Privacy Policy

This Privacy Policy explains how “Katerina 7” OOD collects and processes personal data when you visit back2rank.com (the Website) or contact us through the Website.

It applies to the public Website and inquiries submitted through it. It does not govern personal data processed through the authenticated Back2Rank Client Portal. The Client Portal will be covered by a separate privacy notice and the applicable client service agreement.

 

1. Data controller

The controller responsible for the processing described in this Policy is:

Company: “Katerina 7” OOD
Unique Identification Code (UIC): 204981218
VAT identification number: BG204981218
Registered office and management address: 1700 Sofia, Studentski Grad residential district, block 58, entrance A, Bulgaria
Telephone: +359 896 764 777
Email: [email protected]

Back2Rank is the commercial brand under which “Katerina 7” OOD presents and provides its specialist SEO and related services. Back2Rank was formerly known as MAX Digital.

In this Policy, we, us and our refer to “Katerina 7” OOD.

 

2. Scope of this Policy

This Policy covers personal data processed when you:

1. browse the public Website;
2. change your cookie or analytics preferences;
3. submit a contact form or request information, an assessment or a proposal;
4. contact us by email or telephone using details published on the Website; or
5. communicate with us about privacy, security or another Website-related matter.

Paid services are provided under separate written agreements. Additional privacy information may apply when you become a client, provide access to business systems or use the Client Portal.

 

3. Personal data we process

Depending on how you use the Website, we may process the following categories of personal data:

• Contact and identification data: name, business or organization, job title, email address and telephone number.
• Inquiry data: the content of your message, the service or issue you ask about, information you choose to provide and any follow-up correspondence.
• Technical and security data: IP address, date and time of access, requested URL, referrer, browser and device information, operating system, network data, server logs, security events and bot-detection signals.
• Analytics data: page views, navigation path, approximate location, referral source, session duration, interactions, clicks, scrolling, device and browser characteristics, cookie or similar identifiers, and events configured in our analytics tools.
• Consent data: your cookie choices, the time they were recorded and information needed to respect or demonstrate those choices.
• Rights-request data: information contained in a privacy request and information reasonably required to confirm identity and respond to it.

We do not ask you to submit passwords, payment-card details, national identification numbers, health information or other sensitive data through the general contact form.

 

4. Why we process personal data and our legal bases

Purpose	Data generally used	Legal basis under the GDPR
Deliver the Website, maintain availability, diagnose errors and protect the Website against fraud, spam, abuse and cyberattacks	Technical, network, log and security data	Our legitimate interests in operating and securing the Website, Article 6(1)(f); compliance with a legal obligation where applicable, Article 6(1)(c)
Receive, assess and respond to inquiries, arrange a call and prepare a proposal	Contact and inquiry data	Steps at your request before entering into a contract, Article 6(1)(b), where you would be a party to the contract; otherwise our legitimate interests in handling business communications and service inquiries, Article 6(1)(f)
Measure Website use with Google Analytics 4 and improve reporting through Google Tag Manager	Analytics, device, browser and consent data	Your consent, Article 6(1)(a)
Understand how visitors use pages through Microsoft Clarity heatmaps and session reconstructions	Interaction, analytics, device, browser and consent data	Your consent, Article 6(1)(a)
Record and respect cookie choices	Consent and technical data	Compliance with legal obligations, Article 6(1)(c), and our legitimate interest in demonstrating compliance, Article 6(1)(f)
Establish, exercise or defend legal claims, respond to authorities and comply with applicable law	Relevant contact, inquiry, technical, security and rights-request data	Compliance with a legal obligation, Article 6(1)(c), and our legitimate interests in protecting our rights, Article 6(1)(f)

Where we rely on legitimate interests, those interests include operating a secure Website, preventing malicious activity, responding to business inquiries, maintaining appropriate records and protecting legal rights. We consider the necessity and impact of the processing and do not rely on legitimate interests where your rights and freedoms take priority.

 

5. Contact forms and correspondence

When you submit an inquiry, we use the information you provide to understand the request, respond, arrange a conversation and, where appropriate, prepare a proposal or take other steps you request before a possible engagement.

Fields identified as required must be completed so that the form can be submitted and we can respond. Other information is optional. If you do not provide the required contact details or enough information to understand the request, we may be unable to reply or assess it.

Website inquiries and related email correspondence are handled through Google Workspace or Gmail. Google may process message content, sender and recipient details, timestamps, attachments and related technical information when providing the email service. More information is available in the Google Privacy Policy.

Submitting an inquiry does not subscribe you to a newsletter or unrelated marketing communications. The Website does not offer a newsletter.

