Privacy Policy

1. Introduction

Welcome to KeywordShift (“we,” “us,” “our”), a B2B SaaS demand generation partner specializing in SEO-led content, high-intent Google Ads, CRO, lifecycle email, web, and analytics aligned to pipeline, CAC payback, and NRR outcomes.

This Privacy Policy explains what data is collected, how it is used, with whom it may be shared, how long it is retained, and what rights apply depending on jurisdiction, including GDPR/UK GDPR and certain U.S. state privacy laws.

2. Controller and scope

KeywordShift is the controller for personal data collected via this website and during sales, onboarding, and service delivery, with some processing performed as a processor on behalf of clients per contract.

This policy applies to website visitors, prospects, and clients engaging services related to demand generation, including SEO, paid media, CRO, content, email, analytics, and web.

3. Information we collect

We may collect the following categories of information:

• Personal data: Name, business email, phone, role, and company details submitted via forms, email, or meetings.
• Business account data: Credentials and access tokens provided to connect analytics, ad platforms, CMS, or other tools strictly for contracted work.
• Usage data: IP address, device identifiers, browser/OS, pages viewed, referring URLs, and timestamps collected via server logs and analytics.
• Client data (processor role): Data in client systems we access or process only under documented instructions to provide services; ownership remains with the client.
• Cookies and similar technologies: Session, preference, analytics, and advertising cookies as configured in consent tools.
• Communications: Emails, messages, call notes, and meeting recordings where applicable and permitted by law.

4. How we use information

• Provide and improve services including SEO, paid media, CRO, content, email, analytics, and web delivery.
• Plan strategy, reporting, and performance dashboards tied to pipeline, CAC payback, and NRR.
• Communicate regarding proposals, scopes, onboarding, demos, KPIs, invoices, and support.
• Configure and manage integrations and platforms necessary to deliver services.
• Secure systems, prevent fraud/abuse, and comply with legal obligations.
• Operate marketing and sales activities with consent or legitimate interests, as applicable.

5. Legal bases (GDPR/UK GDPR)

• Contract: Processing necessary to perform a contract or take steps prior to entering into a contract.
• Legitimate interests: Operating and improving services, securing systems, and informing relevant stakeholders, balanced against rights and interests.
• Consent: Where required for cookies, marketing communications, or specific data uses, with the ability to withdraw at any time.
• Legal obligation: Compliance with applicable laws, regulations, and lawful requests.

6. Sharing and disclosure

• Processors and sub‑processors: Trusted vendors for hosting, analytics, ad platforms, email, project management, and support under data processing terms.
• Business transfers: Disclosures in connection with a merger, acquisition, financing, or sale of assets, subject to continued protection.
• Legal requirements: When necessary to comply with law, enforce agreements, or protect rights, security, and safety.
• With consent: When explicitly authorized for specified purposes.

7. International transfers

Where data is transferred outside the EEA/UK, appropriate safeguards are applied such as EU Standard Contractual Clauses and UK Addendum or other lawful mechanisms, with supplementary measures as needed.

8. Data retention

Data is retained only as long as necessary for the purposes described, including service delivery, legal, accounting, and reporting requirements, then securely deleted or anonymized per policy.

• Website analytics data: commonly 12–26 months depending on platform settings.
• Server logs and security telemetry: typically 30–180 days unless required longer for investigations.
• Project workpapers and deliverables: typically retained for the engagement and a reasonable period thereafter to support continuity and obligations.
• Marketing preferences: retained until opt‑out or withdrawal of consent is recorded.

9. Security

Administrative, technical, and physical safeguards are used to protect information, including access controls, least‑privilege principles, encryption in transit, and vendor diligence proportional to risk.

No method of transmission or storage is fully secure, and residual risk remains; security practices are reviewed and improved over time.

10. Cookies and tracking

11. Rights and choices

Depending on location, rights may include access, correction, deletion, portability, restriction/objection to processing, and withdrawal of consent without affecting prior lawful processing.

• EU/UK: Rights under GDPR/UK GDPR including the right to lodge a complaint with a supervisory authority.
• U.S. states (e.g., CA/VA/CO/CT/UT): Rights to know/access, delete, correct, and opt‑out of sale/share and targeted advertising where applicable, with recognition of Global Privacy Control signals where supported.
• Marketing communications: Unsubscribe links are included in applicable emails; separate consent controls may apply to cookies/ads.

Requests may require reasonable verification; where requests are denied, an appeal process or regulator contact information will be provided if required by law.

12. Sub‑processors and DPAs

A list of core sub‑processors used for hosting, analytics, advertising, communications, and support is available upon request, and a Data Processing Addendum is available for clients when KeywordShift acts as a processor.

13. Children’s privacy

Services are intended for business users and are not directed to children; data from individuals under the age required by local law should not be submitted, and known submissions will be deleted upon notice.

14. Changes to this policy

This policy may be updated to reflect operational, legal, or regulatory changes; the “Last Updated” date will be revised, and material updates will be communicated where legally required.

15. Contact

For questions, requests, or complaints regarding this policy or data practices, contact:

KeywordShift
Email: [email protected]