Privacy Policy

1. Who’s collecting your data

SIA BMOptimize, a private limited company registered in Latvia (registration number 40203359436), is the data controller for personal data collected through fixmyworkflow.com (the “Site”) and through the services we sell on it. FixMyWorkflow is a brand of SIA BMOptimize.

Registered address: Cēsu nov., Vaives pag., Krīvi, "Bērzi 3" - 23, LV-4136, Latvia. Contact: contact@bmoptimize.com.

This policy explains what we collect, why, who we share it with, and your rights under the EU General Data Protection Regulation (GDPR).

2. What we collect

When you sign up for emails on the Site, we collect your email address, your first name if you give it, which page you signed up from, and whether you ticked the separate marketing box.

When you book or buy a service, we collect what the booking asks for: typically your name, email address, the time you booked, and your answers to the questions about your business and your website. We also keep what you send us during the work, such as text, images, logins you choose to share and our messages with you.

Payments are taken by our payment provider when you book. We receive confirmation that you paid, the amount and your billing details as needed for invoicing. We never see or store your full card number.

When you email us, we keep the message and your contact details to reply and to handle any work that follows.

Technical and usage data is received automatically: IP address (used for rate limiting and abuse prevention), browser and device information, the referring page, and how you use the Site if, and only if, you accept analytics cookies.

We do not use your data for automated decision-making or profiling that affects you.

3. Why we collect it (lawful basis)

• Contract (Art. 6(1)(b) GDPR): taking your booking and payment, delivering the service you bought, and contacting you about it. This does not rest on marketing consent, and withdrawing consent to marketing does not stop it.
• Consent (Art. 6(1)(a) GDPR): the emails you sign up for, and marketing emails if you tick the marketing box. Each has its own form or checkbox. Our Substack newsletters are separate: subscribing to those happens on Substack, under Substack’s own terms, and we do not sign you up to them from here.
• Legal obligation (Art. 6(1)(c) GDPR): keeping invoices and payment records as accounting and tax law requires.
• Legitimate interest (Art. 6(1)(f) GDPR): rate limiting to prevent abuse, being told when a form fails so a signup or request is not lost, securing our systems, and basic measurement to improve the Site.

4. Who processes it for us

We use the following kinds of processors:

• Email: Brevo (sib SAS, France), for storing contacts, sending emails and managing lists. Hosted in the EU.
• Booking and payments: our booking provider (Cal.com) and the payment provider it connects to (Stripe), for scheduling, the booking questions and taking payment.
• Hosting: Vercel (Vercel Inc., USA), for hosting the Site and its server functions. Vercel is certified under the EU-U.S. Data Privacy Framework.
• Analytics and measurement, only if you accept analytics cookies: PostHog, Google Analytics, Google Tag Manager and the Meta Pixel.
• Working tools: the software we use to build, host and edit the websites we make for clients, and to keep notes and communicate during a project.

Each processor is bound by a Data Processing Agreement (DPA) or equivalent terms and processes data only on our documented instructions. If we replace a processor with another of the same kind, this policy still applies.

5. How long we keep it

• Email contacts: until you unsubscribe or ask us to delete you.
• Booking and project data: for as long as we work together and for a reasonable period after, so we can support the work we delivered, unless you ask us to delete it sooner.
• Invoices and payment records: for the period Latvian accounting and tax law requires.
• Server logs and analytics: according to each processor’s default retention (typically 14 to 26 months), except where shorter retention is required by law.

6. Your GDPR rights

You have the right to:

• access the personal data we hold about you,
• correct inaccurate or incomplete data,
• request deletion (the “right to be forgotten”),
• restrict or object to processing,
• receive your data in a portable, machine-readable format,
• withdraw consent at any time (without affecting processing done before withdrawal),
• lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) or the supervisory authority in your country of residence.

To exercise any of these rights, email contact@bmoptimize.com. We respond within 30 days. Some data, such as invoices, we may have to keep by law even after a deletion request.

7. Cookies and tracking

We use cookies and similar technologies for:

• Essential: rate limiting, fraud prevention, remembering your cookie choice and basic Site functionality. No consent required.
• Analytics: measuring how the Site is used. Loads only if you accept.
• Marketing: audience measurement for advertising. Loads only if you accept.

Videos on the Site load from YouTube only after you click play, using YouTube’s privacy-enhanced mode. You can change your cookie preferences at any time with the cookie button on the Site or by clearing cookies in your browser.

8. Sharing with third parties

We do not sell your data. We share it only with the processors described in section 4, and only as needed to run the Site, the email list and the services you buy.

We may disclose data if required by a valid legal order under Latvian or EU law, or to protect against fraud or abuse.

9. International transfers

Some processors may transfer or process data outside the European Economic Area. Where they do, transfers are protected by:

• EU Standard Contractual Clauses, and / or
• the EU-U.S. Data Privacy Framework, for certified US processors.

10. Children

The Site is not directed at children under 16. If you believe a child has provided us with personal data, contact us and we’ll delete it.

11. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top reflects the most recent version. Material changes will be flagged on the Site where reasonably possible.

12. Contact

For any privacy questions, requests, or complaints: contact@bmoptimize.com.

See also our Terms of Service.