Best Shopify SEO Agency is published by , which acts as the data controller for all personal data described below. This policy explains what is collected, why, who it reaches, how long it is kept, and what you can require us to do about it.
Two things worth stating plainly at the top. Reading this site requires no account and no personal data beyond what your browser sends automatically. Personal data is collected only when you choose to give it, by submitting the newsletter or checklist form.
Table of Contents
What personal data we collect
Three categories, and no more.
- Data you submit voluntarily: your email address, and your name where a form asks for it, when you request the checklist or subscribe to the newsletter.
- Data your browser sends automatically: IP address, browser type and version, operating system, referring page, pages viewed, and timestamps. Standard server log data, generated by visiting any website.
- Data from cookies and similar technologies: described in the cookies section below.
We do not collect special category data as defined in Article 9 of the GDPR, meaning data revealing health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or sexual orientation. Do not send such data to us.
We do not ask for payment details on this site. No products or services are sold here.
Why we process it, and on what legal basis
Every processing activity needs a lawful basis under Article 6 of the GDPR. The table below sets out ours.
| What we do | Data used | Legal basis |
|---|---|---|
| Send the checklist you requested | Email address | Consent, Art. 6(1)(a) |
| Send the newsletter | Email address, name | Consent, Art. 6(1)(a) |
| Reply to a message you send us | Email address, message content | Legitimate interests, Art. 6(1)(f) |
| Keep the site running and secure | Server logs, IP address | Legitimate interests, Art. 6(1)(f) |
| Measure aggregate traffic | Analytics data | Consent where cookies are used, Art. 6(1)(a) |
| Meet legal and tax obligations | Records of consent | Legal obligation, Art. 6(1)(c) |
Where we rely on legitimate interests, the interest is operating a functioning, secure website and responding to people who contact us. We have weighed that against your rights and consider the processing minimal, expected, and low risk. You can object at any time using the contact details below.
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
Cookies and similar technologies
Cookies are small files placed on your device that let a site remember things between page loads. This site uses as few as it can function with.
- Strictly necessary cookies keep the site working: session handling, security, and load balancing. These cannot be switched off and do not require consent.
- Analytics cookies tell us which pages get read and where visitors arrive from, in aggregate. These are set only if you accept them.
We do not use advertising cookies, retargeting pixels, or cross-site tracking on this site.
Most browsers let you block or delete cookies through their settings. Blocking strictly necessary cookies may stop parts of the site working. Blocking analytics cookies has no effect on what you can read here.
Who we share data with
We do not sell personal data. We do not share it with the agencies ranked on this site, and being listed in the ranking gives an agency no access to anything.
Data reaches third parties only where they process it on our instructions, under a data processing agreement, to deliver a service we use:
- Hosting (hosting and server logs)
- Kit.com (newsletter and lead magnet delivery)
- Google Analytics (aggregate traffic measurement)
We may also disclose data where a law, court order, or competent authority requires it, or where disclosure is necessary to establish, exercise, or defend a legal claim.
International transfers
Some processors listed above operate servers outside the European Economic Area. Where personal data is transferred outside the EEA, the transfer relies on one of the safeguards permitted under Chapter V of the GDPR: an adequacy decision by the European Commission, Standard Contractual Clauses, or another recognised mechanism.
You can request details of the safeguard applying to a specific transfer by writing to .
How long we keep it
Retention periods are set by purpose, not by convenience.
| Data | Kept for |
|---|---|
| Newsletter subscriber email | Until you unsubscribe, then deleted within 30 days |
| Checklist request email | Until you unsubscribe, then deleted within 30 days |
| Correspondence you send us | 24 months from the last message |
| Server logs | Up to 12 months |
| Aggregate analytics | Up to 26 months |
| Records of consent | As long as we rely on the consent, plus the applicable limitation period |
Your rights
The GDPR gives you eight rights over your personal data, and exercising them is free. You can ask us to do any of the following.
- Access: get confirmation of whether we hold data about you, and a copy of it.
- Rectification: have inaccurate data corrected and incomplete data completed.
- Erasure: have your data deleted where one of the grounds in Article 17 applies.
- Restriction: have processing paused while a dispute about accuracy or lawfulness is resolved.
- Portability: receive the data you gave us in a structured, machine-readable format, or have it sent to another controller.
- Objection: object to processing based on legitimate interests, and to direct marketing at any time, which we will always honour.
- Withdraw consent: withdraw it at any time, including by using the unsubscribe link in any email we send.
- Automated decisions: not be subject to decisions based solely on automated processing that produce legal effects. We make no such decisions.
Write to to exercise any of these. We respond within one month, extendable by two further months for complex requests, in which case we tell you why within the first month. We may ask for information confirming your identity before acting.
If you are unhappy with how we handle your request, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or to the supervisory authority in your own country of residence.
How we protect your data
The site runs over HTTPS. Access to subscriber data is limited to people who need it, protected by strong authentication. Processors are selected on their security posture and bound by data processing agreements.
No transmission over the internet is completely secure, and we do not claim otherwise. Where a personal data breach is likely to result in a risk to your rights and freedoms, we notify the Autoriteit Persoonsgegevens within 72 hours, and we notify you directly where the risk is high.
Children
This site is aimed at business decision-makers and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to and we will delete it.
Links to other sites
This site names agencies but does not link out to them. Where any outbound link does appear, following it takes you to a site governed by its own privacy policy, over which we have no control and for which we accept no responsibility. Read the policy of any site you visit.
Changes to this policy
We review this policy when our processing changes and at least once a year. The effective date at the top of the page records the current version. Material changes affecting how we use your data are notified by email to subscribers before they take effect.
Contact
Questions about this policy, or about how your data is handled, go to . General enquiries go to . Postal mail reaches us at , .
We have not appointed a Data Protection Officer, as our processing does not meet the thresholds in Article 37 of the GDPR. Privacy questions are handled directly by the address above.