Data protection

Privacy policy

Last updated: 1 October 2026

At Landing Agency we treat personal data with the same seriousness with which we treat your brand. This page explains, in plain language, who is responsible for your data, what we use it for, on what legal basis, for how long and how you can exercise your rights, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD). At the end you will also find the website's legal notice, and in section 10, what the website stores in your browser (cookies). If your company appears in an automatic report requested by someone else, what affects you is in section 5. This translation is provided for convenience; the Spanish version prevails.

Basic information

1. Data controller

2. What data we process and where it comes from

We process the data you provide in the forms on this website (the check of your website, the form on your report page and the checks of your position on Google and in artificial intelligence), by email, by phone or when talking to our voice assistant, and the technical data generated by your visit:

• Identification and contact details: first name, surname, role, email address and phone number.
• Details of your agency: trading name, website address, activity, approximate size of the portfolio, approximate turnover, and the areas and markets you work in.
• If you talk to our voice assistant, your voice and what you say during the conversation.
• If you accept analytics or advertising cookies, the identifiers of those cookies and how you use the website: which pages you view, which ad you came from and which steps you take, such as requesting a report or booking a call (section 10).
• Technical browsing data (IP address, device type and browser), which we use to make the website work and keep it secure. In our systems, your IP address is not kept for more than 24 hours, and the automatic report does not even store it: only an encrypted fingerprint of it (section 4).

For the automatic report we do not ask you for any personal data: the website address or the name of the agency is enough. The data in the long form (the check form, which also appears on your report page) is what we need to prepare your full report, reviewed by a person, and send it to you; if you do not give it to us, we will not be able to do so and you will keep the automatic report.

When we analyse a website or a Google Business Profile, we work with public information about the business; we do not access its clients' data. For the automatic report we also use information you do not give us: what the analysed website itself publishes and what Google (its search results, its map and its business profiles) and artificial intelligence search engines (ChatGPT and Google's AI answers) show about that company and its competitors (sections 4 and 5).

3. What we use your data for and on what legal basis

• To analyse your website, prepare your full report and send it to you, if you ask us to through the form, and to contact you by phone or email to present it and propose our services to you, if they fit. The email with the link to your report is sent by our client management tool (section 7). Legal basis: your consent (art. 6.1.a GDPR), which you give us by ticking the box on the form, and the application of pre-contractual measures at your request (art. 6.1.b GDPR).
• To prepare the automatic report on the website you give us, with public data, and store it to show it instantly to anyone who requests it again (section 4). For this we do not need any of your data. Legal basis: legitimate interest (art. 6.1.f GDPR).
• To deal with your enquiries, including those you make by phone or through the voice assistant, and manage the commercial and contractual relationship if you become a client. Legal basis: performance of the contract or pre-contractual measures (art. 6.1.b GDPR).
• To send you commercial communications about similar services if you are already a client, with the option to object in every message. Legal basis: legitimate interest (art. 6.1.f GDPR and art. 21.2 of the Spanish LSSI).
• To protect the website, the check and the automatic report against abuse, for example by limiting how many new reports are requested in a day from the same connection and checking, with Cloudflare Turnstile, that whoever requests them is not a robot. Legal basis: legitimate interest (art. 6.1.f GDPR).
• Measuring visits and our advertising campaigns, only if you accept analytics or advertising cookies: how many people visit us, which pages work and which ads end in a request or a booked call (section 10). Legal basis: your consent (art. 6.1.a GDPR and art. 22.2 LSSI), which you can withdraw at any time.
• To comply with legal obligations (tax, accounting, handling of rights). Legal basis: legal obligation (art. 6.1.c GDPR).

You can withdraw your consent at any time by writing to info@landingagency.com, without affecting the lawfulness of the previous processing.

We do not make decisions about you based solely on automated processing, nor do we create profiles that produce legal effects or similarly affect you. The instant result of the check and the automatic report, with its score, describe a website, not you.

4. Automatic report on your website

When you type a website address or the name of an agency into “Generate report”, in the check or on a service page, we instantly prepare an automatic report with public data on that website and its presence on Google and in artificial intelligence search engines. Anyone can request it, whether or not they belong to the analysed company.

• What we analyse. What the website itself publishes (its home page, its instructions for search engines and artificial intelligence robots, its structured data, its languages and whether its phone number or WhatsApp can be tapped), its speed on mobile according to Google, its position on the map and in Google results for searches in its area, how often those searches are made, its public Google Business Profile and whether ChatGPT and Google's AI answers name it when asked about agencies in its area. We read the website from our servers, so that website does not receive your IP address.
• Legal basis. Legitimate interest (art. 6.1.f GDPR): that of the person requesting the report, in knowing how a website appears on Google and in artificial intelligence, and ours, in offering them that analysis and making ourselves known. We weigh it against that of the analysed company: we only use information that the company itself or the search engines make public, the report is about its website and not about people, each report has a private address that we neither publish nor link to, it states the source and date of each figure, and the company can object at any time (section 5).
• What we store. The analysed domain, what was typed to request it (the website or the name), the results, the date of each measurement and where the request came from (the page or button it was requested from and, if you arrived from a campaign link, its tags). We do not store your IP address: to limit how many new reports are requested from the same connection, we store only an encrypted fingerprint (hash) calculated with a key that changes every day, and we delete it, together with the key, after 24 hours. If you then fill in the form, in the request we only note that you have done so: your contact details are not stored with the report, but in our client management tool (section 7).
• For how long. The results for a website are valid for 60 days from its first measurement: if someone requests the same website within that period, we show them the report already made. Reports and requests are deleted after 12 months. The private address of each report expires after 90 days.
• Who is involved. Cloudflare, with its Workers and D1 services, prepares the report and stores its database, and Cloudflare Turnstile checks that you are not a robot; Turnstile does not use advertising cookies. DataForSEO gives us the Google data and the answers from artificial intelligence search engines: it receives only what has to be searched (the domain, the company name, the area and the searches), never your data. Google, with PageSpeed Insights and the Chrome UX Report, receives the address of the analysed website to measure its speed. More detail in section 7.
• International transfers. Cloudflare, Inc. is headquartered in the United States and is certified under the EU-U.S. Data Privacy Framework; if that certification were to lapse, the standard contractual clauses approved by the European Commission would apply. DataForSEO (DataForSEO OÜ) is an Estonian company, within the European Union, and for its own providers outside the European Economic Area it uses standard contractual clauses or adequacy decisions.

Every report says so clearly: “Automatic report with public data from Google and your website. It has not been reviewed by a person.” The answers from artificial intelligence search engines change from one time to the next: the report records what they answered on the day of the measurement.

5. If your company appears in a report

The automatic report may talk about your company even if you did not request it: because someone typed your website or your name, because your agency ranks ahead of another in searches for its area and appears among its competitors, or because an artificial intelligence search engine names it when answering about agencies in an area. Of competitors we show only the name, the website, the position and the rating and number of reviews shown by Google Maps.

We use only public information about your website and your presence in search engines: what your website publishes, what Google shows in its results, on its map and in your business profile, and what artificial intelligence search engines answer, with the source and date of each figure. The report is about the company, not about people: it does not include personal data of owners, employees or clients. Only if the trading name is that of a person (for example, a self-employed professional) may that name and the public data of their profile be considered personal data, and then you have all the rights in section 8.

You can object at any time: write to us at info@landingagency.com with the subject “Protección de datos” and state your domain. We will block your domain for future reports and delete the reports on your website we have stored. We may ask you to prove that you are acting on behalf of the company.

6. How long we keep your data

If you ask us for an analysis or make an enquiry, we keep your data while we deal with it and, if the contact is commercial, until you withdraw your consent. If you become a client, for the duration of the contractual relationship. Afterwards, we keep it blocked, available only to judges, courts and competent authorities, for the periods set by law to deal with possible claims and tax and commercial obligations (generally, 6 years).

In our systems, your IP address is not kept for more than 24 hours. The automatic report does not even store it: only an encrypted fingerprint made with a key that changes every day, which it deletes, together with the key, after 24 hours. Automatic reports and their requests are deleted after 12 months, and the private address of each report expires after 90 days (section 4).

7. Who we share your data with

We do not sell or transfer your data to third parties, except where legally required. Only the providers we need to deliver the service access it, as processors and under contract:

• Make: receives the data from the check form, including the one on your report page, and passes it to our client management tool. We use its European servers.
• GoHighLevel: our client management tool (CRM). It stores the form data so that we can prepare your full report and contact you, and it is what sends you the email with the link to your report.
• Cloudflare: hosts the functions that run the check and the automatic report instantly (Workers) and the reports database (D1). To limit abuse it stores, for a maximum of 24 hours, your IP address or, in the automatic report, only an encrypted fingerprint of it.
• Cloudflare Turnstile: checks that whoever requests a report is a person and not a robot. To do so, your browser sends it technical signals, such as your IP address and your browser details. It does not use advertising cookies or use that data for advertising. Cloudflare processes it on our behalf and, to improve its robot detection, also on its own account, as explained in its Turnstile privacy notice.
• DataForSEO: gives us the public Google data (the map, the search results, the business profiles and how often each search is made) and what ChatGPT and Google's artificial intelligence answer about the website and area being analysed. It receives only what has to be searched, never your data.
• Retell AI: the voice assistant, only if you decide to talk to it.
• Google: the YouTube videos on the blog and, for the automatic report, PageSpeed Insights and the Chrome UX Report, which only receive the address of the website analysed. If you accept cookies, also Google Tag Manager, Google Analytics and Google Ads (section 10).
• Only if you accept analytics cookies: Microsoft Clarity, which shows us how the pages are used.
• Only if you accept advertising cookies: Meta (Facebook and Instagram), OpenAI (ChatGPT ads) and Leadsy.ai, which measure which ads work; Leadsy.ai also tells us which company the website is being visited from.
• Our web hosting and email providers.

