Privacy Policy

Last updated: 20 March 2026

1. Who we are

Data Controller:
AG Ventures EOOD
Operating as: NorthTracking
Bulgaria (EU)
Email: hi@north-tracking.com

We are the data controller for personal data collected through this website. As a Bulgarian entity and EU-registered company, we are subject to EU GDPR. We also comply with UK GDPR for services provided to UK-based clients.

2. What data we collect

2.1 Data you provide directly

When you submit the free audit request form, we collect:

• Your full name
• Your work email address
• Your company website URL
• The ad platforms you use
• Any additional information you provide in the optional message field

2.2 Data collected automatically

When you visit our website, we may collect:

• IP address and approximate location (country/city level)
• Browser type and version
• Pages visited and time spent on the site
• Referring website or campaign source
• Device type (desktop, mobile, tablet)

2.3 Data we access as part of our service

When you engage us to conduct a tracking audit, you may provide us with read-only access to:

• Your Google Tag Manager container
• Your Google Analytics (GA4) account
• Ad platform accounts (Google Ads, Meta Ads Manager, etc.)

We access these solely to perform the audit. We do not store, copy, or share the data contained in these accounts beyond what is necessary to produce your audit report. Access is revoked or you are advised to revoke it upon completion of the engagement.

3. Legal basis for processing

Purpose	Legal basis
Responding to your audit request and providing the service	Performance of a contract / pre-contractual steps (Art. 6(1)(b) GDPR)
Sending you a confirmation email	Performance of a contract (Art. 6(1)(b) GDPR)
Following up by email or phone regarding your enquiry	Legitimate interests (Art. 6(1)(f) GDPR) — responding to your direct enquiry
Website analytics and performance tracking (via GTM/GA4)	Consent (Art. 6(1)(a) GDPR) — where a consent mechanism is in place
Compliance with legal obligations	Legal obligation (Art. 6(1)(c) GDPR)

4. How we use your data

We use the data you provide to:

• Respond to your audit request and schedule a review call
• Prepare and deliver your tracking audit report
• Send you a quote for any implementation work if you request one
• Communicate with you about the progress of your project
• Comply with applicable legal and regulatory obligations

We do not use your data for unsolicited marketing, and we do not sell, rent, or share your personal data with third parties for their own marketing purposes.

5. Who we share your data with

We may share your data with the following categories of third parties only where necessary to deliver our services:

• Email service providers — to deliver confirmation and communication emails (e.g. our hosting provider's mail server on Superhosting)
• Google (Google Tag Manager, Google Analytics) — for website analytics. Google acts as a data processor under a Data Processing Agreement. Data may be transferred outside the EU; Google's Standard Contractual Clauses apply
• Legal and regulatory authorities — if required by law or court order

We do not use any other third-party analytics, advertising, or tracking technologies on this website beyond those listed above.

6. International data transfers

As a Bulgarian (EU) company, your data is processed within the EU by default. Where data is transferred outside the EU/EEA (for example, via Google's infrastructure), we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable

For UK-based clients, we comply with UK GDPR transfer rules and rely on the UK's International Data Transfer Agreement (IDTA) where applicable.

7. How long we keep your data

Data type	Retention period
Audit request form submissions	2 years from the date of submission, or the duration of the client relationship if longer
Email correspondence	3 years from the end of the engagement
Client account access credentials / tokens	Deleted immediately upon completion of the audit
Website analytics data (GA4)	14 months (Google Analytics default retention)
Invoices and financial records	5 years (Bulgarian accounting law requirement)

8. Your rights under GDPR

You have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can ask us to correct inaccurate or incomplete data
• Right to erasure — you can ask us to delete your data in certain circumstances ("right to be forgotten")
• Right to restriction of processing — you can ask us to limit how we use your data
• Right to data portability — you can request your data in a structured, machine-readable format
• Right to object — you can object to processing based on legitimate interests
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, email us at hi@north-tracking.com. We will respond within 30 days.

9. Cookies and tracking technologies

This website uses Google Tag Manager (GTM) to manage tracking scripts. The following technologies may be deployed through GTM:

• Google Analytics 4 (GA4) — website analytics, measuring page views, traffic sources, and user behaviour. Data is anonymised where possible
• Google Ads conversion tracking — measuring whether visitors who clicked an ad subsequently submitted the audit form

Where required by GDPR/PECR, these technologies are only activated after you have provided consent via our cookie consent mechanism. Essential cookies necessary for the website to function do not require consent.

You can withdraw cookie consent at any time by clearing your browser cookies and declining consent on your next visit, or by contacting us at hi@north-tracking.com.

10. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include:

• HTTPS encryption for all data transmitted through this website
• Access controls limiting who can view submitted form data
• Prompt deletion of access credentials provided for audit purposes
• Storing data only with reputable hosting providers operating within the EU

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and will inform affected individuals without undue delay where required.

11. How to complain

If you believe we have not handled your personal data correctly, please contact us first so we can try to resolve the issue:

Email: hi@north-tracking.com

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority:

• Bulgaria (EU): Commission for Personal Data Protection (CPDP) — www.cpdp.bg
• UK: Information Commissioner's Office (ICO) — ico.org.uk
• Other EU member states: your local data protection authority

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will update the "Last updated" date at the top of this page. For significant changes, we will notify active clients by email. We encourage you to review this page periodically.