 

6. Analytics and user-experience tools

Optional analytics technologies are used only after you have given the relevant consent through the Website’s consent controls. You can refuse analytics without losing access to the public Website.

Google Tag Manager

Google Tag Manager helps us manage Website tags. The container is configured to respect the consent status communicated by the Website’s consent controls. It must not be used to bypass your choices or load optional analytics tools before the required consent is available.

Google Analytics 4

Google Analytics 4 helps us understand how visitors find and use the Website. It may process information such as pages visited, events, approximate location, browser and device details, traffic source and cookie or similar identifiers. We do not intentionally send names, email addresses, form contents or other directly identifying contact information to Google Analytics.

Google states that it does not log or store individual IP addresses from users in the European Union when collecting data through Google Analytics. Google may nevertheless receive an IP address temporarily so that the connection and initial processing can occur.

You can learn more from Google’s pages on safeguarding Analytics data and the Google Privacy Policy.

Microsoft Clarity

Microsoft Clarity helps us understand how visitors interact with the Website through heatmaps and session reconstructions. Clarity may capture how a page renders and interactions such as clicks, mouse movements and scrolling, together with device, browser, page and session information.

Clarity session reconstructions are not video recordings. They are generated from page and interaction data. We configure masking and exclusions so that contact-form fields and other information intended to remain private are not captured. Microsoft states that it acts as a controller for Clarity data. More information is available in the Microsoft Privacy Statement and the Microsoft Clarity terms.

 

7. Website security, Cloudflare and bot protection

We use Cloudflare for Website traffic management, performance and security. Cloudflare may process IP addresses, requested URLs, traffic and protocol data, device and browser information, security signals and information about suspected malicious activity. This processing helps deliver the Website, prevent abuse, mitigate attacks and investigate security events. See the Cloudflare Privacy Policy.

We use Google reCAPTCHA to protect Website forms against spam and abuse. reCAPTCHA analyzes device, browser, network and interaction signals to assess whether an action is likely to be legitimate. It may set the _GRECAPTCHA cookie for risk analysis. Google’s privacy policy and terms apply to Google’s processing. See the Google Privacy Policy and reCAPTCHA information.

Bot protection is used to secure forms and prevent spam and abuse. Where access to or storage of information on your device is not strictly necessary for that purpose, the relevant technology will be subject to the consent controls required by law.

 

8. Cookies and similar technologies

The Website uses cookies and similar technologies for security, consent management and, if you agree, analytics.

Strictly necessary technologies are used to deliver requested functionality, protect the Website and remember privacy choices. Optional analytics technologies are not activated unless the required consent has been obtained.

You can accept or reject optional categories and change your choices through the Website’s consent controls. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

The Cookie Policy provides the current cookie inventory, purposes, providers, retention periods and instructions for changing your choices. Because cookies can change when Website configurations change, the Cookie Policy should be read together with this Privacy Policy.

 

9. Recipients of personal data

We disclose personal data only where necessary for the purposes described in this Policy. Recipients may include:

• authorized employees and contractors who need the information to perform their duties;
• Website hosting, maintenance and technical-support providers;
• Cloudflare, for traffic delivery and Website security;
• Google, for Google Workspace or Gmail, Google Tag Manager, Google Analytics 4 and reCAPTCHA;
• Microsoft, for Microsoft Clarity;
• professional advisers, including legal, accounting, security and insurance advisers, where necessary;
• competent public authorities, courts or regulators where disclosure is required or permitted by law; and
• a successor or transaction adviser in connection with a genuine corporate reorganization, merger, acquisition or transfer, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal data.

Some providers may act as processors on our instructions. Others may act as independent controllers for particular processing they carry out under their own terms and privacy notices.

 

10. International data transfers

Some service providers or their group companies may process personal data outside Bulgaria or the European Economic Area, including in the United States.

Where personal data is transferred to a country outside the European Economic Area, we use a transfer mechanism permitted by Chapter V of the GDPR. Depending on the provider and destination, this may include:

• an adequacy decision adopted by the European Commission;
• the European Commission’s Standard Contractual Clauses;
• participation by the recipient in an applicable approved data-transfer framework; or
• another lawful safeguard or derogation available under the GDPR.

We also consider supplementary contractual, technical and organizational measures where required. You may contact us for further information about the safeguard relevant to a particular transfer. Certain commercial or security-sensitive details may be redacted where permitted by law.

 

11. Retention periods

We keep personal data only for as long as necessary for the purpose for which it was collected, including legal, accounting, security and claims requirements.

