GenOptima Technology Co., Ltd. (“GenOptima”, “we”, “us”, or “our”) respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, protect, and otherwise process personal information when you visit our website, submit a form, request a GEO audit, communicate with us, use our online services, or otherwise interact with us in connection with this website (collectively, the “Services”).

1. Who We Are and How to Contact Us

The entity responsible for the processing described in this Policy is GenOptima Technology Co., Ltd.. For privacy questions, data-subject requests, complaints, or other privacy matters, contact us at info@gen-optima.com.

Where applicable law requires the appointment of a data protection officer, local representative, or other privacy contact, the relevant contact information will be provided through the applicable jurisdiction-specific notice or by contacting us.

2. Scope and Third-Party Services

This Policy applies to personal information processed by GenOptima through the Services. It does not govern third-party websites, applications, platforms, or services that are linked to or integrated with our website but are controlled by independent third parties. Those parties may have their own privacy notices and terms.

For example, if you choose to contact us through WhatsApp, LinkedIn, email, or another third-party communication platform, that platform may independently collect and process information about you. We do not control the privacy practices of those third parties. You should review their privacy notices before using those services.

3. Personal Information We May Collect

Depending on how you interact with the Services, we may collect the following categories:

3.1 Contact and identification information

• Name, business email address, telephone or mobile number.
• Company name, job title, department, industry, country or region.
• Contact preferences and other information you voluntarily provide.

3.2 Business and service information

• Your company website or other URLs submitted for an audit or assessment.
• Information about your business, products, services, competitors, markets, and GEO objectives.
• Questions, comments, project requirements, meeting information, and communications with us.
• Information contained in documents or attachments you voluntarily submit.

3.3 Technical and usage information

• IP address, approximate location derived from IP address, browser type, device type, operating system, language, time zone, and similar technical identifiers.
• Pages viewed, links clicked, referring pages, dates and times of access, session information, and interaction events.
• Cookie identifiers, advertising identifiers, analytics identifiers, and similar technologies where enabled and permitted.

3.4 Marketing and campaign information

• Campaign source, UTM parameters, landing-page interactions, referral information, and conversion events.
• Marketing preferences, subscription status, and records of opt-outs or consent where applicable.

3.5 Communications and third-party contact information

If you contact us by email, WhatsApp, social media, telephone, or another channel, we may receive your contact details, message content, attachments, timestamps, and other information contained in the communication, subject to the practices of the relevant platform.

3.6 Payment information

If payment functionality is introduced or used through the Services, payment-card or other financial information may be processed by the applicable payment provider. Unless expressly stated otherwise, we do not intentionally store complete payment-card numbers or security codes on our own systems.

4. Information We Do Not Intentionally Request

The Services are intended for business and professional use. We do not require you to submit sensitive personal information such as government identification numbers, financial account credentials, precise geolocation, health information, biometric identifiers, racial or ethnic information, religious beliefs, sexual-orientation information, or similar sensitive data.

Please do not submit such information unless we specifically request it through a lawful, secure process. If you voluntarily provide sensitive information, we may process it only to the extent permitted by applicable law and only when reasonably necessary for the stated purpose, or we may delete or securely isolate it where appropriate.

5. How We Collect Information

We may obtain personal information from:

• You directly, including when you complete forms, request an audit, contact us, subscribe, or communicate with us.
• Your device or browser, through server logs, cookies, pixels, tags, SDKs, and similar technologies where enabled.
• Third parties, such as business partners, event organizers, service providers, advertising platforms, or professional networking platforms, where lawful.
• Public or professional sources, such as publicly available business websites or professional profiles, where permitted by applicable law.

When we obtain personal information from a source other than the individual, we will provide any additional information required by applicable law within the applicable timeframe.

6. Purposes of Processing

We may process personal information for the following purposes:

• Responding to inquiries, requests, and communications.
• Providing GEO audits, visibility assessments, recommendations, and related services.
• Scheduling meetings, managing prospective or existing business relationships, and providing customer support.
• Operating, maintaining, securing, troubleshooting, and improving the website and Services.
• Measuring website performance, traffic, campaign effectiveness, and user experience.
• Detecting, preventing, investigating, and addressing fraud, abuse, security incidents, and other misuse.
• Complying with legal obligations, regulatory requests, court orders, and lawful government requests.
• Establishing, exercising, or defending legal claims and protecting our rights, property, personnel, and users.
• Sending service-related communications and, where legally permitted, business or marketing communications.
• Managing preferences, consent, suppression, and opt-out records.
• Conducting internal reporting, analytics, forecasting, and business administration using information proportionate to the purpose.

