Legal
Privacy Policy
How Get Ranked On Top collects, uses, stores and shares personal data, and the rights you have over it. Written to describe what this website actually does, not what a template assumes it does.
Last updated 17 October 2026
1. Who we are
This site is operated by Evolves EOOD, trading as Get Ranked On Top, registered in Bulgaria under company number 206114078, with a registered office at 14 Tsar Osvoboditel Blvd, floor 6, Sredets, 1000 Sofia, Bulgaria.
We are the data controller for the personal data described below. For anything in this policy, including to exercise any of the rights in section 8, contact privacy@getrankedontop.com.
2. What we collect, and when
We only collect data you actively give us, plus a small amount of technical data needed to keep the service working. There is no analytics package on this site, no advertising or social pixels, and no third-party tracking scripts of any kind.
When you send an enquiry through the contact form: your name, email address, and — if you choose to provide them — your website address, the service you are interested in, and the content of your message.
When you create an account: your first and last name, email address, and optionally your company name and country. Your password is never stored. We keep only a salted scrypt hash of it, from which the password cannot be recovered.
When you place an order: your first and last name, email address, country, optionally your company name, and the contents and value of your order. We also generate an order reference and store the transaction identifier returned by our payment processor. Your IP address at the time of the order is passed to our payment processor for fraud screening (see section 5).
When you sign an agreement — at checkout, or the framework agreement sent after you create an account — we record your typed name, the date and time, your IP address, your browser's user-agent string and a fingerprint (hash) of the document, and store them with the signed copy as evidence of your signature.
Emails we send you: order confirmations, signed agreements, delivery and tracking updates, and replies to enquiries. We keep a record of each email sent — recipient, subject, content and whether it was delivered.
When you contact support: the messages you send and our replies, kept against your client record so the conversation has continuity.
Technical data. Our public forms are rate-limited to prevent flooding. Those counters are keyed either to your IP address — but only where our hosting proxy is explicitly trusted to report it — or to a single shared counter where it is not. These counters live in server memory only, are never written to the database, and are discarded when the window expires (10 minutes) or the server restarts.
3. What we never collect
- Card and payment details. Payment happens on a page hosted by ZEN. Card numbers, expiry dates and security codes never reach our servers and we never store them, in any form.
- Analytics or behavioural profiles. We do not measure which pages you visit, build a profile of you, or track you across other websites.
- Special category data. We do not ask for, and have no use for, data about health, ethnicity, religion, political opinions, biometrics, or sexual orientation. Please do not include such information in enquiry or support messages.
4. Why we use it, and our legal basis
Under the UK GDPR / EU GDPR, each use of your data needs a lawful basis. Ours are:
| What we do | Lawful basis |
|---|---|
| Take, price and fulfil your order; manage your subscription | Performance of a contract with you |
| Reply to an enquiry you sent us | Steps taken at your request prior to entering a contract, and our legitimate interest in answering the people who contact us |
| Create and secure your account | Performance of a contract with you |
| Keep invoices and order records | Compliance with a legal obligation (tax and accounting law) |
| Rate-limit forms, throttle failed logins, and otherwise protect the service | Our legitimate interest in keeping the site available and free of abuse |
Where we rely on legitimate interests, we have considered the effect on you and use the minimum data that achieves the purpose. You can object at any time — see section 8.
6. International transfers
Our data is held in Contabo GmbH, in a data centre in the European Union (Germany). Where a provider processes data outside the UK or the EEA, we rely on an adequacy decision where one exists, and otherwise on the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, together with any additional safeguards the transfer requires. You can ask us for a copy of the mechanism used.
7. How long we keep it
| Record | Kept for |
|---|---|
| Orders, invoices and payment records | 10 years from the end of the relevant financial year, as required by the Bulgarian Accountancy Act and VAT Act |
| Signed agreements, with the signature evidence recorded with them (typed name, IP address, user-agent, document fingerprint) | [contract retention period] after the agreement ends — the period in which a claim under it could be brought |
| Email records | [email record retention period] |
| Account records | While the account is open, and 12 months after you close it or ask us to delete it |
| Enquiries and sales-pipeline records | 24 months from our last contact with you, unless you ask us to erase them sooner |
| Support conversations | 24 months from the ticket being resolved |
| Rate-limiting counters | Up to 10 minutes, in memory only |
Deletion is currently carried out manually by our team on request or on schedule, rather than by an automated job. That does not change what we are committing to above — it means a deletion request is actioned by a person, normally within 30 days.
8. Your rights
If you are in the UK or the EEA you have the right to: get a copy of your data; have inaccurate data corrected; have data erased; restrict or object to how we use it; receive it in a portable format; and withdraw consent where consent was the basis. You will never be treated less favourably for exercising any of them.
Write to privacy@getrankedontop.com and we will respond within one month. We may ask for enough information to be sure we are dealing with the right person — that check is itself a protection for you.
If you are unhappy with our response you can complain to the Commission for Personal Data Protection (CPDP), Bulgaria. We would rather you raised it with us first so we can put it right.
9. How we protect it
- Traffic is served over HTTPS.
- Passwords are stored only as salted scrypt hashes, and are compared in constant time.
- The staff portal sits behind a signed, expiring,
httpOnlysession cookie and a login throttle that locks out repeated failures. - Public forms are rate-limited, and every price is recalculated on the server rather than trusted from the browser.
- Card data never reaches our infrastructure at all.
No system is perfectly secure. If we ever suffer a breach that is likely to put your rights at risk, we will tell the supervisory authority within 72 hours and tell you without undue delay.
11. Children
This is a business-to-business service and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes to this policy
We update this policy when what we do changes. The date at the top always reflects the current version. If a change materially affects your rights we will tell account holders by email before it takes effect.