Last updated: 13 October 2026
This policy explains how we handle personal data when you visit oroseo.com or contact OroSEO.
Who we are
OroSEO is a trading name of Šikk OÜ (registry code 12781008), Meretähe 3, Muraste, 76905 Harjumaa, Estonia. Šikk OÜ is the controller of your personal data.
Questions about this policy or your data: kristjan@oroseo.com
When you contact us
Our contact and enquiry forms ask for your email address and, depending on the form, your name, phone number, website address and a message. The SEO audit form also asks which audit option interests you. With service enquiries we also record which page the form was sent from.
We use these details to reply, understand what you need and prepare a proposal or quote.
Legal basis: steps you ask us to take before a possible contract (GDPR Art. 6(1)(b)). If you write on behalf of a company, our legitimate interest in answering business enquiries (Art. 6(1)(f)).
Form messages are not stored on the website. They are sent to our email inbox, which Hostinger hosts.
Giving us your details is voluntary, but without an email address we can’t reply.
Spam protection
Our enquiry forms use Cloudflare Turnstile to check that a person, not a bot, is sending the form. Turnstile processes technical information such as your IP address and browser details for this purpose. It isn’t used for advertising.
Legal basis: our legitimate interest in protecting the forms from spam and abuse (Art. 6(1)(f)).
Website analytics (only with your consent)
If you accept statistics cookies, we use Google Analytics 4 to see how the site is used, for example which pages are visited and how visitors find us. Google Analytics does not log or store IP addresses of visitors from the EU. If you don’t accept, Google Analytics isn’t loaded.
Legal basis: your consent (Art. 6(1)(a)). You can change or withdraw it at any time via Manage consent at the bottom of the page.
Google Analytics keeps event-level data for 2 months and user-level data for 14 months. Aggregated statistics that don’t identify individual visitors are not affected by these periods.
Visiting the website
To deliver the website and keep it secure, our hosting provider’s servers process technical data such as your IP address, the page requested, and the browser and time of the visit. We don’t keep these server logs ourselves. Hostinger processes them as part of its hosting service.
Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f)).
Cookies
We use only the cookies needed for the site to work, and analytics cookies if you allow them.
| Cookie | Purpose | Duration | Consent needed |
|---|---|---|---|
cmplz_* | Remembers your cookie choices | 1 year | No (necessary) |
wp_consent_* | Passes your cookie choices to the website’s plugins | 30 days | No (necessary) |
_ga, _ga_<ID> | Google Analytics: distinguishes visitors and sessions | Up to 2 years | Yes |
Site administrators also use login cookies when signed in to WordPress.
Who receives your data
We don’t sell your data or use it for advertising. We share it only with service providers who work for us, and with authorities where the law requires it:
- Hosting and email: Hostinger (Hostinger International Ltd, Cyprus); servers in the EU.
- Spam protection: Cloudflare.
- Analytics (only with consent): Google.
- If you become a client: our invoicing software provider and cloud document storage (Google Drive).
Transfers outside the EU
Google and Cloudflare may process data in the United States. Both are certified under the EU–US Data Privacy Framework, and they use the European Commission’s standard contractual clauses where required. Contact us if you want more information about these safeguards.
How long we keep data
- Enquiries: kept in our email inbox for as long as they’re relevant to our communication with you.
- Clients: correspondence and project information for as long as needed to deliver the work and handle follow-up questions or legal claims.
- Invoices and accounting records: 7 years from the end of the financial year, as Estonian accounting law requires.
- Analytics: as described above.
Your rights
You can ask us to:
- give you access to your personal data;
- correct it;
- delete it;
- restrict its processing;
- provide it in a portable format.
You can object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time; this doesn’t affect processing before the withdrawal. Email kristjan@oroseo.com. We reply within one month.
You can also complain to the Estonian Data Protection Inspectorate (www.aki.ee), or to the supervisory authority where you live or work.
We don’t make decisions about you based solely on automated processing.
Changes
We’ll update this policy when our tools or services change. The date at the top shows the current version.