Privacy Policy

Visiting the website — server and access logs

What we process: IP address, date and time of access, the page requested, the referring page, browser type and version, and operating system. This happens automatically whenever you load any page.

Why: to deliver the website reliably, to keep it secure (detecting and preventing abuse, attacks, and errors), and for basic technical administration.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in the stable, secure operation of our website. We have balanced this against your interests and concluded that short-lived, purely technical logging that is not linked to any profile or used for marketing is a proportionate and expected part of operating a website.

Recipients: our hosting provider, acting as our processor under a data-processing agreement (Art. 28 GDPR). Logs are not shared with anyone else.

Retention: access logs are rotated automatically and deleted after a short, fixed period (typically no more than 7 days), except where a specific entry must be kept longer to investigate a security incident.

Contacting us — the enquiry / free-review-call form

What we process: the fields you submit — name, work email address, company name, website URL, phone number (optional), your message, and the service you are interested in.

Why: to respond to your enquiry and, where you are requesting a free strategy call or a quote, to take steps at your request before entering into a contract with you.

Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) for the substance of your enquiry; Art. 6(1)(f) GDPR (our legitimate interest in preventing spam and abuse of the form) for the technical validation, rate-limiting, and honeypot checks applied to every submission.

How it is handled technically: your submission is validated on our server and a brief, structured technical record of the request may be written to our operational logs (for rate-limiting and abuse prevention only). We do not currently forward form submissions to any third-party CRM, mailing list, or messaging service, and we do not build a marketing database from this form. Submitted content is not persisted beyond the operational log described above, which is subject to the retention period above.

Recipients: none outside SEO Review GmbH and our hosting provider (as processor). We do not sell, rent, or share this data with advertisers.

Retention: as above; where your enquiry leads to a client engagement, the relevant contact and engagement details are then kept as part of that business relationship, for as long as necessary to perform the contract and to meet statutory retention obligations (commercial and tax law generally requires records to be kept for 6–10 years in Germany).

Providing this data is voluntary but required fields (marked as such on the form) are necessary for us to respond; optional fields (such as phone number) are exactly that — optional, and leaving them blank does not affect your enquiry.

Analytics — Google Analytics 4 (consent-only)

What it is: we use Google Analytics 4 (“GA4”), a web-analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), part of Google LLC (USA), to understand how visitors use our site (pages viewed, time on site, general navigation paths, approximate region, device/browser type).

Legal basis: Art. 6(1)(a) GDPR — your explicit, opt-in consent, given (or refused) via the cookie banner described in the Cookie Policy. GA4 is never loaded, and no Google-related cookie or network request is made, before you actively click “Accept” in the banner or enable “Analytics” in the preferences panel. If you click “Reject”, or simply close the banner without accepting, GA4 does not load at all for that visit.

IP handling: GA4 does not log or store your full IP address; Google’s collection infrastructure is designed so that IP addresses are used only transiently to derive approximate location and are not retained in identifiable form alongside your analytics events.

International transfer: using GA4 involves transferring analytics data to Google LLC in the United States, a third country outside the EU/EEA. This transfer relies on the European Commission’s EU–U.S. Data Privacy Framework adequacy decision (for Google, as a certified participant) and, as a fallback safeguard, on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR) included in our data-processing terms with Google.

Retention: GA4 event-level data is configured to be automatically deleted after 14 months.

Withdrawing consent: you can withdraw your consent at any time, with effect for the future, using the “Cookie preferences” link in the site footer, which reopens the consent panel and lets you switch analytics off. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it (Art. 7(3) GDPR).

Cookies and local storage, including the consent record itself

See our Cookie Policy for the full inventory. In brief: the only storage set before any consent decision is the record of your cookie choice itself (what you accepted or rejected, and when). Storing that one record is strictly necessary to run the consent banner correctly and to avoid asking you again on every page, so it does not require consent under Art. 6(1)(f) GDPR and § 25(2) TDDDG (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz), which exempts storage that is strictly necessary to provide a service you have explicitly requested.