Privacy information for businesses we audit

Insites Technologies Limited, Sadler Bridge Studios, Bold Lane, Derby, DE1 3NT, United Kingdom. We are registered in England and Wales, company number 13479874.

Our representative in the European Union, appointed under Article 27 of the EU GDPR, is DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland.

Insites analyses the online presence of a business: its website, its business listings, its reviews, how it shows up in search results, and how AI assistants describe it. Your business may have been analysed this way.

Most of what that produces is information about a business rather than about a person. Sometimes it is both. If you are a sole trader and your business name is your own name, or if you are named as a contact on a business website, then information about the business is also information about you. That makes it personal data, and data protection law gives you rights over it.

We collected it from sources other than you, so this page tells you what we hold, where it came from, why, and what you can do about it.

Most analyses are run because one of our customers asked for them. In those cases the customer decides which businesses are analysed and why, and we act on their instructions as their data processor.

We also analyse businesses on our own initiative, for example to build our own records of businesses we may approach, and we are the data controller for that.

If you contact us, we will check whether we also hold information about your business on our own account. Where we do, we will deal with your request ourselves. Where the analysis was instructed by one of our customers, that customer decides what happens to the information they hold, so we will pass your request on, and confirm to you that we have done so.

Every analysis starts from known identifiers for the business. This information is typically a business name, a website address, physical address and/or a telephone number.

From that starting point we collect:

• Content published on the business's website.
• Business listing details, including the name, address, telephone number and geographic coordinates.
• Review content.
• Search engine results.
• SEO data about the business (how it ranks in search engines, and for which keywords).
• Responses from AI assistants.

When we analyse a business, most of what we collect comes from sources that anyone can look at.

The business's own website. We retrieve its pages and read the content published on them.

Public business listings and search engines. Directory and map listings for the business, and the results search engines return for it.

Companies House. The public register of companies for the United Kingdom.

Review platforms. Reviews published about the business.

SEO data providers. Other tools or platforms that look at search engine performance for businesses.

AI assistants. The responses they give to questions about the business.

Social media profiles. Business social media profiles belonging to the business.

Online ads for the business. Advertisements that link to the business's website.

Where one of our customers instructs an analysis, that customer decides what it is for and holds the lawful basis for it. We act on their instructions.

Where we analyse a business on our own initiative, we rely on legitimate interests under Article 6(1)(f). Our interest is in identifying and assessing businesses that may benefit from our services, and in building an accurate picture of a business's online presence. You can object to that at any time, using the details below.

Insites is built to measure how well a business is marketed online: whether it can be found, and the things that determine that. Its website, its listings, its reviews, its search results, and the way AI assistants describe it. Everything we collect serves that purpose.

Our analysis is aimed at a business rather than at an individual, and what it produces is an assessment of that business's online marketing. Where the business and the person are the same, as they are for a sole trader trading under their own name, that assessment is still about how the business is marketed and found.

When we look at a website, we read the content published on its pages. If the site's robots.txt names Insites in the way set out below, we do not retrieve them at all.

We use a small number of providers to run an analysis, covering hosting, SEO data retrieval and AEO analysis. Our sub-processor list names every one of them, where it processes data, and the safeguard covering the transfer.

Some of these providers are outside the United Kingdom and the European Economic Area. Where that is so, the sub-processor list sets out what covers the transfer for each one. If you would like a copy of the safeguard that applies, email privacy@insites.com.

Where an analysis sits in a customer's account, that customer sets how long it is kept. The period runs from one year to five years, and it is three years unless they change it.

You can ask us for access to the personal data we hold about you, to have it corrected or erased, to have our processing of it restricted, to object to that processing, and to receive it in a portable form.

There are two routes, and they do different jobs.

To stop us retrieving pages from your website. Add these two lines to your website's robots.txt file:

User-agent: Insites
Disallow: /

Insites has to be named specifically. A wildcard rule (User-agent: *) will not apply, because blanket rules are addressed to search-engine indexing crawlers, and honouring them would stop a site owner running an audit of their own site. There is a step-by-step version of this in our help centre.

This stops us retrieving pages from your website. It does not delete information we already hold, and it does not stop your business appearing in our platform. For that, use the route below.

To object, or to ask us to delete what we hold. Email privacy@insites.com. Tell us the business name and the website address so we can find the right records. If we cannot tell that the request comes from the business, we may ask you to confirm it. We will respond within one month. Where your request has to be dealt with by the customer who instructed the analysis, we will pass it on promptly and tell you we have. Their own response time is a matter for them.

If you have any complaints about our use of your personal data, please email privacy@insites.com so that we can put it right.

If our response does not resolve it, you can take the complaint to your local data protection supervisory authority. You are entitled to do that at any time, whether or not you come to us first.

For UK individuals: The Information Commissioner's Office at, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England.

Our EU representative is: DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland.