Privacy Policy | Optymyse

Optymyse Ltd respects your privacy and is committed to handling personal information fairly, securely and transparently.

This notice explains what we collect, why we use it, who we share it with and the rights available to you. It applies when you visit optymyse.com, contact us, request a demonstration, book a meeting, ask for support or otherwise deal with Optymyse in a business context.

1. Who we are

Optymyse Ltd is the controller of the personal information described in this notice unless we explain otherwise.

Optymyse Ltd is a private limited company registered in England and Wales under company number 16052256. Our registered office is Thursby House, 1 Thursby Road, Bromborough, Wirral, United Kingdom, CH62 3PW.

For privacy questions, rights requests or complaints, contact us at hello@optymyse.com, call 020 3951 2481, or write to us at the registered office above.

Where we process personal information inside an Optymyse product on behalf of a customer, that customer will usually be the controller and Optymyse will act as its processor. The customer’s privacy notice and our agreement with that customer will govern that processing.

2. Information we collect

Information you give us

Depending on how you contact us, this may include:

your first and last name;
work email address and telephone number;
company name and role;
the subject and content of an enquiry, demonstration request or support ticket;
meeting details and any information you enter into our booking scheduler;
correspondence, call notes and other information connected with our business relationship; and
account, order, billing and service information if you become a customer.

Our public website does not directly collect or store full payment card or bank account details. If you pay an invoice, complete a Stripe checkout or set up a GoCardless payment mandate, the relevant payment details are collected securely by Stripe or GoCardless. We may receive your billing contact details, transaction reference, amount, payment status and limited information about the payment method, but not the full credentials needed to make a payment.

Please do not include special category information, financial credentials or other sensitive information in a website form unless we specifically ask for it and explain why it is needed.

Information collected when you use the website

Our website and security provider may process technical information such as your IP address, browser and device type, request date and time, pages requested, referring page, approximate country and diagnostic or security events.

Cloudflare Web Analytics gives us aggregated page-view and performance information. Cloudflare states that this service does not collect or use visitors’ personal data and it does not use cookies for this purpose.

If you accept optional HubSpot analytics, HubSpot may collect page views, referral information, campaign information, browser and device information, IP-derived location and a visitor identifier. If you later submit a form, HubSpot may associate that activity with your contact record. We do not use this technology to capture text typed into a form before it is submitted.

Campaign parameters in the current page address may be submitted with a form. With your consent, we may also keep those parameters in session storage until you close the browser so that we can understand which campaign led to an enquiry.

Forms and meeting bookings

Contact, demonstration and support forms are protected by Cloudflare Turnstile. Turnstile assesses browser and device signals to distinguish people from automated traffic. Our server sends the resulting token and your IP address to Cloudflare for validation. A failed check may prevent the form from being sent, but you can still contact us by email or telephone.

Valid form submissions are sent to HubSpot, which we use for forms, customer relationship management and support administration.

If you allow optional HubSpot tools, the meeting scheduler on our demonstration page loads from HubSpot. Information entered into that scheduler is sent directly to HubSpot so that the meeting can be arranged.

Authorised content editors

Authorised editors who use the website’s content management area sign in through Keystatic Cloud. Keystatic Cloud connects the content system to GitHub, where website content and its revision history are stored. Keystatic and GitHub may process editor account information and contribution history under their own notices and our arrangements with them. This does not apply to ordinary website visitors.

3. How and why we use information

We use personal information only where we have a lawful basis to do so:

To operate, secure and troubleshoot the website. We use technical and security information for our legitimate interests in providing a reliable website, preventing abuse and protecting our systems and users.
To respond to enquiries and arrange demonstrations or meetings. We use the details you provide to take steps at your request before a contract and for our legitimate interests in communicating with prospective customers and partners.
To provide products, support and other services. We use customer and support information to perform our contract and manage the business relationship.
To manage customer and business records. We use account, order, correspondence and billing information to perform contracts, meet legal obligations and pursue our legitimate interests in running and protecting the business.
To take and reconcile payments. We and our payment providers use billing and transaction information to perform our contract, prevent fraud, administer payments and refunds, and meet financial and regulatory obligations.
To understand website use. We use aggregated Cloudflare Web Analytics for our legitimate interest in measuring and improving the website. We use HubSpot analytics and related browser storage only with your consent.
To measure campaign effectiveness. We use campaign information submitted with an enquiry for our legitimate interest in understanding how the enquiry arose. We store campaign information in the browser beyond the current page only with your consent.
To send marketing. We will send electronic marketing only where you have consented or where the law otherwise permits it. You can opt out at any time. Service messages are not marketing.
To comply with law and protect rights. We may use information to meet legal, regulatory, tax and accounting duties, establish or defend legal claims, and protect people, property and the integrity of our services.

Where we rely on legitimate interests, we consider whether our use is necessary and balance it against your rights and reasonable expectations. You can ask us for more information about that assessment.

4. Who receives information

We do not sell personal information.

