Version 1.5, 28 October 2026. Effective from 28 October 2026. It replaces version 1.4 of 21 October 2026. Polish version: fullsearchaudit.com/polityka-prywatnosci/.
Contents
This Privacy Policy explains how personal data is processed in connection with the website fullsearchaudit.com (the “Website”) and the Full Search Audit services, as required by Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (the “GDPR”) and, for people in the United Kingdom, the UK GDPR.
1.1. The controller is Fundacja Rozwoju Przedsiębiorczości „Twój StartUp”, registered office: ul. Żurawia 6/12 lok. 766, 00-503 Warsaw, Poland, KRS 0000442857, NIP 5213641211, REGON 146433467 (the “Controller”, “we”). The Full Search Audit services are performed within the Controller’s organised business unit run by its Beneficiary, Vadym Borovskyi, who processes personal data as the Controller’s processor under a data processing agreement (Article 28 GDPR) and is your contact person.
1.2. Contact about personal data: hello@fullsearchaudit.com or rodo@twojstartup.pl (the Controller’s data protection contact); by post: the registered office above.
2.1. Visiting the Website: standard server log data recorded by our hosting provider (IP address, date and time, requested page, browser and operating system, referring page). The Website is hosted on our provider’s servers in Amsterdam, Netherlands (EU). Without your consent the Website uses only strictly necessary cookies and browser storage, described in the Cookie Policy. Only if you consent in the cookie banner, the Website also uses Google Analytics 4 (statistics), Google Ads conversion tracking and remarketing, and the Meta Pixel for conversion measurement and retargeting. With your consent these technologies set cookies and send to Google or Meta pseudonymous identifiers, your IP address, browser and device data, the pages you visit and events such as sending a form, never the content of the form. Until you consent, and after “Reject all”, the Google Analytics 4 and Google Ads tags are not run and send no measurement data to Google, and the Meta Pixel is not loaded. You can withdraw your consent at any time. The cookies, their lifetimes, the roles of Google and Meta and the transfers are described in the Cookie Policy.
2.2. Contact form: your name, work email, the reason for contacting us, your message and, if you give them, your company, website and order reference, plus the date and time of sending and your IP address. Sample report form: your work email, the date and time of sending, your IP address, the page the form was sent from, whether you ticked the optional follow-up box and the version of the texts shown. If you order through a form, also whether you ticked the acceptance of our Terms.
2.3. Emails, including order emails: what you write to us and the technical data of your emails (date, time, headers, attachments). An order email usually contains your name and email, your website, your business name, country and EU VAT number, the report language, what you sell and to whom, and the answer to a question specific to the audit (competitors, or your monthly Google Ads spend band). Before invoicing we ask for your invoicing details and the email address for invoices. Please do not send passwords, access codes or personal data of your customers by email; we never ask for them.
2.4. Performing the contract: our written confirmations, the invoice, your approved buyer questions, the Report, complaints and records of cancellations, withdrawals and refunds.
2.5. Payments: invoicing data (business name, address, VAT number, amounts, VAT treatment), the payment details shown on the Seller’s bank statement (payer name, account number, amount, reference) or, if you pay online, the confirmation we receive from the payment service provider (payer name, email, amount, status; never full card details). When you give an EU VAT number, we check it in the European Commission’s VIES database and keep the result with the invoice.
2.6. Audit data from public sources: public pages of your website and of the competitors you name, public profiles, search result pages and Google AI Overviews obtained from SEO data services, and the answers of AI assistants to the approved buyer questions. This may incidentally include personal data that is public (for example names of founders, authors or employees) or that an AI assistant states; we collect it only to the extent relevant to the audit and do not look for personal data as such.
2.7. Google Ads and Google Analytics 4 exports that you send us for the Full Search Audit, the Ad Spend and Tracking Integrity Audit or the Monthly Ad Spend Check. We ask for aggregated reports without personal data and do not access your accounts. If an export contains personal data of your visitors or customers anyway, we do not use it, delete it and tell you. Such exports may contain the names or email addresses of the people who prepared or appear in them, which we process as business contact data.
2.8. Giving data is voluntary. Without the data marked as required in a form we cannot answer you or send the sample; without the invoicing details we ask for we cannot issue an invoice or start the audit.
2.9. Data about other people. If you give us personal data of other people (for example colleagues as contact persons, people named in your brief or the authors of exports), you confirm that you may share it with us for the purposes of the service and that you have informed them as the law requires. Send only what the service needs; exports must be aggregated (Terms of Service, § 3 paragraph 9). Do not send us special categories of data (Article 9 GDPR, for example data about health, beliefs or political opinions) or data about criminal convictions; we do not need them and delete them if received.
| Purpose | Data | Legal basis (GDPR) | How long |
|---|---|---|---|
| Answering messages and order requests, consulting on the Service, preparing confirmations and invoices, checking that the website is suitable | 2.2, 2.3, 2.5 | Article 6(1)(b) (steps before a contract at your request, where you act for yourself) and Article 6(1)(f) (legitimate interest in answering and handling business contacts) | 12 months after the last contact, unless a contract follows |
| Sending the sample report you asked for | 2.2 | Article 6(1)(b) and Article 6(1)(f), as above | 12 months after your request |
| Follow-up emails about the sample and offers for an audit, only if you tick the optional box | work email | Article 6(1)(a) (consent) with Article 398 of the Polish Electronic Communications Law | within the limits stated next to the box (at most 3 emails over 60 days) and until you withdraw consent, at the latest 12 months after your request |
| Website statistics, measuring our advertising and showing our ads on Google and Meta services, only if you consent in the cookie banner | 2.1 (cookie identifiers, IP address, browser and device data, pages and events) | Article 6(1)(a) (consent) with Article 399 of the Polish Electronic Communications Law and Article 5(3) of Directive 2002/58/EC | cookie lifetimes in the Cookie Policy; event-level data in our Google Analytics account at most 14 months; your banner choice 12 months |
| Record of consents, withdrawals and opt-outs | 2.2 and the date of withdrawal | Article 6(1)(f) (demonstrating compliance, Articles 5(2) and 7(1)) and Article 21(3) | 3 years after the last email or your withdrawal; a list of opted-out addresses is kept while we send such emails |
| Concluding and performing contracts, including the brief, communication, the Report and complaints | 2.3, 2.4, 2.6, 2.7 | Article 6(1)(b) and Article 6(1)(f) (contact persons of a company) | duration of the contract, then as for claims below; audit evidence (2.6) 12 months after delivery; exports (2.7) 30 days after delivery, unless a complaint is pending |
| Invoicing, accounting, tax and anti-money-laundering obligations, VIES checks | 2.5 | Article 6(1)(c) (Polish accounting, tax and AML law) | as the law requires: as a rule 5 years from the end of the year in which the tax payment deadline passed |
| Handling your requests about your data (section 7) | your request, the identity information we ask for and our answer | Article 6(1)(c) (Articles 12 to 22 GDPR) | as for legal claims below |
| Establishing, exercising or defending legal claims | 2.2 to 2.7 | Article 6(1)(f) | until claims are time-barred: as a rule 3 years for business claims under the Polish Civil Code, to the end of the calendar year |
| Security and operation of the Website, server logs | 2.1 | Article 6(1)(f) | the period of our hosting provider’s standard log configuration |
3.1. Ordering does not depend on any marketing consent, and we do not send unsolicited marketing emails. Emails that are part of handling your order (confirmations, invoice, questions for approval, delivery of the Report, a sentence in the delivery email telling you until when the second audit discount applies) are not marketing. Where we rely on legitimate interests, the processing is limited to what a business contact would reasonably expect and you can object at any time (section 7). Refusing or withdrawing cookie consent has no effect on your use of the Website, the forms or our services. Emails in our mailbox are deleted or kept according to the periods above.
4.1. We share personal data only with the categories of recipients needed to run the Website and perform the services. Recipients acting on our behalf are bound by a data processing agreement or equivalent terms:
| Category of recipient | What they receive | Location and transfer safeguard |
|---|---|---|
| Our hosting and email provider (Website hosting, form database and the hello@fullsearchaudit.com mailbox, which we read through the provider’s webmail) | everything stored on the Website and all emails sent to or from hello@fullsearchaudit.com, including order emails, exports and Reports | Servers in Amsterdam, Netherlands (EU), where the Website, the form database, the mailbox and their backups are kept. The provider is a company established in the United States and may access the data remotely from the United States or other countries outside the EEA for support, maintenance and security; this access is covered by the standard contractual clauses in the provider’s data processing addendum, which we have accepted, and, where the provider is certified, by the EU-US Data Privacy Framework |
| Providers of the AI assistants we measure, through their programming interfaces | the approved buyer questions and business names | United States or EU; standard contractual clauses in the providers’ data processing terms or the EU-US Data Privacy Framework |
| Providers of SEO data services | search queries built from the approved buyer questions and business names | EU or United States; standard contractual clauses or adequacy decisions |
| A payment service provider, if you pay online (independent controller for the payment itself) | the data you enter on its payment page and the payment status | EU; its own privacy policy, linked on the payment page |
| Google (Google Ireland Limited, Dublin, Ireland): for Google Analytics 4 as our processor under the Google Ads Data Processing Terms; for Google Ads (conversion measurement and remarketing) as an independent controller under the Google Ads Controller-Controller Data Protection Terms | only with your consent to statistics or marketing cookies: cookie identifiers, IP address, browser and device data, pages visited, events, ad click IDs; before or without consent: no measurement data (the tags are not run); never form content | EU; data may be transferred to Google LLC, United States, certified under the EU-US Data Privacy Framework at the date of this Policy, and under standard contractual clauses in Google’s terms |
| Meta (Meta Platforms Ireland Limited, Dublin, Ireland), only if you consent to marketing cookies: joint controller with us for the collection and transmission of Meta Pixel data under Meta’s Controller Addendum (Article 26 GDPR); independent controller for the later processing | cookie identifiers, IP address, browser and device data, pages visited, events, ad click IDs; never form content | EU; data may be transferred to Meta Platforms, Inc., United States, certified under the EU-US Data Privacy Framework at the date of this Policy, and under standard contractual clauses in Meta’s terms |
| The Controller’s accounting, invoicing (CRM) and legal service providers, and banks | invoicing and payment data, correspondence needed for claims | Poland / EU |
| The Controller’s Beneficiary (Vadym Borovskyi), the Controller’s processor (section 1.1) | all data needed to perform the services | Poland |
| Public authorities | only where the law requires | Poland / EU |
4.2. We transfer personal data outside the EEA only to countries or recipients the European Commission has found adequate (including US companies certified under the EU-US Data Privacy Framework) or under the European Commission’s standard contractual clauses, with additional measures where needed. You may ask us at hello@fullsearchaudit.com for details of the safeguard used for a specific provider. For people in the United Kingdom, transfers rely on the UK adequacy regulations, the UK Extension to the Data Privacy Framework or the UK International Data Transfer Addendum.
