Privacy Policy

Last updated: October 23, 2026. Effective date: October 23, 2026.

Overview

Outsourcing Review ("we", "us", "our") operates outsourcing-review.com (the "Service"). This policy describes what personal information we collect, how we use it, who we share it with, and your rights.

We follow the standards of the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA) and similar laws. If you are located in a jurisdiction with specific data protection laws, those rights are described in the "Your rights" section below.

Information we collect

Information you provide directly

• Contact form submissions and emails: name, email address, company name, and any message content you choose to send.
• "Add Your Company" ranking submissions: company name, website, contact person's name, business email, and any supplementary information you include.
• Newsletter signups (if applicable): email address and submission timestamp.

Information collected automatically

• Server logs: IP address, user-agent string, referring URL, timestamp, and pages visited. Retained for 90 days for security and abuse prevention.
• Analytics (if enabled): aggregated and anonymized visitor statistics via a privacy-respecting analytics tool. We do not use Google Analytics or any tracker that profiles individual visitors across sites.
• Cookies: see "Cookies" section below.

Information we do not collect

We do not collect payment information (we do not process payments on this site), government IDs, biometric data, precise geolocation, or special categories of personal data (race, religion, political opinions, sexual orientation, health data) under GDPR Article 9.

How we use your information

We use personal information only for the purposes you reasonably expect:

• To respond to your inquiry or process your submission
• To send you a newsletter if you have opted in
• To operate and secure the Service (fraud prevention, abuse detection)
• To comply with legal obligations
• To aggregate and anonymize analytics for editorial planning

We do not sell personal information. We do not share it with advertisers. We do not use it to train AI models.

Legal bases (GDPR)

• Consent for newsletter subscriptions and non-essential cookies
• Legitimate interest for responding to inquiries, server log retention, and security monitoring
• Contract for processing rankings submissions you choose to send
• Legal obligation for responding to lawful requests from authorities

Cookies

Who we share information with

We share personal information only with the following categories of service providers, and only to the extent necessary:

• Hosting provider (processes server logs on our behalf)
• Email provider (processes emails sent to our editorial addresses)
• Analytics tool if enabled (processes anonymized traffic data)
• Legal counsel or authorities if required by law

All service providers are bound by data processing agreements consistent with GDPR Article 28. We never sell, rent, or exchange personal information for marketing purposes.

International transfers

Our hosting infrastructure is located in the European Union. If any data is transferred outside the EEA, we rely on Standard Contractual Clauses adopted by the European Commission as the legal basis for the transfer, together with supplementary technical measures where required.

Data retention

• Contact inquiries and submissions: 24 months from last activity, then deleted
• Server logs: 90 days, then deleted
• Newsletter subscriptions: until you unsubscribe
• Published editorial content (including rankings): retained indefinitely as a matter of editorial record

Your rights

Depending on your jurisdiction, you have rights to:

• Access the personal information we hold about you
• Rectify inaccurate or incomplete information
• Delete your personal information (right to be forgotten)
• Restrict or object to processing
• Data portability (receive your data in a structured, machine-readable format)
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local data protection authority

To exercise any of these rights, email [email protected]. We respond within 30 days (the statutory maximum under GDPR).

California residents (CCPA/CPRA)

California residents have the right to know what personal information we have collected, to delete it, to opt out of its sale or sharing (we do not sell or share for cross-context behavioral advertising), and to non-discrimination for exercising these rights. Contact [email protected] to exercise these rights.

Security

We implement industry-standard technical and organizational security measures: HTTPS/TLS encryption in transit, encrypted backups at rest, access controls on administrative systems, and routine security audits. No system is completely secure, but we take reasonable steps to protect your information.

Children

The Service is not directed at children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact [email protected] and we will delete it promptly.

Changes to this policy

We may update this policy periodically. Material changes will be announced at the top of this page and the "Last updated" date will be revised. Your continued use of the Service after a change constitutes acceptance.

Contact

Questions about this privacy policy or requests to exercise your rights: [email protected].