Privacy Policy

This policy explains how Exceed SEO SL collects and uses personal data when you visit our website, book a call, work with us as a client, or are contacted by us about our services. We process personal data under the EU General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

1. Who is responsible for your data

Exceed SEO SL, NIF B19439652, Calle Eugenio Gross 16, 6C, 29009 Málaga, Spain. Contact for any privacy question or request: eddie@exceedseo.com.

2. What we process, why, and on what basis

Booking a call through our Calendly widget

• Data: name, work email, company, and any details you add to the booking form
• Legal basis: steps prior to a contract at your request (art. 6.1.b GDPR)
• Kept for: up to 2 years after our last contact, unless you become a client

Delivering our services and managing the client relationship

• Data: contact details of client staff, emails, Slack messages, meeting recordings and notes, invoicing data
• Legal basis: performance of the contract (art. 6.1.b) and legal obligations (art. 6.1.c)
• Kept for: the duration of the contract and up to 2 years after it ends; invoicing and accounting records for 6 years, as required by Spanish law

Monitoring and improving service quality

• Data: recordings and transcripts of calls with clients, and messages exchanged with clients, analysed with AI tools to assess client satisfaction and spot issues early
• Legal basis: our legitimate interest in delivering a good service and keeping client relationships healthy (art. 6.1.f)
• Kept for: copies used for this analysis are deleted after 6 months; company-level scores and summaries are kept for the duration of the relationship (original recordings follow the client relationship periods above)

Business development

• Data: name, job title, company, work email and professional profile (e.g. LinkedIn) of people at companies that may benefit from our services
• Legal basis: our legitimate interest in promoting our services to businesses (art. 6.1.f)
• Kept for: up to 2 years after our last contact, or until you object

Website analytics and improvement

• Data: usage data, device and browser information, pages visited, and interactions, collected through cookies
• Legal basis: your consent (art. 6.1.a), given through our cookie banner
• Kept for: see our Cookie Policy

Service-quality analysis is done at company level and is not used to make decisions about individual people. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

Where we process our clients' own data (for example, analytics or search data from their websites) on their behalf, we act as a processor, and our data processing agreement with that client applies instead of this policy.

3. Where your data comes from

Mostly from you: when you book a call, email us, join a call, or message us. For business development, we may also collect professional contact details from public sources such as company websites and LinkedIn. If we contact you this way, we will tell you how we got your details and you can ask us to stop at any time.

4. Who we share it with

We do not sell personal data. We share it only with service providers who process it on our behalf under data processing agreements:

• Scheduling: Calendly
• Meeting recording and transcription: Fathom
• Team and client communication: Slack, Google Workspace
• CRM and outreach tools we use for sales and client management
• AI analysis: Anthropic (Claude API); data sent through the API is not used to train its models
• Web hosting and app infrastructure, including the database for our internal tools
• Analytics: Google (Google Analytics 4, Google Tag Manager, Google Search Console), Hotjar
• Accounting: our external accountants

We may also disclose data where required by law, for example to tax authorities.

5. International transfers

Some of these providers are based in, or use servers in, the United States or other countries outside the EU. Where this happens, transfers are protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

6. Your rights

You can ask us at any time to:

• access the personal data we hold about you
• correct inaccurate data
• delete your data
• restrict how we use it
• receive it in a portable format
• object to processing based on our legitimate interest, including service-quality analysis and business development
• withdraw consent you have given, for example for analytics cookies, without affecting earlier processing

Email eddie@exceedseo.com. We will reply within one month. If you are not satisfied with our response, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es).

7. Security

We use access controls, encryption in transit, and reputable providers to protect personal data, and we keep only what we need for the purposes above.

8. Changes to this policy

We may update this policy. The date at the top shows when it last changed; we will tell clients directly about significant changes.