Privacy Policy

Version 4, effective 28 October 2026.

This policy explains what personal data we collect through onwardseo.com, why, on what legal basis, who receives it, how long we keep it and what your rights are. In short:

• We use your data to answer you, to deliver what you order, to keep the website secure and fast, and to understand how it is used.
• Google Analytics, the Calendly booking calendar and the measurement of our ChatGPT ads (with OpenAI) run only if you allow them in our cookie panel. You can change your choice at any time in Cookie settings.
• Some things run without asking, because the site needs them or because we rely on our legitimate interest: page delivery and security (Cloudflare), cookie-free statistics (Cloudflare Web Analytics), spam protection on our contact and CV forms (Google reCAPTCHA) and payment security on our order pages (Stripe). Section 3 explains each one.
• We do not sell your data. With your consent, we measure whether our ads in ChatGPT lead to orders (section 3.15); we do not use your data to target or personalise ads.
• You can ask to see, correct or delete your data at any time: support@onwardseo.com.

1. Who is responsible for your data

onwardSEO is a brand of Virtual Media SRL, which decides how your data is used (the “controller”):

• Registered office: Str. Aviatorilor 3, Roman, Neamț County, Romania
• Trade Register no. J27/436/2007; CUI / VAT no. RO21383197
• Privacy contact: support@onwardseo.com

We have not appointed a data protection officer, as GDPR Art. 37 does not require one for our activities. Write to the address above with any question about your data.

2. When this policy applies

When you visit onwardseo.com or use our Ping My URL tool, contact us, book a meeting, become our client, order Rank Check Reports or Onward Nexus, withdraw from an order, or send us a job application.

When we work on a client’s website, the client is the controller of any personal data in that work (for example in its analytics or Search Console). There we act as the client’s processor under our contract with them, and the client’s privacy notice applies.

3. What we collect, why, and on what legal basis

We use personal data only on these legal bases (GDPR Art. 6(1)): (a) your consent; (b) a contract with you, or steps you ask for before one; (c) a legal obligation; (f) our legitimate interests, which we name in each case.

3.1 Visiting the website

Data: your IP address, browser and device type, the pages you request, the page you came from and the time of each request.

Why: to deliver the pages quickly through Cloudflare’s network and to protect the site against attacks, spam and abuse.

Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f)).

Kept: see “technical and security logs” in section 6.

3.2 Cookie-free statistics (Cloudflare Web Analytics)

On every page view a small Cloudflare script, which runs without asking, measures how fast the page loads. Cloudflare receives the page address, the page you came from, your browser and device type and the load times; like any request, this reaches Cloudflare with your IP address, from which Cloudflare works out your country. The script sets no cookies and stores nothing on your device.

Why: to keep the site fast and to see basic visit numbers (page views, referring sites, countries).

Legal basis: our legitimate interest in measuring the speed and use of our site without cookies (Art. 6(1)(f)).

Kept: Cloudflare keeps these statistics available to us for about 6 months.

Your choice: because these statistics do not identify you, we cannot switch them off for one visitor. To stop them, block static.cloudflareinsights.com in your browser or content blocker; the site works the same without it.

3.3 Google Analytics (only with your consent)

If you allow “Analytics” in our cookie panel, Google Analytics 4 records how the site is used: the pages you view, how you arrived, your device and browser, your approximate location (country or city) and a random identifier kept in the _ga cookies in your browser. Until you allow it, Google’s tag does not load at all (Google Consent Mode, basic setup). Even with your consent, our setup tells Google not to use this data for advertising: the advertising consent signals stay “denied”.

Why: to see which pages help visitors and to improve the site.

Legal basis: your consent (Art. 6(1)(a); Law 506/2004 art. 4(5)). You can withdraw it at any time in Cookie settings; this stops Google Analytics and deletes its cookies on our site.

Kept: on Google’s servers, event data for 2 months and data linked to the identifier for 14 months after your last visit; our reports use aggregated figures. Google acts as our processor.

3.4 Contact and quote forms, e-mail and WhatsApp

Data: what you enter in our forms: name, e-mail address, phone number, website, industry, the service you are interested in and your message (on the Google penalty form, also details of any manual action). With each entry we also save your IP address and browser type, to spot spam. If you write to us by e-mail or WhatsApp, we receive your address or number and your messages.

Why: to answer you and, if you ask, to prepare an offer.

Legal basis: steps you ask for before a contract (Art. 6(1)(b)); for inquiries from or on behalf of a business, our legitimate interest in answering business inquiries (Art. 6(1)(f)); for the spam checks, our legitimate interest in protecting our forms (Art. 6(1)(f)).

