Privacy Policy
1. Who is responsible
Top Pick Digital is responsible for the personal data described on this page. Contact: hello@toppickdigital.com. We are the “data controller” under the EU General Data Protection Regulation (GDPR), which applies to us because we are established in Spain, even though our clients are in the United States.
2. What we collect, why, and on what legal basis
a) Free AI visibility report form
Business name, trade, city, website (optional) and email address, plus the campaign tags of the link you followed (utm parameters) and the page that referred you, so we know which message brought you here. Purpose: to prepare and send your report, to reply to you about it and to follow up once about working together. Legal basis: steps taken at your request before entering into a contract (GDPR art. 6(1)(b)) and our legitimate interest in following up on a request you made (art. 6(1)(f)). Business name, city and email are required; without them we cannot send the report.
b) Booking an intro call
Name, email, company, website (optional), the time you pick and your time zone, plus the same campaign tags and referring page. Purpose: to schedule and hold the call and send you the calendar invite and video link. Legal basis: art. 6(1)(b).
c) Technical data
IP address, browser and request logs processed by our hosting provider to serve the site and protect it from abuse, including a hidden anti-spam field in our forms. Legal basis: legitimate interest in security (art. 6(1)(f)).
d) Visit statistics (only if you accept cookies)
If you click “Accept” in the cookie banner, we use Google Analytics 4 to count visits and see which pages and buttons help: pages viewed, clicks on our main buttons, whether you started or sent the report form or booked a call, approximate location (country and city, derived from your IP address, which Google does not store), device, browser and the site that referred you, linked to a random identifier stored in a cookie. We have turned off Google signals and ad personalization, and we do not link this data to your name or email. Legal basis: your consent (GDPR art. 6(1)(a) and art. 22.2 of the Spanish e-commerce law, LSSI). If you click “Reject” or do nothing, Google Analytics is not loaded at all.
We do not use advertising trackers, we do not sell personal information, and we make no automated decisions about you.
3. Who receives your data
We use service providers that process data on our behalf under data-processing agreements:
- Cloudflare, Inc. (USA): hosting, storage of report requests in its D1 database, sending the email that tells us a new request arrived, and Cloudflare Web Analytics (aggregate page views, without cookies or any identifier stored on your device).
- Cal.com, Inc. (USA): scheduling the call; Cal.com sends you the invitation and reminders and provides the video link.
- Google LLC (USA): the mailbox where we receive notifications and reply to you.
- Google Ireland Limited (Ireland), with Google LLC (USA) as its sub-processor: Google Analytics visit statistics, only if you accept cookies, under the Google Ads Data Processing Terms.
Links in the “Ask AI about Top Pick” section open ChatGPT, Claude, Perplexity or Google in a new tab. Nothing is sent to them unless you click; once there, their privacy policies apply. We do not share your data with anyone else unless the law requires it.
4. International transfers
We are established in Spain and some of our providers are in the United States. Transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified (Cloudflare, Google, including Google Analytics data sent to Google LLC) and on the European Commission's Standard Contractual Clauses (Cloudflare, Cal.com). You can ask us for a copy of the clauses.
5. How long we keep it
- Report requests: 12 months after we send the report, then deleted. If we start working together, for the duration of the contract and the legal retention periods that follow (up to 6 years for invoicing records under Spanish law).
- Call bookings: 12 months after the call.
- Security logs: up to 30 days.
- Google Analytics: event data is kept for 2 months in Google Analytics, then deleted; the cookies expire after 13 months, or sooner if you withdraw consent (see section 7).
6. Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to its processing, and to withdraw any consent at any time, by emailing hello@toppickdigital.com. We answer within one month. If you think we have not handled your data properly you can complain to the Spanish Data Protection Authority (Agencia Española de Protección de Datos, www.aepd.es) or to your local authority. Residents of U.S. states with privacy laws have the rights those laws grant them; we honor the same requests for everyone.
7. Cookies
We only use cookies if you accept them in the banner. We store your choice (accept or reject) in your browser's local storage for 12 months under the key tp-consent; that is needed to respect your choice and requires no consent. If you accept, Google Analytics sets:
_ga: first-party analytics cookie (Google) with a random identifier that distinguishes visitors. Expires after 13 months._ga_<container-id>: first-party analytics cookie (Google) that keeps the state of your session. Expires after 13 months.
You can change your mind at any time with “Cookie settings” at the bottom of every page: choosing “Reject” stops Google Analytics and deletes those cookies. You can also delete cookies in your browser settings. Withdrawing consent does not affect measurement done before.
8. Email
If we email you, every commercial message will say who we are, include our postal address and a way to stop further emails, and we honor those requests promptly. We never buy email lists.
9. Changes
We will post any change here with a new date. This site is intended for businesses; it is not directed at children.