Legal / Privacy
Privacy Policy
Search Orchard respects your privacy. This policy explains what personal data may be processed when you visit searchorchard.com, contact me, request a free SEO review or book a consultation. It also explains why that information is used, who may receive it and the rights available to you under European data protection law.
This notice is intended to meet the transparency requirements of Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR) and applicable Italian data protection law, including Legislative Decree No. 196/2003, as amended.
01
Who We Are
Search Orchard is an independent SEO and digital consultancy based in Turin, Italy, offering search consultancy, website-related services and enquiries through this website.
| Data controller | Arianna Ren |
|---|---|
| Trading name | Search Orchard |
| Location | Turin, Italy |
| Privacy contact | hello@searchorchard.com |
I have not appointed a data protection officer. As an individual consultant, I do not carry out the large-scale monitoring or large-scale processing of special categories of data that would require one under Article 37 GDPR. For any privacy question, contact me directly at the address above.
02
What Personal Data We Collect
The information processed depends on how you use the website.
Information you provide
| When you use the website | Personal data that may be processed |
|---|---|
| Send a contact or service enquiry | Name, email address, website URL, requested service, message or challenge, and other details you choose to provide. The exact fields vary between forms. Some forms also ask for a telephone number, target markets, platform, business area or Google Business Profile URL. |
| Request a free SEO audit | Website URL and email address, plus any optional name, business type, estimated organic traffic, Search Console access information or description of your main challenge. |
| Book a consultation | Name, email address, selected appointment time, time zone, website URL where provided, and booking-related information. |
| Email me directly | Your email address, the content of the message and any information you choose to include. |
| Receive a free-audit response | Information needed to review your website, and a Loom video walkthrough that shows your website and my findings. If you choose to share read-only access to Google Search Console, I use your search data only to prepare your audit. You can remove my access at any time in your Search Console settings. If you prefer not to share it, I work with publicly available information. |
Information processed automatically
| When you use the website | Personal data that may be processed |
|---|---|
| Browse pages | IP address, browser and device information, requested URLs and request headers, as processed in connection with website delivery and security. |
Free-text form fields may contain information you choose to provide beyond the requested details. Please do not send sensitive personal data unless it is genuinely necessary and we have agreed an appropriate way to handle it.
On the homepage, a website address entered in the hero field is passed to the free SEO audit page through a URL parameter (?url=), so the address can appear in browser history and relevant request logs. The audit did not establish that this field independently submits data to a third-party form provider before you send the full form.
03
How and Why We Use Your Data
I use information provided through the website to:
- respond to questions and service enquiries;
- understand the website, project or service you have asked about;
- prepare an initial review, proposal or agreed SEO audit;
- arrange, confirm and manage consultation bookings;
- deliver requested reports or follow-up communications;
- operate the website, maintain its availability and protect it from misuse; and
- comply with legal obligations where applicable.
The audited website does not contain a newsletter subscription system, CRM integration, advertising pixel or active analytics installation. I do not describe data as being used for email marketing or advertising on the basis of this audit.
04
Legal Bases for Processing
Different processing activities may rely on different legal bases under Article 6 GDPR. The appropriate basis depends on the purpose of the processing, not merely on which technology is used.
| Purpose | Legal basis |
|---|---|
| Answering your enquiry, preparing a free audit or proposal you asked for, and arranging a call you booked | Article 6(1)(b): steps taken at your request before entering into a contract. |
| Providing a service we have agreed, including reports, calls and related communication | Article 6(1)(b): performance of a contract. |
| Keeping invoices and accounting records | Article 6(1)(c): legal obligation under Italian civil and tax law (Article 2220 of the Civil Code; Article 22 of Presidential Decree 600/1973). |
| Delivering the website and protecting it from abuse | Article 6(1)(f): my legitimate interest in a website that is available, secure and free from spam or attacks. |
| Establishing, exercising or defending legal claims | Article 6(1)(f): my legitimate interest in protecting my rights. |
Where information is needed to answer a request or arrange a booking, not providing it may mean I cannot respond or provide that service. Optional fields may be left blank unless indicated otherwise.
I do not use your data for marketing or analytics. If that changes, I will ask for your consent first where the law requires it, and update this policy.
05
Cookies and Analytics
| Technology | Status at the 28 October 2026 audit |
|---|---|
| Cookies and browser storage | None observed in the tested production build |
| GA4, Google Tag Manager, other analytics or advertising scripts | None observed in the tested production build |
| Images and fonts | Served locally |
| Appointment calendar (Cal.com) | Contacts Cal.com to retrieve availability when certain pages load |
At the time of the 28 October 2026 code and preview audit, no cookies, browser-storage entries, GA4, Google Tag Manager or other analytics or advertising scripts were observed in the tested production build. Website images and fonts were served locally.
This finding does not conclusively establish what the live domain does: Cloudflare account-level settings or future changes may introduce cookies or other tracking technologies.
The website's appointment calendar contacts Cal.com to retrieve availability when certain pages load, even if you do not make a booking. This request involves network information such as IP address, browser details and time zone. A lack of cookies does not mean no personal data is processed.
For details of cookies and similar technologies, see the Cookie Policy.