Kept: 12 months after our last exchange if no contract follows; if you become our client, see 3.6. WhatsApp is run by Meta, which acts as a separate controller under its own privacy policy.

Spam protection: our three contact forms and our CV form use Google reCAPTCHA. On the pages with these forms it loads at your first tap, click, key press or scroll, even if you do not use the form, and checks that a person, not a bot, is using the page, based on your IP address, browser data and how you use the page; it sets the _GRECAPTCHA cookie. Legal basis: our legitimate interest in protecting our forms from spam and abuse (Art. 6(1)(f)). Google processes this data as our processor. To contact us without reCAPTCHA, e-mail support@onwardseo.com.

3.5 Booking a meeting (Calendly)

The booking calendar on our meeting pages is provided by Calendly. It loads only if you allow “External media” in our cookie panel or press “Show calendar” in its box; pressing the button also changes a cookie choice you have already made to allow External media. You can also book directly on calendly.com.

Data: your name, e-mail address, the time you choose and anything you add in the booking form.

Why: to arrange and hold the call.

Legal basis: for loading the calendar, your consent (Art. 6(1)(a); Law 506/2004 art. 4(5)); for the booking, steps you ask for before a contract (Art. 6(1)(b)) or, if you book for a business, our legitimate interest in arranging business meetings (Art. 6(1)(f)).

Kept: 12 months after the meeting if no contract follows. Calendly handles the bookings as our processor; for the cookies its calendar sets for its own purposes, Calendly is a separate controller (see Calendly’s privacy notice).

3.6 Clients of our SEO services

Data: the names and contact details of you or of your company’s contact persons, the contract, project information, our messages, and invoices and payments.

Why: to provide the services we agreed, to communicate about the work and to invoice.

Legal basis: our contract with you (Art. 6(1)(b)); if you act for a company, our legitimate interest in working with the company’s contact persons (Art. 6(1)(f)); our legal obligations for invoicing and accounting (Art. 6(1)(c)).

Kept: the contract and our messages about it, during the contract and for 3 years after it ends, the general limitation period for legal claims (Romanian Civil Code art. 2517); invoices, 5 years from 1 July of the year after the financial year (Law 82/1991 art. 25, as amended by Law 36/2023). Personal data inside your website’s tools: see section 2.

3.7 Rank Check Reports orders

Data: your website, keyword list, chosen Google editions, cities and depth; if you add them, the name, logo and brand color for the report; your name, e-mail address and country; if you add them, a company name, VAT number and billing address; and the order and payment status. Your card details go directly to Stripe; we never see or store them.

Why: to run your check, build and deliver your report, invoice you and meet our accounting obligations.

Legal basis: our contract with you (Art. 6(1)(b)) or, if you order for a company, our legitimate interest in fulfilling the company’s order (Art. 6(1)(f)); and our legal obligations (Art. 6(1)(c)).

Who receives it: Stripe (payments and invoices); our search-results data provider, which receives your keywords and Google settings only, never your name or e-mail address; HostGator, our website host; our accountant; and, for a paid order, OpenAI, only if you allowed Advertising and came from one of our ChatGPT ads (see 3.15). We do not sell or publish your data.

Kept:

• order form entries, including your keyword list and any logo you upload: deleted after 90 days;
• reports: kept for at least 90 days after the check, so that your next check can show the change against earlier ones, and deleted at the latest 24 months after your last check; if you ask, we delete them sooner;
• other records of your order and our messages about it: up to 3 years after the order is completed (Civil Code art. 2517);
• invoices and payment records: see 3.9.

3.8 Onward Nexus orders

Data: the package and article options you choose (language, length, urgency), your website, site platform and WordPress theme name, your name, e-mail address and country; if you add them, phone number, company name, VAT number and billing address; and the order and payment status. Card details go directly to Stripe.

Why: to write and deliver your articles and invoice you.

Legal basis: our contract with you (Art. 6(1)(b)) or, if you order for a company, our legitimate interest in fulfilling the company’s order (Art. 6(1)(f)); and our legal obligations (Art. 6(1)(c)).

Kept: while the order runs and up to 3 years after it is completed (Civil Code art. 2517); invoices and payment records: see 3.9.

3.9 Invoices and payments for website orders

Invoices and payment records for orders placed on this website are issued and stored by Stripe, our payment provider (a third party), on our behalf, for the 5 years Romanian accounting law requires: from 1 July of the year after the financial year in which they were issued (Law 82/1991 art. 25, as amended by Law 36/2023). Stripe also keeps payment data under its own legal obligations, as a separate controller: see Stripe’s privacy policy. Our accountant receives invoice data for bookkeeping and tax filings, and invoice data is reported to the Romanian tax authority (ANAF) where the law requires. Legal basis: our legal obligations (Art. 6(1)(c)).