We use the following providers for the website:

Cloudflare, Inc. and its group companies provide website delivery, edge security, Workers hosting, Turnstile, operational logging and Web Analytics. See Cloudflare’s Privacy Policy and Cloudflare Customer DPA.
HubSpot, Inc. and its group companies provide forms, customer relationship management, support administration, optional analytics and meeting scheduling. See HubSpot’s Privacy Policy, Data Processing Agreement and visitor cookie information.
Stripe Payments UK Ltd and other relevant Stripe group companies process card and other supported payments, provide checkout services and help prevent payment fraud. Stripe may act as our processor for some activities and as an independent controller for regulated, fraud-prevention and compliance activities. See the Stripe Privacy Center.
GoCardless Ltd and its group companies process Direct Debit and other bank payments, manage payment mandates and help prevent payment fraud. GoCardless also processes information for its own regulated and compliance purposes. See the GoCardless Privacy Centre.
Thinkmill Labs Pty Ltd, through Keystatic Cloud, and GitHub, Inc. provide content editing, authentication and version-controlled storage for authorised website editors. See Keystatic’s Privacy Policy and GitHub’s Privacy Statement.

We may also disclose relevant information to professional advisers, insurers, auditors, regulators, courts, law enforcement or another party involved in a sale, investment or reorganisation of our business. We do so only where necessary and with appropriate safeguards.

External websites linked from optymyse.com control their own data handling. Their privacy notices apply once you follow those links.

5. International transfers

Some providers operate internationally, so personal information may be processed outside the United Kingdom.

Where a provider processes personal information in a destination not covered by UK adequacy regulations, we assess the transfer and use an appropriate safeguard where required. This may include the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another lawful transfer mechanism. The provider documents linked above contain further information about their processing locations and transfer arrangements.

You can contact us for more information about the safeguard relevant to your information.

6. How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected. In deciding the period, we consider the nature of the relationship, contractual and support requirements, the sensitivity of the information, legal and accounting duties, limitation periods and whether a dispute or security incident is active.

In general:

enquiry, demonstration and meeting records are reviewed after the request has concluded and removed when there is no continuing business, contractual or legal need;
customer, order and support records are kept for the customer relationship and afterward for applicable tax, accounting, audit and legal-claims periods;
billing and transaction records are normally kept for at least six years from the end of the relevant financial year where tax or accounting law requires it, while Stripe and GoCardless apply their own regulatory retention duties to information they control;
marketing records are kept until you opt out or the information is no longer useful, while a minimal suppression record may be retained to honour an opt-out;
security and operational logs are normally kept for a short diagnostic period, but relevant records may be retained longer to investigate an incident or comply with law;
the Optymyse consent preference is kept in browser storage for up to one year;
optional campaign information in session storage is removed when the browser session ends; and
the principal HubSpot analytics cookies currently last for up to six months, with session cookies lasting for a session or 30 minutes. HubSpot’s linked cookie information contains the current list.

Backups and provider systems may retain limited copies for a further period before they are securely overwritten or deleted.

7. Cookies and browser storage

We use a small number of cookies and similar technologies:

omy_consent is stored as a cookie and in local storage for up to one year. It remembers whether you accepted or declined optional HubSpot analytics and stops us repeatedly asking the same question.
omy_utm_* values may be stored in session storage after consent. They remember campaign parameters until the browser session ends.
__hs_do_not_track may be set for up to six months if you withdraw consent after HubSpot analytics has loaded. It prevents further HubSpot tracking and is removed if you later accept optional tools again.
Cloudflare security and Turnstile may use strictly necessary cookies or short-lived browser signals when required to deliver and protect the website or verify a form submission.
Cloudflare Web Analytics is privacy-first, does not use cookies and, according to Cloudflare, does not collect or use visitors’ personal data.
HubSpot analytics loads only after consent. It may set __hstc and hubspotutk for up to six months, __hssc for 30 minutes and __hssrc for the browser session. HubSpot may update its technologies, so its linked cookie information is the definitive current list.

You can accept or decline optional technologies in the banner and change your decision at any time using Cookie settings in the website footer. Withdrawing consent does not affect processing that was lawful before withdrawal.

You can also delete cookies and local storage through your browser. Blocking strictly necessary security technology may stop a form or protected part of the site from working.

Stripe or GoCardless may use cookies and similar technologies on a checkout, mandate or account page that they operate. Their own notices and controls apply on those pages.

8. Your data protection rights

Depending on the circumstances, UK data protection law gives you the right to:

ask for access to your personal information;
ask us to correct inaccurate or incomplete information;
ask us to delete information;
ask us to restrict how information is used;
object to processing based on legitimate interests;
object at any time to direct marketing;
receive certain information in a portable format; and
withdraw consent at any time where processing relies on consent.

These rights are not absolute and an exemption may apply. We may need to verify your identity before acting on a request. We do not charge a fee in ordinary circumstances and will respond within the time required by law.

We do not use personal information to make solely automated decisions that have a legal or similarly significant effect. Turnstile makes an automated security assessment of form traffic, but an unsuccessful check can be bypassed by contacting us directly.

9. Security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure or access. Access is limited to people and providers who need the information for an authorised purpose.

No internet transmission or storage system can be guaranteed completely secure. Please contact us promptly if you believe information connected with Optymyse has been compromised.

10. Children

Our website and business services are intended for organisations and working professionals. They are not directed at children, and we do not knowingly collect children’s personal information through the website.

11. Complaints

Please send a data protection complaint to hello@optymyse.com or to our registered office. We will acknowledge it within 30 days, investigate it appropriately and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office. Details are available on the ICO website. We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the ICO.

12. Changes to this notice

We review this notice when our services, providers or legal obligations change. The date at the top shows when it was last updated. If a change materially affects how we use information already collected, we will provide an additional notice where required.