Noetis — Visitor Intelligence & Personalisation Addendum

Version 2.0 · Effective date: to be announced upon release · Last updated: to be announced upon release

This Addendum governs Customer's use of Noetis Visitor Intelligence, behavioural profiling, experimentation and Personalisation functionality.

It supplements the Terms and DPA.

1. Purpose

Visitor Intelligence is designed to help Customer understand how Visitors interact with a Customer Property and, where lawfully configured, provide more relevant website experiences.

Depending on Customer configuration, Noetis may:

observe → associate → infer → decide → personalise → measure → learn.

2. Observation

The Service may process behavioural signals including:

• page visits;
• section visibility;
• scroll depth;
• clicks;
• CTA interactions;
• dwell time;
• navigation paths;
• repeat visits;
• experiment exposure;
• interaction and conversion events.

3. Visitor recognition

Where enabled and legally permitted, Noetis may assign or receive a pseudonymous Visitor Identifier enabling behavioural events from multiple sessions to be associated with the same Visitor Profile.

A Visitor Identifier is pseudonymous, not necessarily anonymous.

Noetis does not represent that pseudonymised Personal Data falls outside GDPR.

4. Visitor Profiles

The Service may aggregate behavioural signals into a Visitor Profile.

Profiles may include inferred:

• interests;
• preferences;
• engagement;
• commercial intent;
• behavioural segments;
• persona hypotheses;
• confidence indicators.

Such inferences are probabilistic.

Customer shall not present a Noetis inference as an objectively verified characteristic of an individual without independent verification.

5. Explainability records

The Service may retain information intended to explain how a profile or Personalisation developed, including:

• signals observed;
• inferences generated;
• changes to a profile;
• eligibility determinations;
• treatments selected;
• render/view status;
• interactions and outcomes.

Noetis does not guarantee that every AI or statistical operation can be reconstructed at model-internal or mathematical level.

Any explanation functionality is intended to provide meaningful operational information, not disclosure of proprietary model weights, system prompts, source code, security-sensitive information or Noetis trade secrets.

6. Consent gating

Where Customer configures a processing activity as consent-dependent, Noetis will use supported technical controls designed to prevent that activity before receipt of the required consent state.

For processing configured as consent-dependent, only a supported affirmative consent state may activate that processing. An unknown, missing, malformed, rejected or withdrawn consent state does not count as consent.

Customer is responsible for:

• selecting the correct consent category;
• determining which processing requires consent;
• obtaining valid consent;
• retaining evidence where required;
• communicating consent accurately;
• allowing refusal without unlawful detriment;
• allowing withdrawal.

A technical consent state received by Noetis is distinct from legal evidence of consent; Customer remains responsible for maintaining, or ensuring the availability of, such evidence where required.

Customer shall not intentionally bypass consent gating.

7. Withdrawal

Where a valid supported withdrawal signal is received, consent-dependent Visitor Intelligence and Personalisation for the relevant identifier shall cease in accordance with the DPA. This includes ceasing consent-dependent cross-session recognition, profile enrichment, consent-dependent inference, consent-dependent Personalisation and use of the profile for consent-dependent treatment selection; background processes shall not silently reactivate the withdrawn processing.

Historical behavioural data shall not be used to silently reconstruct the withdrawn consent-dependent Visitor Profile, and a return visit does not by itself reactivate the withdrawn purpose. Where consent is legally required, a new valid affirmative consent state is required before the processing may resume.

Customer acknowledges that withdrawal cannot retroactively undo processing lawfully performed before withdrawal.

8. Sensitive characteristics

Visitor Intelligence must not be configured to infer, classify, predict or personalise based on special-category Personal Data or criminal-conviction data, whether directly or through deliberate indirect proxies.

Noetis may maintain prohibited-signal and prohibited-inference controls.

Customer must not attempt to circumvent those controls through prompts, labels, custom events, event names, persona names, segments, APIs, integrations, metadata, source content or indirect proxies.

9. Proxy discrimination

Customer shall not intentionally use seemingly neutral signals as proxies to unlawfully discriminate based on protected or sensitive characteristics.

Noetis may disable configurations reasonably suspected of facilitating discriminatory treatment.

10. Personalisation

Where enabled, Noetis may use Visitor Data to select between eligible website experiences.

Personalisation may concern:

• wording;
• headlines;
• CTAs;
• content emphasis;
• section ordering;
• case selection;
• eligible layout variants;
• other Customer-authorised elements.

Personalisation does not authorise Noetis to modify Immutable Content.

11. Immutable Content

Unless Customer deliberately edits it outside autonomous functionality, autonomous functionality is not authorised to intentionally alter the substantive value or meaning of:

• actual prices;
• discounts or financial amounts;
• contractual terms;
• privacy notices;
• mandatory legal disclosures;
• regulatory warnings;
• binding guarantees;
• other elements designated Immutable.

Customer may separately permit presentation or contextual changes around such content — for example a surrounding headline, CTA or explanation — where the underlying immutable fact remains unchanged and is not misrepresented.

12. Experiments and controls

Noetis may assign eligible Visitors to:

• baseline/control experiences;
• Personalisation treatments;
• experiment variants;
• holdout groups.

Customer authorises the processing reasonably necessary to perform experiments that Customer enables, subject to applicable law and the DPA.

13. Decision versus exposure

The Service may distinguish between:

Selected — a treatment was chosen.

Rendered — the treatment was delivered into the page experience.

Viewed — the relevant content entered a defined viewability state.

Interacted — the Visitor interacted with it.

Converted — a configured outcome occurred.

These states are measurements and do not guarantee causation.

14. Measurement and causal claims

Noetis may use experimentation, holdouts and statistical methods intended to estimate whether an intervention caused a change in an outcome.

Results remain statistical estimates subject to uncertainty.

Noetis does not warrant that:

• every experiment is statistically conclusive;
• measured uplift will persist;
• an observed effect applies to other populations;
• statistical association always establishes causation.

15. Significant decisions prohibited

Visitor Intelligence is designed for website-content relevance and optimisation.

It must not be used as the sole basis for decisions producing legal or similarly significant effects concerning an individual unless expressly approved by Noetis and lawfully implemented.

16. No cross-customer tracking network

Noetis does not operate Visitor Intelligence as a cross-customer advertising identity network.

Pseudonymous Visitor Profiles from unrelated Customers will not be combined to target the same person across unrelated Customer Properties, and pseudonymised data is not treated as anonymous merely because direct identifiers are absent.

17. Customer transparency

Customer shall provide End Users with legally required information concerning its use of Visitor Intelligence.

Where applicable, this should explain in clear language:

• that behavioural information is collected;
• that returning Visitors may be recognised;
• that interests or preferences may be inferred;
• the purposes for which profiles are used;
• that website content may be personalised;
• relevant lawful bases;
• applicable retention;
• relevant recipients;
• how consent can be withdrawn or rights exercised.

18. Customer compliance

Customer is responsible for determining whether its deployment requires a DPIA or other assessment.

Noetis will provide reasonable technical and compliance information available to it to assist Customer.

19. Product safeguards

Noetis may implement technical restrictions more protective than Customer's configuration where reasonably necessary for privacy, security, legal compliance or protection of End Users.

Customer is not entitled to circumvent those safeguards.

20. No warranty of inference

Noetis makes no representation that an inferred persona, preference, interest, intent or other Derived Data accurately describes the Visitor.

Derived Data must be treated as a probabilistic signal.

Contact: chris@noetis.nl