7. Legal Bases for Processing (Where GDPR/UK GDPR Applies)

Where the EU GDPR, UK GDPR, or another law requiring a lawful basis applies, we will rely on an appropriate legal basis for each processing activity. Depending on the circumstances, these may include:

• Performance of a contract or pre-contractual steps: for providing requested services, responding to an audit request, scheduling or preparing for a business engagement, and taking steps at your request before entering into a contract.
• Consent: where required for optional cookies, certain marketing communications, or other processing for which consent is legally required. You may withdraw consent at any time, without affecting processing that occurred before withdrawal.
• Legitimate interests: for reasonable business operations, security, service improvement, B2B relationship management, fraud prevention, and certain direct marketing activities where permitted and where our interests are not overridden by your rights and freedoms.
• Legal obligation: where processing is necessary to comply with applicable law.
• Vital interests or public interest: only where applicable and legally available.

Where we rely on legitimate interests, we will consider whether the processing is necessary, proportionate, reasonably expected, and balanced against individual rights and freedoms. Where electronic marketing laws require consent, we will not rely on legitimate interests as a substitute for that required consent.

8. Marketing Communications

We may send business-related communications, including responses to inquiries, service information, product updates, event information, newsletters, or other marketing content, subject to applicable law.

Where consent is required, we will seek it before sending the relevant marketing. Where a jurisdiction permits certain B2B marketing without prior consent, we will comply with the applicable requirements, including providing a clear and easy way to object or unsubscribe. You may opt out of marketing communications at any time by using an unsubscribe mechanism or contacting info@gen-optima.com.

Opting out of marketing does not necessarily stop service, security, transactional, or other non-marketing communications that are necessary to provide requested services or comply with law.

9. Cookies, Analytics, Advertising, and Similar Technologies

We may use cookies, pixels, tags, local storage, server-side measurement, analytics tools, advertising technologies, and similar mechanisms. These technologies may collect technical and usage information such as IP address, browser/device information, pages visited, interactions, referral sources, and conversion events.

9.1 Strictly necessary technologies

These may be used to provide core website functions, security, session management, form functionality, and other features that cannot reasonably operate without them.

9.2 Analytics and performance technologies

Where enabled, analytics tools may help us understand traffic, engagement, performance, and conversion activity. We will obtain consent where applicable law requires consent for non-essential analytics technologies.

9.3 Advertising and remarketing technologies

Where enabled, advertising or remarketing tools may measure advertising performance or help us reach audiences who have interacted with our website or content. Depending on the technology and jurisdiction, this activity may constitute “sharing” or targeted advertising under applicable privacy laws. We will provide the controls and notices required by applicable law.

10. AI, Automated Processing, and GEO Analysis

Because our Services concern generative-engine optimization and AI visibility, we may use automated systems or AI-enabled tools to analyze website content, search results, brand visibility, structured information, submitted URLs, and related business information.

We seek to minimize unnecessary personal information in AI-related processing. You should not submit sensitive personal information, passwords, authentication credentials, payment credentials, or confidential personal data in a GEO audit request unless specifically requested through an appropriate secure process.

Unless a separate notice states otherwise, we do not intend to make decisions producing legal or similarly significant effects about individuals solely through automated processing. GEO scores, recommendations, rankings, or visibility assessments are business and marketing analysis and should not be interpreted as decisions about an individual’s employment, credit, insurance, housing, health, or other legal rights.

If applicable law provides rights concerning automated decision-making, profiling, or similar technologies, we will provide the notices, human-review mechanisms, opt-out rights, or other safeguards required by that law.

11. How We Share and Disclose Personal Information

We may disclose personal information only as reasonably necessary for the purposes described in this Policy, subject to applicable law. Categories of recipients may include:

• Hosting, cloud infrastructure, content delivery, cybersecurity, and IT providers.
• CRM, lead-management, customer-support, email, scheduling, and communication providers.
• Analytics, conversion measurement, advertising, and marketing technology providers.
• AI, search, data-processing, and software providers used to deliver or improve the Services.
• Professional advisers, auditors, insurers, legal counsel, and other professional service providers.
• Affiliated entities or business partners where necessary and lawful.
• Government authorities, regulators, courts, law-enforcement bodies, or other parties where required or permitted by law.
• Parties involved in a merger, acquisition, financing, restructuring, sale of assets, or similar corporate transaction, subject to applicable confidentiality and privacy requirements.

