GDPR Compliance

1. What is GDPR?

The General Data Protection Regulation (GDPR) is a European Union regulation that governs how organizations collect, process, store, and protect personal data of individuals in the EEA and UK. GBPTrack applies GDPR principles to all users, with enhanced protections for individuals located in these regions.

2. Our Approach to Data Protection

GBPTrack follows these core principles:

• Lawfulness, fairness, and transparency — we process data with a clear legal basis and explain our practices in our Privacy Policy
• Purpose limitation — we collect data only for specified, legitimate purposes related to providing our local SEO platform
• Data minimization — we collect only the data necessary to operate GBPTrack
• Accuracy — you can update account and business information through your dashboard
• Storage limitation — we retain data only as long as needed to provide the service or meet legal obligations
• Integrity and confidentiality — we implement security measures to protect your data

3. Legal Basis for Processing

We process personal data under the following legal bases:

• Contract — to provide the GBPTrack platform, run grid scans, and manage your subscription
• Consent — for optional marketing communications and certain cookie types
• Legitimate interests — for platform security, fraud prevention, and product improvement
• Legal obligation — to comply with tax, accounting, and regulatory requirements

4. Your Rights Under GDPR

If you are in the EEA or UK, you have the following rights:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data ("right to be forgotten")
• Right to restrict processing — limit how we use your data in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — where processing is consent-based, withdraw consent at any time
• Right to lodge a complaint — file a complaint with your local data protection authority

To exercise any of these rights, email hello@gbptrack.com. We will respond within 30 days as required by GDPR.

5. Data We Process

GBPTrack processes the following categories of personal data:

• Account information (name, email, organization details)
• Billing and payment data (processed by our payment provider)
• Business and location data you add to the platform
• Google Business Profile data connected via OAuth
• Usage logs, scan history, and support communications

6. Data Protection Officer

For GDPR-related inquiries, contact our privacy team at hello@gbptrack.com. We will assign a dedicated contact for complex data protection requests.

7. International Data Transfers

Your data may be processed in countries outside the EEA. Where this occurs, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or rely on adequacy decisions where applicable.

8. Data Processors

We use trusted third-party processors for hosting, payment processing, email delivery, analytics, and SERP data. Each processor is bound by data processing agreements that require GDPR-compliant handling of your information.

9. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay where required by law.

10. Contact Us

For GDPR questions or to exercise your rights, contact hello@gbptrack.com or visit our Contact page. You can also review our Privacy Policy and Refund Policy for additional information.