Privacy Policy

Last updated: 14 October 2026

This policy explains which personal data is collected through seoyolo.com, why it is used, how long it is kept and how to exercise your rights.

Who controls your data

SEO YOLO is a trading name of Josh Willett Consultancy, a French single-member limited liability company (EURL). Josh Willett Consultancy is the controller of the personal data collected through this website.

Josh Willett Consultancy is not required to appoint a data protection officer. Privacy requests can be sent to the email address above or to hello@seoyolo.com.

What information is collected

The data collected depends on how you use the website.

• When you send an enquiry, the form collects your name, your email address, your telephone number if you choose to give it, and your message.
• When you correspond by email or telephone, the information you provide becomes part of the business correspondence.
• When you become a client, the contact details and business information needed to deliver the agreed work, send invoices and keep records are collected.
• Google Analytics 4 may collect usage information such as the pages viewed, approximate location, device, browser, the source of the visit and interactions with the website.
• Cloudflare may process technical request data, including the IP address, browser information and security signals, in order to deliver and protect the website.

The website does not knowingly collect sensitive data through the form. Please do not send passwords, payment card details or confidential information that is not needed for your enquiry.

Why the information is used and on what legal basis

Personal data is used to reply to enquiries, carry out the free audits and discussions you ask for, prepare a proposal, deliver the agreed work, keep business records, protect the website and understand how it is used.

The legal basis depends on the activity:

• enquiries, audits and early discussions rely on steps taken at your request before entering into a contract and, depending on the context, on the legitimate interest in replying to a business enquiry
• client work is processed to perform a contract
• invoicing, accounting and administrative records are kept to comply with legal obligations
• protecting and securing the website relies on legitimate interest
• business-to-business prospecting emails rely on legitimate interest: they concern an offer relevant to the recipient's job, and every message offers a way to opt out
• non-essential audience measurement cookies rely on your consent where consent is required

Cookies and analytics

The website uses cookies. Cloudflare may use essential cookies to protect and deliver the website.

The website also uses Google Analytics 4, loaded through Google Tag Manager, to measure traffic and how the website is used. Google Analytics runs on every page. The cookie notice on the contact page lets you accept or decline; your choice is saved in your browser's local storage so the notice does not appear again, and it does not change whether Google Analytics loads. You can limit or delete cookies in your browser settings, and you can use the opt-out tools Google provides for Google Analytics.

Service providers and recipients

Data is available only to the people and providers who need it to run the website, reply to enquiries or deliver the work concerned.

• Cloudflare for hosting, content delivery, website security and receiving form submissions
• Google Cloud for running the service that forwards form enquiries
• SMTP2GO for delivering form enquiries to the company's email inbox
• Google Workspace for email and business correspondence
• the company's own client management system, which keeps a record of each form enquiry so it can be followed up, hosted on servers rented from Hetzner
• Google Analytics 4 and Google Tag Manager for website measurement
• Google Fonts for delivering fonts when they are loaded from Google's services
• the company's accountant, for invoicing and accounting records

These providers act under their own terms and data protection commitments. Josh Willett Consultancy does not sell or rent your personal data. Data may also be disclosed where the law requires it.

Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area, including in the United Kingdom and the United States. Where that happens, the processing is covered by an adequacy decision such as the EU-US Data Privacy Framework, by standard contractual clauses or by another transfer mechanism provided for by the GDPR, depending on the provider.

How long information is kept

• Enquiries and prospect correspondence are kept for up to three years after the last contact.
• Client records and contracts are kept for the length of the contract and five years after it ends.
• Invoices and accounting records are kept for ten years.
• Technical security data and audience measurement data follow the retention periods configured with the providers concerned.

Your rights

Depending on the circumstances, you can ask for:

• access to your personal data
• correction of data that is inaccurate
• erasure of your data
• restriction of processing
• portability of the data concerned
• an end to processing based on legitimate interest, by objecting to it
• withdrawal of your consent where consent is the legal basis
• instructions to be recorded about what happens to your data after your death, a right provided by French law

Exercising your rights

To exercise a right, write to hello@joshwillett.com or hello@seoyolo.com. Proof of identity may be requested only where it is needed to confirm who is making the request.

You can also lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or visit cnil.fr. If you are in the United Kingdom, you can complain to the Information Commissioner's Office at ico.org.uk.

Data security

Proportionate technical and organisational measures are used to protect data against unauthorised access, loss, alteration or disclosure. No online service can guarantee absolute security.

Changes to this policy

This policy may be updated when the website, the providers or the legal requirements change. The date of the last revision is shown at the top of the page. The rules for using the website and buying services are in the terms and conditions.