4.3. The “Order” buttons open an email in your own email program; your own email provider’s terms apply to that email, as to any email. The form plugin runs on our own server. The Google Analytics 4 and Google Ads tags and the Meta Pixel are run only after you consent to the relevant category in the cookie banner (section 2.1).
5.1. Answers of the AI assistants we measure that mention people are reproduced in the Report as evidence of what the assistant said and are not verified or used for any other purpose. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). If you consent to marketing cookies, we, Google and Meta use the data collected on the Website to show our ads to you on Google and Meta services (remarketing and retargeting, which involves profiling for advertising); this has no legal or similarly significant effect on you, and you can withdraw your consent at any time through “Cookie settings”.
6.1. We apply technical and organisational measures appropriate to the risk, including HTTPS on the Website, access limited to the persons who need it, and confidentiality and data processing obligations of our providers. We handle personal data breaches as Articles 33 and 34 GDPR require: we notify the supervisory authority where a breach is likely to result in a risk to your rights and freedoms, and you where that risk is high.
7.1. You may ask for access to your data and a copy (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability of data you gave us that we process by automated means on the basis of a contract or consent (Article 20). You may withdraw any consent at any time, as easily as you gave it (unsubscribe link, replying “unsubscribe”, the “Cookie settings” link for cookies, or writing to hello@fullsearchaudit.com), without affecting earlier processing. Where we rely on legitimate interests you may object on grounds relating to your particular situation (Article 21(1)); you may object to direct marketing at any time and we always comply (Article 21(2) and (3)). Where a copy of your data would adversely affect the rights of others (for example other clients or people named in a Report), we provide what we can without those parts (Article 15(4)).
7.2. We would welcome the chance to address your concern first, but you may at any time lodge a complaint with a supervisory authority, in particular the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or the authority of the EU member state where you live or work; people in the United Kingdom may complain to the Information Commissioner’s Office (ico.org.uk).
7.3. To exercise any right, write to hello@fullsearchaudit.com or rodo@twojstartup.pl, preferably from the email address we hold for you. We may ask you for the information needed to confirm your identity and to find your data. We answer within one month of receiving your request; for complex or numerous requests we may extend this by up to two further months and tell you within the first month. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may refuse it or charge a reasonable fee (Article 12(5)). We keep a record of your request and our answer for the period in section 3.
8.1. If a client gave us your contact details (for example as the person who receives invoices or prepared the exports), or if you are named on a client’s or competitor’s website, in public sources or in AI answers we review during an audit, we received your data from the client, from those sources or from the AI assistant. The categories are: name, job title or role, business contact details and information about you published in the source concerned or stated by the AI assistant. We process them for the purposes, on the bases and for the periods in section 3; the recipients are those in section 4; all rights in section 7 are available to you.
9.1. This Policy is also our notice under the UK GDPR. We are not established in the United Kingdom and have not appointed a UK representative under Article 27 UK GDPR; our processing of data about people in the UK is limited to business contacts and orders. We do not sell personal information. Advertising cookies set only with your consent may count as “sharing” for cross-context behavioural advertising under some US state laws; you can refuse or withdraw them at any time through “Cookie settings”. If a US state privacy law becomes applicable to us, we will update this Policy. Every commercial email we send identifies us, gives our postal address and contains a working way to unsubscribe.
10.1. We update this Policy when our processing, our providers or the law change; the current version and its effective date are shown at the top of this page, and clients with a running contract are notified of material changes by email. Contact: hello@fullsearchaudit.com; the Controller’s data protection contact: rodo@twojstartup.pl, or by post to the registered office in section 1.1.