Data	Normal retention approach
Contact-form inquiries and related correspondence that do not lead to an engagement	Up to 24 months after the last meaningful communication, unless a shorter period is sufficient or longer retention is needed for a legal claim or legal obligation
Proposal and pre-contract records	For the period reasonably required to manage the proposal and any resulting legal claim; if an engagement begins, relevant records may become part of the client file governed by the applicable agreement and privacy information
Website and security logs under our control	Normally up to 12 months, unless a security incident, investigation or legal claim requires longer retention
Google Analytics 4 user-level and event-level data	For the period configured in the relevant Analytics property, not exceeding 14 months; aggregated reports that no longer identify a visitor may be kept for longer
Microsoft Clarity data	Playback data is generally retained for 30 days. Click and heatmap data, labeled or favorite sessions and a limited sample of recordings may be retained for up to 9 months under Microsoft’s current retention rules
Cookie-consent records	For as long as reasonably necessary to respect your choices and demonstrate compliance, taking account of applicable limitation periods
Privacy requests and related correspondence	For as long as necessary to respond and demonstrate compliance, and longer where required for a complaint, investigation or legal claim

Service providers may keep limited data for additional periods required by law, security, backups or the protection of legal rights, in accordance with their applicable terms.

When personal data is no longer required, we delete or anonymize it, unless continued retention is required or permitted by law.

 

12. Sources of personal data

We obtain personal data:

• directly from you when you submit a form, email us, call us or exercise a privacy right;
• automatically from your browser or device when you use the Website;
• from the analytics, security, hosting and communication providers described in this Policy; and
• from a business or organization you represent, where it includes you in an inquiry or correspondence.

 

13. Your rights

Subject to the conditions and limits in applicable law, you may have the right to:

1. receive confirmation of whether we process your personal data and obtain access to it;
2. correct inaccurate data and complete incomplete data;
3. request erasure of personal data;
4. request restriction of processing;
5. receive personal data you provided in a structured, commonly used and machine-readable format, and request its transmission to another controller where the right to data portability applies;
6. object, on grounds relating to your particular situation, to processing based on legitimate interests;
7. withdraw consent at any time where processing is based on consent; and
8. lodge a complaint with a competent data-protection supervisory authority.

Where we process data for direct marketing, you have an absolute right to object to that processing. The Website does not currently operate a newsletter.

These rights are not absolute. For example, we may retain information where necessary to comply with law or establish, exercise or defend legal claims.

 

14. How to exercise your rights

Send requests to [email protected] or use the contact details in Section 1. Describe the right you wish to exercise and provide enough information for us to identify the relevant data.

We may request limited additional information where reasonably necessary to verify identity and protect personal data against unauthorized disclosure. We normally respond within one month. Where permitted by the GDPR, this period may be extended by up to two further months because of complexity or the number of requests. We will inform you if an extension is required.

Requests are normally free of charge. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, as permitted by law.

 

15. Automated decision-making

We do not use personal data collected through the public Website to make decisions based solely on automated processing that produce legal effects or similarly significant effects for you.

Security services may automatically assess whether traffic or a form submission appears automated or malicious. These assessments protect the Website and may temporarily block a request, but they are not used to make contractual, employment, credit or similarly significant decisions about you. If a legitimate form submission is blocked, contact us by email or telephone.

 

16. Special-category data and information about children

The public Website and contact form are not intended for the submission of special categories of personal data, such as health data, biometric data, political opinions, religious beliefs or information about a person’s sex life or sexual orientation. Please do not send this information through the general contact form. If it is provided without being requested, we will limit its use and delete it where it is not necessary to handle the inquiry or comply with law.

The Website is intended for business and professional audiences and is not directed to children. We do not knowingly use the public Website to collect personal data from children.

 

17. Data security

We use appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. These measures may include access controls, encryption in transit, security monitoring, backups, provider reviews and procedures for handling incidents and rights requests.

No internet transmission or storage system can be guaranteed to be completely secure. If you believe information sent to or through the Website has been compromised, contact us promptly.

 

18. Changes to this Policy

We may update this Policy when the Website, our processing activities, service providers or legal obligations change. The current version will be published on this page with its effective date. Where a change materially affects how we use personal data, we will provide additional notice where appropriate.

 

19. Supervisory authority

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection or, where applicable, another supervisory authority in the European Union or European Economic Area.

Bulgarian Commission for Personal Data Protection
Address: 2 Prof. Tsvetan Lazarov Boulevard, 1592 Sofia, Bulgaria
Email: [email protected]
Website: cpdp.bg

We encourage you to contact us first so that we have an opportunity to address your concern.