Privacy Policy

1. Who this policy covers

This policy applies to everyone who visits seo-engineers.com, including visitors based in the EU and Malta, where SEO Engineers is founded and based. Because a large share of our clients are EU and Malta-based businesses, this site is built to be GDPR-compliant by default, not as an afterthought.

2. Data collected through the contact form

When you fill in the form on our Contact page, we ask for:

• Name— so we know who we're talking to.
• Email address— so we can reply to your enquiry.
• Company— optional, helps us understand the context of your enquiry.
• Website— optional, so we can look at the site you want help with before we reply.
• Service you're interested in— e.g. a technical SEO audit or a Vibe Code Security Audit, so your message reaches the right person.
• Message— the detail of what you need.

We use this information for one purpose only: to respond to your enquiry and, if it goes further, to scope and deliver the work you've asked about. We don't add you to a marketing list, sell your details, or share them with anyone outside SEO Engineers except the processors listed in section 6. The legal basis for processing this data is Article 6(1)(b) GDPR (steps taken at your request prior to a contract) and, where no contract follows, our legitimate interest in responding to enquiries sent to us (Article 6(1)(f)).

We keep enquiry data for as long as needed to handle the conversation and, if you become a client, for the duration of that relationship plus any period required by Maltese tax and accounting law. If nothing comes of an enquiry, we delete it within 12 months.

3. Spam protection (Cloudflare Turnstile)

The contact form is protected by Cloudflare Turnstile, a privacy-friendly alternative to traditional CAPTCHAs. Turnstile runs a background check on technical signals — things like your browser's behaviour and IP address — to confirm you're a human rather than a bot, without showing you image puzzles. This processing happens under Cloudflare's own privacy terms and is limited to the moment you submit the form; it doesn't track you around the rest of the site. We use Turnstile because unprotected contact forms on client-facing agency sites get flooded with automated spam within days of launch — this is a security measure, not a tracking one.

4. Cookies

This site sets one cookie of its own, plus the two cookies Google Analytics needs (see section 5):

lang_pref is strictly necessary for the site to function as intended and falls under the GDPR/ePrivacy exemption for functional cookies, so it does not require consent. The two Google Analytics cookies are a different matter: they are analytics cookies, they are not covered by that exemption, and they are set as soon as a page loads. There is no cookie consent banner on this site at present, so if you would rather not have them, section 5 sets out how to opt out. We run no advertising or retargeting pixels and no third-party marketing trackers.

5. Analytics (Google Analytics 4)

We use Google Analytics 4 on every page of this site to understand how it is being used: how many people visit, which pages they read, roughly which part of the world they are in, and whether they arrived from a search engine, a link on another site, or by typing the address in. We use that to decide which pages to improve and what to write next. It is not used to build advertising profiles, and we have not switched on Google Ads remarketing, ad personalisation, or Google Signals for this property.

The service is provided by Google Ireland Limited, which acts as our data processor; where data is passed on to Google LLC in the United States, Google relies on the European Commission's standard contractual clauses and on its certification under the EU-US Data Privacy Framework. Google's own privacy policy describes what it does with the data as a company.

What it collects on our behalf is the standard GA4 set of usage data: the pages you view and the order you view them in, how long you stay, the site or search engine that referred you, an approximate location worked out from your IP address, and technical details such as device type, screen size, browser, and operating system. GA4 does not log or store IP addresses — your IP is used to derive that coarse location and is then discarded. To recognise the same browser across pages and across visits, it reads and writes the two analytics cookies listed in section 4. What reaches us is aggregated reporting: we cannot identify you by name from it, and it is never joined up with anything you send us through the contact form.

Our legal basis for analysing this data is our legitimate interest in measuring and improving the performance of our own website (Article 6(1)(f) GDPR). We do not show a cookie consent banner, so if you would rather not be counted, you can opt out yourself in either of these ways:

• Install Google's official Google Analytics Opt-out Browser Add-on. It stops your browser sending anything to Google Analytics — on this site and on every other site you visit.
• Block or delete cookies for seo-engineers.com in your browser settings, or turn on your browser's tracking protection. Most current browsers and most content blockers already block googletagmanager.com outright, which has the same effect.

Either route is enough to keep you out of our figures, and nothing on the site stops working if you take it — no page needs the analytics tag to load, and the contact form submits without it.

6. Hosting and data processors

This site is served through Cloudflare, which acts as our data processor for content delivery, security (including the Turnstile check above), and DNS. Cloudflare may process technical data such as IP addresses as part of routing and protecting traffic to this site, under its role as a GDPR-compliant processor operating standard contractual clauses for any data transferred outside the EU. Our other processor is Google, for the analytics described in section 5. Beyond those two we use no further third-party analytics, advertising, or social embedding services. The site's styling framework is served from our own server, so your browser makes no request to a third-party CDN for it.

7. Your rights under the GDPR

If you're in the EU or Malta (or the GDPR otherwise applies to you), you have the right to:

• Ask what personal data we hold about you and get a copy of it (right of access).
• Ask us to correct inaccurate data (right to rectification).
• Ask us to delete your data, e.g. an old enquiry we no longer need (right to erasure).
• Object to or ask us to restrict how we use your data (right to object / restrict).
• Ask for your data in a portable format (right to data portability).
• Lodge a complaint with Malta's data protection authority, the Information and Data Protection Commissioner (IDPC), or your own country's supervisory authority.

To exercise any of these rights, just email us — see section 8.

8. Questions or requests

For anything relating to this policy, your data, or a rights request, email us directly at [email protected]. We aim to respond within a few working days.

9. Changes to this policy

If we change what we collect or why — for example if we add another tool that processes visitor data — we'll update this page and revise the "last updated" date at the top. We won't quietly widen what we do with your data without saying so here first.