We do not permit service providers to use personal information for purposes inconsistent with our instructions where they are acting as processors/service providers, except where independent processing is permitted or required by law.

12. Sale, Sharing, and Targeted Advertising

We do not sell personal information for monetary consideration in the ordinary course of operating the Services. However, certain advertising or analytics activities may be treated as “sharing” or cross-context behavioral advertising under laws such as the CCPA even when no money is exchanged directly for the information.

If an activity is legally considered a sale or sharing, we will provide the applicable opt-out mechanism, honor applicable privacy preference signals such as Global Privacy Control where required, and maintain records of valid opt-out requests. We will not discriminate against you for exercising privacy rights.

13. Categories of Personal Information and Business Purposes

14. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law. Retention depends on the type of information, the nature of the relationship, security requirements, legal obligations, dispute periods, and business needs.

• Lead and inquiry information: generally retained while the inquiry or business relationship is active and for a reasonable period afterward for follow-up, recordkeeping, legal, and compliance purposes.
• Customer and contract records: retained for the duration of the relationship and for the period required or reasonably necessary for accounting, tax, legal, warranty, dispute, and compliance purposes.
• Marketing preferences and suppression records: retained as necessary to honor opt-outs and prevent future unwanted marketing.
• Security and technical logs: retained for periods appropriate to security, troubleshooting, fraud prevention, and legal requirements.
• Cookie and analytics data: retained according to the applicable technology configuration and retention settings.

When personal information is no longer required, we will delete, anonymize, aggregate, or securely isolate it, subject to legal or operational exceptions.

15. Data Security

We use reasonable administrative, organizational, physical, and technical safeguards appropriate to the nature and risk of the information. These may include access controls, authentication, least-privilege practices, encryption in transit where supported, secure development practices, monitoring, backups, vendor controls, and incident-response procedures.

No internet transmission, storage system, or electronic communication is completely secure. Accordingly, we cannot guarantee absolute security. You should avoid submitting passwords, payment credentials, highly sensitive personal information, or confidential information through ordinary website forms or email.

16. Data Breaches and Security Incidents

If we become aware of a personal-information security incident, we will investigate, contain, remediate, document, and notify affected individuals or regulators when and to the extent required by applicable law. Notification timing and content may depend on the jurisdiction, nature of the incident, risk of harm, and applicable legal requirements.

17. International Data Transfers

GenOptima and its service providers may operate in different countries. Personal information may therefore be processed or stored outside your country of residence.

Where a jurisdiction restricts international transfers, we will use an appropriate transfer mechanism where required, such as an adequacy decision, standard contractual clauses, contractual safeguards, approved certification mechanisms, or another legally recognized mechanism. Additional safeguards may be applied based on the nature and risk of the transfer.

If Chinese personal information is transferred outside mainland China, the transfer will be handled in accordance with applicable Chinese data and personal-information laws and the applicable cross-border transfer mechanism and filing/assessment requirements, where triggered.

18. Your Privacy Rights — General

Depending on where you live and which law applies, you may have rights including:

• Access to personal information we hold about you.
• Correction of inaccurate or incomplete information.
• Deletion or erasure, subject to legal exceptions.
• Restriction of certain processing.
• Objection to certain processing, including direct marketing.
• Withdrawal of consent where processing relies on consent.
• Data portability in circumstances where legally required.
• Information about categories of recipients and sources.
• Opt-out of certain sales, sharing, targeted advertising, or profiling activities where applicable.
• Rights concerning sensitive personal information where applicable.
• Rights concerning certain automated decision-making or profiling where applicable.
• The right to lodge a complaint with an applicable data protection authority.

These rights are not absolute and may be subject to statutory exceptions, verification requirements, legal privilege, security needs, contractual obligations, or other lawful restrictions.

19. European Economic Area and United Kingdom

If the EU GDPR or UK GDPR applies to you, you may have the rights described in the applicable law, including access, rectification, erasure, restriction, objection, portability, and withdrawal of consent where relevant. You may also object at any time to direct marketing.

Where we process information based on legitimate interests, you may object to that processing on grounds relating to your particular situation, subject to applicable legal exceptions. Where direct marketing is involved, we will stop processing your personal information for direct marketing after a valid objection.

You may also lodge a complaint with the supervisory authority in the country where you live, work, or believe an infringement occurred. We encourage you to contact us first so that we can attempt to resolve the issue promptly.

