Last updated: 4 September 2026 · Version 1.0
This policy explains what personal data Indexia Web collects, why, how long it is kept, and the rights you have over it. It is written to be read rather than to be skimmed past.
Indexia Web LLC provides SEO and web development services. For the purposes of the EU and UK General Data Protection Regulation, Indexia Web LLC is the data controller for the personal data described in this policy.
The company is registered in the State of Wyoming, United States. Personal data may be accessed and processed in more than one country; the countries concerned and the safeguards that apply are set out in section 6.
If you email or call, we receive whatever you choose to include: your name, email address, telephone number, company name, website URL, and the content of your message.
To deliver the service and issue invoices we collect your billing name and address, VAT number where applicable, and a record of the work performed. Payment card details are handled by our payment provider and are never seen or stored by us.
This site does not run advertising trackers, social media pixels, or third-party analytics that profile you across websites. Our hosting provider records standard server logs — IP address, browser type, pages requested, timestamps — which exist for security and troubleshooting and are not used to build a profile of you.
Under GDPR every processing activity needs a lawful basis. Ours are set out below.
Where we rely on legitimate interest, we have considered whether our interest is overridden by your rights and concluded it is not — replying to someone who has emailed us, and keeping our systems secure, are things a person contacting a business reasonably expects. You can object to processing based on legitimate interest at any time; see section 8.
Delivering SEO and development work usually requires access to your website, hosting and Search Console. In doing so we may encounter personal data that belongs to your customers — order records, form submissions, user accounts.
For that data, you are the controller and we act as a processor on your instructions. We commit to the following:
If you are subject to GDPR and we process personal data on your behalf, Article 28 requires a written data processing agreement between us. We will sign one on request, and for larger engagements we will propose one without being asked.
Indexia Web LLC is established in the United States. Personal data is also accessed and processed from Morocco, where the company’s work is carried out. If you are in the European Economic Area or the United Kingdom, your personal data is therefore transferred outside those territories — to both countries — when you contact us or engage our services.
The European Commission adopted an adequacy decision for the United States in July 2023, but it covers only organisations that have self-certified to the EU–US Data Privacy Framework. Indexia Web LLC is not currently self-certified, so that adequacy decision does not cover transfers to us. We rely instead on the European Commission’s Standard Contractual Clauses under Article 46 GDPR.
The European Commission has not issued an adequacy decision in respect of Morocco. Transfers to Morocco likewise rely on Standard Contractual Clauses.
We will enter into Standard Contractual Clauses on request, covering both destinations, and will supply them before any engagement begins where you need them in place first.
Some providers we use are located in the United States or elsewhere. Where they are, we rely on their transfer mechanisms, which for major providers are typically Standard Contractual Clauses or self-certification under the Data Privacy Framework.
Where a retention period is set by law we cannot shorten it, including in response to an erasure request.
If you are in the EEA or UK, you have the right to:
To exercise any of these, email contact@indexiaweb.com. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
Where Moroccan Law 09-08 applies to processing carried out there, you have equivalent rights, exercisable through the same address.
We keep the number of systems holding your data deliberately small. Accounts are protected with strong unique passwords and two-factor authentication where the provider supports it. Client site credentials are stored in an encrypted password manager, never in email or plain text.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform you directly where the risk is high.
Our services are sold to businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this policy as our services or the law change. The version number and date at the top of this page will always reflect the current version. Where a change materially affects how we handle data we already hold, we will contact affected clients directly rather than relying on this page alone.
For any question about this policy or about how your data is handled:
If you are in the EEA or UK and are not satisfied with our response, you may complain to your national data protection authority. In Morocco, the competent authority is the Commission Nationale de contrôle de la protection des Données à caractère Personnel (CNDP). In the United States, privacy enforcement sits with the Federal Trade Commission and, for residents of states with their own privacy statutes, with that state’s Attorney General.
Indexia Web LLC · Terms of Service · Refund Policy · Cookie Policy