On our two order pages, Stripe’s payment script loads at your first tap, click, key press or scroll, so that the card form is ready, and sets fraud-prevention cookies (see our Cookie Policy). Stripe uses this data to prevent fraud as a separate controller. Legal basis for loading the script: our legitimate interest in secure payments (Art. 6(1)(f)).

3.10 Withdrawal requests

If you use our withdrawal form, we receive your name, order number and e-mail address and use them to process and confirm your withdrawal. Legal basis: our obligations under consumer law (Art. 6(1)(c)) and our legitimate interest in being able to show how we handled your withdrawal (Art. 6(1)(f)). Kept: the form entries are deleted automatically after 2 years; the rest of the order record follows 3.7 or 3.8.

3.11 Job applications

Data: your name, e-mail address, phone number, Skype ID if you give it, your CV and your answer to our question; with the entry we also save your IP address and browser type, to spot spam. Please do not include sensitive information, such as health data, in your CV.

Why: to assess your application and contact you about it.

Legal basis: steps you ask for before a contract with us (Art. 6(1)(b)); for the spam checks, our legitimate interest in protecting our forms (Art. 6(1)(f)).

Kept: 6 months after we receive it, unless we start working together; ask us and we delete it sooner.

3.12 Ping My URL tool

The tool does not ask for your name or e-mail address. It sends the web addresses you enter, with their page titles, to the ping services of search engines, which is the service you ask for. It runs on tools.onwardseo.com, hosted by Netlify, which processes your IP address to deliver it.

Legal basis: providing the tool you use (Art. 6(1)(b)) and our legitimate interest in keeping it secure (Art. 6(1)(f)). Kept: see “technical and security logs” in section 6.

3.13 Your cookie choice

Your choice in our cookie panel is stored in your browser, in the onw_consent cookie, for 180 days: what you chose, when, and the version of the panel. It lets the site respect your choice on every page; we do not keep a copy on our servers. Legal basis: our legal obligation to respect your choice (Law 506/2004 art. 4(5); GDPR Art. 6(1)(c) and Art. 7).

3.14 Staff log-in

The log-in page (/login/) is meant for our team. It uses WordPress log-in cookies and loads a font from Google Fonts, which receives your IP address; Google acts as a separate controller for Google Fonts. Log-ins, failed log-in attempts and changes in the site’s admin area are recorded to protect the site. Legal basis: our legitimate interest in a secure, working log-in page (Art. 6(1)(f)). Kept: see “technical and security logs” in section 6.

3.15 Measuring our ChatGPT ads (OpenAI, only with your consent)

We advertise Rank Check Reports in ChatGPT. If you allow “Advertising” in our cookie panel and arrive on our Rank Check Reports page from one of our ads, our own script saves the ad’s code, found in the page address, in a cookie. If you then pay for an order on that page, our server reports it to OpenAI. Nothing of OpenAI’s loads in your browser, and we report only orders paid in a browser that came from one of our ads in the last 30 days.

Data: the code OpenAI adds to the link of our ad when you click it, which lets OpenAI match your order to that click; it is kept in the __oppref cookie in your browser for 30 days. For a paid order, our server sends OpenAI that code, the order number, the time of payment, the page address, and the order’s value, currency and package. We do not send OpenAI your name, your e-mail address, your IP address, your browser details or anything you type in the order form.

Why: to know whether our ChatGPT ads lead to orders and what each order costs us in advertising.

Legal basis: your consent (Art. 6(1)(a); Law 506/2004 art. 4(5)). You can withdraw it at any time in Cookie settings; this deletes the __oppref cookie in that browser, and orders you pay for after that are not reported to OpenAI. An order you have already paid for may still be reported.

Who receives it: OpenAI Ireland Ltd., which may transfer it to OpenAI in the USA (see section 5). We mark every event so that OpenAI does not use it to personalise ads; for visitors in the EEA and Switzerland, OpenAI then processes it on our behalf, as our processor. For visitors elsewhere, OpenAI acts as a separate controller under its own privacy policy.

Kept: the __oppref cookie, in your browser, for 30 days; the ad’s code on our server, with your order, only until the order is reported (7 days at most); at OpenAI, for as long as its advertising terms and data protection law allow (OpenAI does not publish a fixed period).