20. California Privacy Rights

If you are a California resident and the CCPA applies to our processing, you may have rights to know/access, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal treatment for exercising your rights, subject to applicable exceptions.

If we engage in a sale or sharing covered by California law, we will provide a clear mechanism to submit the applicable opt-out request and will honor valid preference signals such as Global Privacy Control where required.

To submit a California privacy request, contact info@gen-optima.com. We may need to verify your identity to protect against unauthorized disclosure. We will only request information reasonably necessary for verification and will not use verification information for unrelated purposes.

We will not discriminate against you for exercising rights provided by California law. Authorized agents may submit requests where permitted by law, subject to applicable authorization and verification requirements.

21. China Personal Information Protection

Where the Personal Information Protection Law of the People’s Republic of China (“PIPL”) or other Chinese privacy and data-security laws apply, we will process personal information in accordance with applicable requirements, including purpose limitation, data minimization, transparency, security, individual rights, and applicable requirements for sensitive personal information.

Individuals may have rights including access, copying, correction, deletion where legally available, withdrawal of consent, explanation of processing rules, and other rights provided by applicable Chinese law.

Where personal information is provided outside mainland China, we will follow applicable cross-border transfer requirements, including any required separate consent, personal information protection impact assessment, standard contract, certification, security assessment, filing, or other legally applicable mechanism.

22. Other Jurisdictions

Privacy rights vary by jurisdiction. If you are located in Brazil, Canada, Australia, Japan, Singapore, or another jurisdiction with applicable privacy legislation, you may have additional rights or protections. We will apply mandatory local requirements to processing within the relevant scope.

If a local law provides a right or protection that is more protective than this Policy, the applicable law will prevail to the extent required.

23. How to Exercise Your Rights

Send your request to info@gen-optima.com with enough information for us to understand your request. Please identify the right you are exercising and, where possible, the email address or other contact information previously used with us.

We may request additional information to verify identity when reasonably necessary. We will not ask for unnecessary sensitive information solely to process a privacy request. If we cannot fulfill a request, we will explain the reason to the extent required by law.

We generally respond within the timeframe required by the applicable law. Some laws allow extensions for complex or multiple requests; where an extension is permitted, we will notify you as required.

24. Children and Minors

The Services are intended for business and professional audiences and are not directed to children. We do not knowingly collect personal information from children through the Services where prohibited by law. If you believe a child has provided personal information to us, contact info@gen-optima.com so that we can assess and take appropriate action.

25. Third-Party Links and Platforms

Our website may contain links to third-party websites, social platforms, messaging services, event pages, booking tools, or other external services. Clicking those links may cause your information to be processed by the third party. We are not responsible for the privacy, security, content, or practices of third-party services. Please review the applicable third-party privacy notices before providing information.

26. Business Transfers

If GenOptima undergoes a merger, acquisition, financing, restructuring, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be transferred as part of that transaction. We will handle such transfers in accordance with applicable law and contractual confidentiality requirements.

27. Legal Requests and Protection of Rights

We may disclose personal information when reasonably necessary to comply with applicable law, lawful process, court orders, regulatory requirements, government requests, or to establish, exercise, or defend legal claims; prevent fraud or abuse; protect the rights, property, safety, and security of GenOptima, our users, or others; or enforce applicable agreements.

28. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our Services, technologies, business practices, legal requirements, or privacy practices. The “Last updated” date at the top of this Policy will be changed when material revisions are made.

Where applicable law requires advance notice or consent for a material change, we will provide the required notice or obtain the required consent. We encourage you to review this Policy periodically.

29. Data Minimization and Accuracy

We seek to collect information that is reasonably relevant to the purposes for which it is used. You are responsible for ensuring that information you provide to us is accurate and appropriate for the purpose. Please notify us if your information changes or if you believe information we hold about you is inaccurate.

30. Confidentiality and Business Information

A privacy policy does not by itself create a contractual confidentiality obligation for all information submitted to the website. Do not submit trade secrets, source code, passwords, security credentials, regulated information, or other highly confidential material through a public form unless a separate confidentiality or secure-submission arrangement is provided. Where a separate contract, NDA, data-processing agreement, or service agreement applies, that agreement may impose additional obligations.

31. Severability and Applicable Law

If any provision of this Policy is determined to be invalid or unenforceable, the remaining provisions will remain effective to the extent permitted by law. This Policy is intended to operate together with mandatory privacy, data-protection, consumer-protection, and electronic communications laws applicable to the relevant processing activity.

32. Contact

For privacy questions, requests, complaints, or concerns: info@gen-optima.com