1. Who is responsible (controller)
RecoSearch [legal entity name], [registered address],
is the data controller for personal data processed through this website and the client
workspace at app.recosearch.com. Data protection contact:
dpo@recosearch.com. Our EU/EEA
representative under Art. 27 GDPR: [name and address].
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis | Retention |
| Name, work email, company, domain you submit | Answering your request, preparing a quote and teardown | Art. 6(1)(b) — steps prior to a contract | 24 months after last contact |
| Account data (email, hashed password, workspace settings) | Providing the client workspace, authentication, support | Art. 6(1)(b) — performance of a contract | Duration of the account + 6 months |
| Billing and invoice records | Payment processing, accounting, tax | Art. 6(1)(c) — legal obligation | Statutory period (typically 6–10 years) |
| Server logs, IP address, security events | Availability, fraud and abuse prevention | Art. 6(1)(f) — legitimate interest in a secure service | 90 days |
| Analytics and marketing cookies | Measuring site usage, campaign attribution | Art. 6(1)(a) — your consent (ePrivacy) | Up to 13 months, or until you withdraw |
We do not sell personal data, do not use it for automated decision-making with
legal effect, and do not knowingly process data of anyone under 18. This is a B2B service.
3. Cookies
No non-essential cookie or tracker is written before you give consent. The banner defaults to
rejection — closing it without choosing leaves only strictly necessary cookies active.
Rejecting is exactly as easy as accepting, and your choice is stored locally so we can honour it.
- Strictly necessary — session, security, load balancing, and your consent choice itself. No consent required (ePrivacy Art. 5(3) exemption).
- Analytics — aggregated usage statistics. Consent required, IP truncated where supported.
- Marketing — campaign attribution and remarketing. Consent required, off by default.
Withdraw or change consent any time via Cookie settings in the footer. Withdrawal
does not affect the lawfulness of processing carried out before it.
4. Your rights
If you are in the EEA or the UK you may exercise the following rights free of charge; we
respond within one month (extendable by two further months for complex requests):
- Access (Art. 15) — a copy of your data
- Rectification (Art. 16) — fix inaccurate data
- Erasure (Art. 17) — "right to be forgotten"
- Restriction (Art. 18) — pause processing
- Portability (Art. 20) — machine-readable export
- Objection (Art. 21) — to legitimate-interest processing and to direct marketing at any time
- Withdraw consent (Art. 7(3)) — at any time, without detriment
Send requests to dpo@recosearch.com.
You also have the right to lodge a complaint with your local supervisory authority
(in the UK, the ICO).
5. Processors, transfers and security
Where we process personal data on your behalf as part of a campaign, we act as
processor and sign a Data Processing Agreement (Art. 28) covering scope, duration,
confidentiality, sub-processor approval, assistance with data-subject requests, breach
notification within 72 hours, and deletion or return on termination. Our current
sub-processor list is available on request and updated with prior notice.
Primary hosting and storage is in the EU. Any transfer outside the EEA/UK relies on
Standard Contractual Clauses (or the UK Addendum / IDTA) plus a transfer impact assessment.
We apply encryption in transit and at rest, least-privilege access, audit logging and
regular access reviews (Art. 32).
Placeholders marked in gold must be completed by your legal counsel before
launch: entity name, registered address, Art. 27 representative, sub-processor list, and
the retention periods your accounting jurisdiction actually requires.