06
Third-Party Services and Data Recipients
I use a small number of service providers. Each acts as a processor on my behalf under a data processing agreement, unless stated otherwise.
| Provider | What it does for me | Role and contract |
|---|---|---|
| Cloudflare, Inc. (USA) | Hosting, DNS, website delivery and security. Every page request passes through Cloudflare, including your IP address and browser details. | Processor under the Cloudflare Customer Data Processing Addendum. |
| Web3Forms (Web3Creative, India) | Sends the details you type into a website form to my email inbox. | Processor under the Web3Forms Data Processing Agreement (version 1.0, 13 July 2026). Its subprocessors include Amazon Web Services, Cloudflare, Hetzner (EU) and two spam-filtering services, CleanTalk and Akismet, which receive the sender's IP address and email address. |
| Cal.com, Inc. (USA) | Shows my availability and handles call bookings: name, email, time, time zone and website if given. | Processor under the Cal.com Data Processing Agreement, which forms part of its terms for every account. |
| Aruba S.p.A. (Italy) | Hosts my email at searchorchard.com, where enquiries and form messages arrive. | Processor under Article 23 of Aruba's hosting and domain terms (version 4.9, in force from 8 October 2026). |
| Google (Calendar and Meet) | Holds booked calls in my calendar and provides the video link. | I use a personal Google account, not Google Workspace. Google processes this data as an independent controller under its own Privacy Policy. |
| Loom (Atlassian) | Records the video walkthrough I send with a free audit, showing your website. | Loom is part of Atlassian. Processor under the Atlassian Data Processing Addendum, which applies to Loom under the Atlassian Customer Agreement, including free plans. |
I may also disclose information when required by applicable law or to establish, exercise or defend legal claims, where legally justified.
I do not sell your data or share it with anyone for their own marketing.
07
International Data Transfers
Some of these providers are based in, or process data in, countries outside the European Economic Area. Where that happens, the transfer is covered by one of the safeguards in Chapter V GDPR.
| Provider | Where data goes | Safeguard |
|---|---|---|
| Cloudflare | USA and Cloudflare's global network | EU-U.S. Data Privacy Framework (Cloudflare, Inc. is certified); EU standard contractual clauses in its DPA apply if certification lapses. |
| Cal.com | USA | EU-U.S. Data Privacy Framework (Cal.com, Inc. is certified), with the 2021 EU standard contractual clauses as a fallback. |
| Web3Forms | India (operator), USA and the EU (subprocessors) | EU standard contractual clauses (Decision 2021/914), incorporated into the Web3Forms DPA (section 10). Web3Forms is not certified under the Data Privacy Framework. |
| USA | EU-U.S. Data Privacy Framework (Google LLC is certified), and standard contractual clauses where required. | |
| Loom | USA | EU-U.S. Data Privacy Framework (Loom, Inc. is covered by Atlassian, Inc.'s certification), and standard contractual clauses. |
| Aruba | Italy | None needed: Aruba stores my email in data centres in Italy. |
You can check a company's certification on the official Data Privacy Framework list. To receive more information about the safeguards for a specific transfer, email me.
08
How Long We Keep Your Data
I keep personal data only for as long as I need it for the purpose it was collected for, or as long as the law requires.
| Data | How long I keep it |
|---|---|
| Enquiries, free-audit requests and booking details that do not lead to work together | 12 months from our last contact, then deleted |
| Free-audit notes and Loom walkthrough videos | 12 months from delivery, then deleted |
| Client emails, proposals, contracts and project records | 10 years from the end of our work together, the ordinary limitation period under Article 2946 of the Italian Civil Code |
| Invoices and accounting records | 10 years from the last entry (Article 2220 of the Civil Code), or longer if a tax assessment is still open |
| Form submissions at Web3Forms | Web3Forms keeps submissions for up to three years under its own retention design, and deletes them within 90 days if I close the account (DPA section 8). The copy in my inbox follows the periods above. |
You can ask me to delete your data earlier, unless I am required to keep it by law.
I set a yearly reminder to delete old enquiries and Loom videos that have passed these periods.
09
Your Rights Under the GDPR
Subject to the conditions and exceptions in applicable law, you may have the right to:
- Access
- access personal data held about you;
- Rectification
- rectify inaccurate or incomplete information;
- Erasure
- erase data in circumstances where the right to erasure applies;
- Restriction
- restrict certain processing activities;
- Objection
- object to processing based on legitimate interests, including where relevant to your particular situation;
- Data portability
- data portability, where its legal conditions are met; and
- Withdraw consent
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of earlier processing.
You also have the right not to be subject to certain decisions based solely on automated processing, including profiling, where Article 22 GDPR applies.
To exercise your rights, contact hello@searchorchard.com. I may need reasonable information to verify the identity of the person making a request. Requests will be handled within the periods required by the GDPR, subject to applicable extensions and exceptions.
10
Security and Automated Decision-Making
Security
I use reasonable technical and organisational measures to protect personal data, taking account of the nature and risks of the processing. The website is served over HTTPS through Cloudflare, and the information you submit through its forms and booking calendar is sent over encrypted connections to the services described above. No method of transmission or storage is completely secure, so I cannot guarantee absolute security.
Automated decision-making
I review every enquiry and every website myself, by hand. I do not use any tool that scores, ranks or makes decisions about you automatically.
11
Changes to This Privacy Policy
This notice may be updated if the website, services, technology providers or applicable legal requirements change. The date at the top of this page will be updated when a revised version is published. Where law requires additional notice or consent for a particular change, the appropriate steps will be taken.
12
Contact and Complaints
For privacy questions or to exercise your rights, contact:
| Data controller | Arianna Ren |
|---|---|
| Trading name | Search Orchard |
| Location | Turin, Italy |
| hello@searchorchard.com |
Supervisory authority
You also have the right to lodge a complaint with a supervisory authority. In Italy, the competent authority is the Garante per la protezione dei dati personali: garanteprivacy.it. Depending on your circumstances, you may also be entitled to contact another competent EU/EEA supervisory authority.