4. Who receives your data

We do not sell your data. We share it for advertising only to measure our ChatGPT ads, with your consent (3.15). We share it with these recipients, for the purposes above:

• HostGator (Newfold Digital, USA): hosts the website and its database (processor).
• Cloudflare (Cloudflare, Inc., USA): content delivery, security and the cookie-free statistics in 3.2 (processor).
• Google (Google Ireland Ltd. and Google LLC, USA): e-mail (Google Workspace), Google Analytics and Tag Manager (only with your consent) and reCAPTCHA, as our processor; Google Fonts on the staff log-in page, as a separate controller.
• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): payments and invoices, as our processor; fraud prevention and its own legal obligations, as a separate controller.
• Calendly (Calendly LLC, USA): meeting bookings, as our processor; its own cookies, as a separate controller.
• OpenAI (OpenAI Ireland Ltd.; may transfer data to OpenAI in the USA, see section 5): measuring our ChatGPT ads, only with your consent; as our processor for visitors in the EEA and Switzerland, otherwise as a separate controller.
• Make (make.com): automation service connected to our website (processor).
• Netlify (Netlify, Inc., USA): hosting of the Ping My URL tool (processor).
• Our search-results data provider: receives only the keywords and Google settings of a Rank Check order (processor).
• Our accountant (Romania): bookkeeping and tax filings, under its own professional and legal obligations.
• Meta (WhatsApp): only if you contact us on WhatsApp, as a separate controller.
• Search engines’ ping services: the web addresses you submit in the Ping My URL tool.
• Public authorities, such as the tax authority (ANAF) or a court, when the law requires it.

Processors may use the data only on our instructions, under data processing terms (GDPR Art. 28).

5. Transfers outside the EU

Several of these recipients are based in the USA or use servers there. Where a provider is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission’s adequacy decision of 10 July 2023; otherwise it relies on the Commission’s standard contractual clauses (GDPR Art. 46(2)(c)). You can ask us for a copy of these safeguards.

6. How long we keep your data

When a period ends, we delete the data or make it anonymous.

7. Your rights

• Access: a copy of your data and information on how we use it (Art. 15).
• Rectification: correction of inaccurate data (Art. 16).
• Erasure: deletion of your data, unless the law requires keeping it, for example invoices (Art. 17).
• Restriction: limiting how we use your data, for example while a correction or an objection is being checked (Art. 18).
• Portability: the data you gave us on the basis of consent or a contract, in a common machine-readable format, sent to you or, where technically possible, directly to another company (Art. 20).
• Withdrawing consent at any time, without affecting what was done before (Art. 7(3)); for cookies, use Cookie settings.
• No automated decisions: we do not make decisions about you based only on automated processing, including profiling, that have legal or similarly significant effects (Art. 22).

To use a right, write to support@onwardseo.com. It is free, unless a request is clearly unfounded or excessive (Art. 12(5)). We reply within one month; for complex or numerous requests we may extend this by two months and will tell you why within the first month. We may ask you to confirm your identity.

8. Your right to object

You can object at any time, on grounds relating to your situation, to our use of your data based on legitimate interests (Art. 6(1)(f)): security and spam protection, the cookie-free statistics, the payment script on our order pages, and our handling of business inquiries, bookings and orders made for companies. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims (GDPR Art. 21). Write to support@onwardseo.com. For the cookie-free statistics, which do not identify you, 3.2 explains how to block them yourself.

9. Complaints

You can complain to the Romanian data protection authority, or to the authority of the EU country where you live or work or where you think the infringement happened:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, cod poștal 010336, București, România · tel. +40.318.059.211 / +40.318.059.212 · fax +40.318.059.602 · anspdcp@dataprotection.ro · www.dataprotection.ro

We would welcome the chance to resolve your concern first: support@onwardseo.com.

10. Do you have to give us your data?

Giving us data is your choice, but some of it is needed: the fields marked * in our forms are needed to answer you or to enter into and carry out an order, and without them we cannot reply or deliver; invoices must also contain the details the law requires. Google Analytics, the Calendly calendar and the measurement of our ChatGPT ads are optional and run only with your consent.

11. Children

Our services are not aimed at children. We do not knowingly collect data from anyone under 16.

12. Security

The site uses encrypted connections (HTTPS) and Cloudflare’s protection against attacks, and card details go directly to Stripe. If a personal data breach happens, we will report it to the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to put anyone’s rights at risk; if it is likely to put your rights at high risk, we will also tell you without undue delay.

13. Cookies

We use strictly necessary cookies without asking and all other cookies only with your consent. The full list is in our Cookie Policy; you can change your choice at any time in Cookie settings.

14. Changes to this policy

When we change this policy, we update the version and date at the top. Before we use your data for a new purpose, we will tell you.

15. Contact

Virtual Media SRL (onwardSEO), Str. Aviatorilor 3, Roman, Neamț County, Romania · support@onwardseo.com