to be designated.

6. Confidentiality

6.1 The processor keeps the data processed on the controller's behalf confidential, including after this agreement ends.

6.2 Only persons who need it in order to perform the engagement have access to the data. As at the date given under “Version”, that is exclusively the proprietor of the processor.

6.3 Further persons are bound to confidentiality before taking up their activity and are informed of the relevant rules.

7. Sub-processors

7.1 The controller hereby gives general authorisation under Art. 28(2) sentence 2 GDPR for the engagement of further processors.

7.2 The sub-processors engaged as at the date of this agreement are listed in Annex 2.

7.3 Where the processor intends to engage a further sub-processor or to replace an existing one, it announces this at least 30 days in advance on this page and on the blog. The controller may object in text form within that period.

7.4 If the controller objects, the processor may either refrain from the change or terminate this agreement under section 15. The controller has no claim to continued provision of the service without the sub-processor objected to.

7.5 The processor binds every sub-processor to data protection obligations equivalent to those in this agreement and remains answerable to the controller for its conduct.

7.6 Ancillary services obtained by the processor from third parties without those parties gaining access to the data processed under the engagement — such as electricity, network connectivity or domain administration — do not constitute sub-processing within the meaning of this section.

8. Assistance with data subject rights

8.1 The processor assists the controller by appropriate technical and organisational measures in responding to requests from data subjects under Chapter III GDPR.

8.2 Where a data subject approaches the processor directly, the processor refers them to the controller, to the extent the controller is identifiable from the request, and does not answer the request itself.

8.3 The controller is responsible for upholding data subject rights. The processor provides information only on instruction.

8.4 The scope for assistance is limited by the nature of the data: the statistics contain no IP addresses, the daily hashes are salted and the salt is deleted after 2 days. After that, a record can no longer be assigned to a data subject. Under Art. 11(2) GDPR the processor is not obliged to collect additional data solely in order to comply with a request.

9. Assistance with security, notifications and impact assessment

9.1 The processor assists the controller in complying with Art. 32 to 36 GDPR, to the extent the controller does not itself hold the necessary information.

9.2 Where the processor becomes aware of a personal data breach, it informs the controller without undue delay and no later than 48 hours after becoming aware. The notification contains, so far as known, the nature of the breach, the categories and approximate number of records concerned, the likely consequences and the measures taken.

9.3 Notification is sent to the e-mail address provided by the controller. If the controller has provided none, the processor announces the breach on www.stats4u.net. Controllers who wish to be notified directly should ensure that a reachable address is on file.

9.4 Notification to the supervisory authority under Art. 33 GDPR and communication to data subjects under Art. 34 GDPR are the controller's responsibility.

9.5 A data protection impact assessment under Art. 35 GDPR is carried out by the controller. The processor makes available for that purpose the information in this agreement, in Annex 1 and in the privacy policy.

10. Evidence and audits

10.1 The processor makes available to the controller all information necessary to demonstrate compliance with Art. 28 GDPR.

10.2 Evidence is provided primarily by this agreement, by Annex 1 and by the overview generated from the system configuration in the privacy policy. The processor provides supplementary information on request in text form.

10.3 On-site audits are possible after prior arrangement, with reasonable notice of at least four weeks, during normal business hours and at most once a year. The processor may object to auditors who compete with it.

10.4 The service is provided free of charge. The cost of audits going beyond 10.2 is borne by the controller. This does not apply where the audit is occasioned by a breach for which the processor is responsible.

10.5 The powers of supervisory authorities remain unaffected.

11. Erasure, retention and return

11.1 The processor erases the data processed under the engagement after this agreement ends. On the controller's instruction it returns the data instead; the controller receives it in a common, machine-readable format.

11.2 Independently of this, erasure runs continuously: daily hashes after 2 days, aggregated evaluations after 400 days, entries in the web server access log after 14 days.

11.3 The instruction under 11.1 must be given within 30 days of termination. After that the processor may erase without further prompting the controller.

11.4 The processor may retain data to the extent required by Union or Member State law. It informs the controller accordingly.

11.5 Aggregated figures without any personal reference — in particular the total counter reading — are not covered by the erasure obligation.

12. Transfers to third countries

12.1 Processing takes place in Poland and therefore within the European Union.

12.2 A transfer to a third country takes place only where it is set out in Annex 2, and only on a basis under Chapter V GDPR — an adequacy decision of the European Commission or standard contractual clauses.

12.3 The processor informs the controller before commencing any new transfer to a third country; section 7.3 applies accordingly.

13. Obligations of the controller

13.1 The controller alone is responsible for the lawfulness of the processing, in particular for the existence of a legal basis under Art. 6 GDPR and, where required, for obtaining consent.

13.2 It informs data subjects under Art. 13 GDPR. The processor supplies a ready-made text at privacy text for your site.

13.3 Where obliged to do so, it maintains a record of processing activities under Art. 30(1) GDPR.

13.4 It ensures that no personal data and no special categories of personal data are transmitted through page addresses, event names or other fields.

13.5 It assesses on its own responsibility whether the visibility it has chosen for its statistics page is compatible with its obligations.