Some of these providers have their headquarters or servers outside the European Economic Area (for example, Cloudflare, Google, GoHighLevel, Retell AI, Meta, OpenAI, Microsoft and Leadsy.ai, in the United States). When your data leaves the European Economic Area it does so with the safeguards required by the GDPR: companies certified under the EU-U.S. Data Privacy Framework (such as Cloudflare, Microsoft and HighLevel, the company behind GoHighLevel) or standard contractual clauses approved by the European Commission. DataForSEO is a company based in Estonia, within the European Union.

8. Your rights

You can exercise at any time your rights of access, rectification, erasure, objection, restriction of processing and portability, and not to be subject to decisions based solely on automated processing, as well as withdraw your consent, by writing to info@landingagency.com with the subject “Protección de datos” and stating the right you are exercising, or to our data protection officer (section 1). We may ask you to prove your identity. We will reply within one month. If you belong to a company that appears in an automatic report, you can object as explained in section 5.

If you consider that we have not handled your rights correctly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

9. Security

We apply reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration, and we limit access to the team members who need it for their work.

10. Cookies

This website uses its own and third-party cookies. Necessary cookies always work; analytics and advertising cookies are only switched on if you accept them in the notice shown on your first visit. You can change your choice at any time, here or with the “Cookie settings” link in the footer.

Cookie settings

Necessary

They do not need your consent, because without them the website cannot give you what you ask for. Your cookie choice is stored in your browser (local storage, “la_consentimiento”) for 12 months; after that we ask you again.

The website itself also stores technical session data in your browser (sessionStorage), which is deleted at the latest when you close the tab: for example, your website address if you type it on a service page, to carry it over to the check on the home page (it is deleted as soon as the home page picks it up), or what is needed to follow your report in that tab while it is being generated. This is technical storage, needed to give you what you ask for, and does not require your consent.

When you request an automatic report, the website loads Cloudflare Turnstile to check that you are not a robot (section 7). Turnstile may store in your browser technical information needed only for that check and for the security of the service; it does not use advertising or analytics cookies. Because it is necessary to give you what you ask for and protect the website, it does not require your consent.

Analytics (only with your consent)

• Google Analytics (Google Ireland Ltd.): counts visits and how the website is used. Cookies _ga and _ga_<id>, up to 2 years.
• Microsoft Clarity (Microsoft Corporation): shows us how people move through the pages (clicks, scrolling and session recordings without the data you type) so we can improve them. Cookies _clck, 1 year, and _clsk, 1 day.

Advertising (only with your consent)

• Google Ads (Google Ireland Ltd.): measures which ads end in a request or a booked call. Cookie _gcl_au, 90 days, plus those of google.com and doubleclick.net.
• Meta (Meta Platforms Ireland Ltd.): measures our ads on Facebook and Instagram and lets us show them to people who already know us. Cookie _fbp, 90 days.
• ChatGPT Ads (OpenAI): measures which ads in ChatGPT end in a booked call, with the cookies its pixel sets under OpenAI's policy.
• Leadsy.ai: tells us which company the website is being visited from, based on the IP address, so we know which companies are interested in us.

We load all of them with Google Tag Manager, which does not store cookies by itself. We use Google's consent mode: until you accept, Google's tags neither store nor read cookies in your browser. Meta, OpenAI and Leadsy.ai are not even loaded unless you accept advertising.

Blog articles that include a video show its cover image, which your browser downloads from YouTube's (Google's) servers when you open the article. The video only loads if you click it, from YouTube in its privacy-enhanced mode (youtube-nocookie.com); from that moment, YouTube may store information in your browser according to its own policy: policies.google.com.

You can also block or delete cookies in your browser settings; if you block the necessary ones, some parts of the website may not work.

11. Changes to this policy

We may update this policy to adapt it to legal or service changes. We will always publish the current version on this page with its update date.

Legal notice

In compliance with article 10 of Spanish Law 34/2002 on information society services and electronic commerce (LSSI-CE), these are the details of the owner of www.landingagency.com: Landing Agency SL, with tax ID (NIF) B44546083, entered in the Lleida Companies Register (Registro Mercantil de Lleida), volume 1681, folio 100, sheet L-34675, 1st entry, and registered office at Calle Puigllançada, 133, 25721 Prats i Sansor (Lleida). Office at Pg. de Gràcia, 46, Eixample, 08007 Barcelona. Phone +34 675 15 96 61 and email info@landingagency.com.

The texts, images, design and code of this website belong to Landing Agency SL or are used with the permission of their owners, and may not be reproduced without written authorisation. Third-party trademarks appearing on it belong to their owners.

Landing Agency SL is not responsible for the content of the external websites linked to from here.