Privacy Notice
What personal data we process through recosearch.com and the client workspace, why, on what legal basis, for how long — and how to exercise your rights.
1. Who is responsible (controller)
RecoSearch [legal entity name], [registered address],
is the data controller for personal data processed through this website and the client
workspace at app.recosearch.com. Data protection contact:
dpo@recosearch.com. Our EU/EEA
representative under Art. 27 GDPR: [name and address].
2. What we process, why, and on what legal basis
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, work email, company, domain you submit | Answering your request, preparing a quote and teardown | Art. 6(1)(b) — steps prior to a contract | 24 months after last contact |
| Account data (email, hashed password, workspace settings) | Providing the client workspace, authentication, support | Art. 6(1)(b) — performance of a contract | Duration of the account + 6 months |
| Billing and invoice records | Payment processing, accounting, tax | Art. 6(1)(c) — legal obligation | Statutory period (typically 6–10 years) |
| Server logs, IP address, security events | Availability, fraud and abuse prevention | Art. 6(1)(f) — legitimate interest in a secure service | 90 days |
| Analytics and marketing cookies | Measuring site usage, campaign attribution | Art. 6(1)(a) — your consent (ePrivacy) | Up to 13 months, or until you withdraw |
We do not sell personal data, do not use it for automated decision-making with legal effect, and do not knowingly process data of anyone under 18. This is a B2B service.
Cookies are described in the Cookie Policy. Processing we carry out on your behalf during a campaign is covered in DPA & Subprocessors.
3. Your rights
If you are in the EEA or the UK you may exercise the following rights free of charge; we respond within one month (extendable by two further months for complex requests):
- Access (Art. 15) — a copy of your data
- Rectification (Art. 16) — fix inaccurate data
- Erasure (Art. 17) — "right to be forgotten"
- Restriction (Art. 18) — pause processing
- Portability (Art. 20) — machine-readable export
- Objection (Art. 21) — to legitimate-interest processing and to direct marketing at any time
- Withdraw consent (Art. 7(3)) — at any time, without detriment
Send requests to dpo@recosearch.com. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the ICO).