13.6 It informs the processor of changes that are material to the processing.

14. Liability and indemnification

14.1 Art. 82 GDPR applies to damage suffered by a data subject as a result of processing. The processor's liability towards data subjects is not excluded by this agreement.

14.2 As between the parties, the controller bears responsibility for the lawfulness of the processing, for the legal basis, for informing data subjects and for the content of its instructions.

14.3 The controller shall indemnify the processor against all claims brought against the processor by data subjects, supervisory authorities or other third parties because a legal basis was missing, because information under Art. 13 GDPR was omitted or insufficient, because a required consent was missing, because the controller breached section 13, or because an instruction of the controller was unlawful. The indemnification covers damages, administrative fines, procedural costs and the reasonable costs of legal defence.

14.4 Where the processor has been liable for the entire damage under Art. 82(4) GDPR, it may claim back from the controller under Art. 82(5) GDPR to the extent the controller is responsible for the damage.

14.5 In all other respects § 7 of the terms of service applies. Claims of the controller against the processor under this agreement are limited in accordance with that provision, to the extent the law permits a limitation; liability for intent and liability towards data subjects under Art. 82 GDPR remain unaffected.

14.6 Where the controller is a consumer, the indemnification under 14.3 applies only to the extent that the controller is responsible for the underlying breach of duty.

15. Term and termination

15.1 This agreement runs for as long as the counter code is embedded and ends together with the use relationship under the terms of service.

15.2 The controller terminates it by removing the code from its pages.

15.3 The processor may terminate it at any time without notice; the obligations under sections 6 and 11 continue to apply.

15.4 The controller may also terminate where the processor does not comply with an instruction (section 4.5) or where the controller has objected to a new sub-processor (section 7.4).

16. Final provisions

16.1 Amendments to this agreement are published on this page with a new version number and announced on the blog. Anyone who does not agree to an amendment terminates the agreement under section 15.2.

16.2 Should a provision be invalid, the validity of the remaining provisions is unaffected; the statutory rules take the place of the invalid provision.

16.3 The law of the Republic of Poland applies. The place of jurisdiction is Łódź, where the controller is a trader.

16.4 This agreement exists in German, English and Polish. For controllers addressed in one of those languages the respective version is binding; for all other language versions the English version governs.

Annex 1 — Technical and organisational measures (Art. 32 GDPR)

What is described here is what is in place — not what would be desirable. The service runs on a single machine on the processor's premises; the measures are aligned to that.

Confidentiality

• Physical access: the server is located on the processor's premises, which are not open to the public.
• System access: command-line login exclusively by SSH with a key pair; the database accepts no connections from outside the machine.
• Data access: only the proprietor of the processor has access to the data (section 6.2). The administration area is protected by a password stored as a bcrypt hash.
• Credentials and keys are held outside the directory reachable over the network and cannot be retrieved over HTTP.
• Separation: the data of each counter is separated by its number. The daily hash includes the counter number — the same visitor cannot be recognised as the same person across two different sites.
• Pseudonymisation: the IP address is not stored in the statistics but feeds into a salted daily hash. The salt changes daily and is deleted after 2 days; after that the hash can no longer be linked to an IP address.

Integrity

• Transmission: all pages and the counter request run exclusively over HTTPS with a valid certificate.
• Input is passed to the database using prepared statements; output is escaped.
• The enquiry form is protected against automated submissions.
• Changes to the program code are logged under version control.

Availability and resilience

• The data is backed up; the backups are held outside the directory reachable over the network.
• There is no guaranteed availability and no entitlement to restoration (§ 3.2, § 7.5 of the terms of service). Controllers should themselves back up figures they depend on.
• A nightly run deletes expired data according to the periods in section 11.2.

Review and evaluation

• The statements about the processing in the privacy policy are generated from the system configuration and therefore do not drift apart when the technology changes.
• Engagement control: sub-processors only under section 7 and only per Annex 2.
• The measures are kept up to date; the published version of this annex governs.

Annex 2 — Sub-processors

As at 19 August 2026. A sub-processor is listed here where it may gain access to data from the engagement.

For the counter on the controller's site

• None. The counter data collected under the engagement does not leave the processor's server in Łódź. It is not transmitted to third parties, not stored in anyone else's cloud and not transferred to a third country.

Only for ancillary services towards the controller itself — not for its visitors' data:

• Namecheap, Inc. / PrivateEmail (USA) — sending the administration link to the e-mail address provided by the controller. Only that address is concerned. Basis for the transfer: standard contractual clauses. Anyone who provides no address is not concerned.
• Telegram FZ-LLC (United Arab Emirates) — forwarding submissions from the enquiry form to the processor. Only the details the sender writes into the form are concerned. Basis: Art. 49(1)(b) GDPR. Anyone who does not use the form is not concerned.

On the pages of www.stats4u.net itself — concerning visitors to those pages, not the controller's visitors:

• Google Ireland Limited — advertising on the statistics pages, consent management, and protection of the enquiry form against automated submissions. Details in the privacy policy.
• MousePlayer — session recording on www.stats4u.net, only with consent. This recording does not run on the controller's pages.

This list is kept up to date. Changes are announced under section 7.3 with 30 days' notice.

Version

Version 1.0, dated 19 August 2026. Earlier versions are not archived; if you wish to document a version, save or print this page.