Privacy notice

Last updated: 27 October 2026.

Who we are. OPTIMIZE MANAGER LTD (company number 17545258) is the data controller for this website. Contact: hello@optimizemanager.com.

What we collect. Only what our forms ask for: name, work email, business details, phone (if you give it), the area you cover, and the answers you give our tools. While you're filling in a form, your answers — never your contact details — are saved as you go. That way a half-finished audit still shows us where the flow loses people. Once you've submitted a form, your contact details are also remembered on this device only (browser local storage) so the next form fills itself in. The copy never leaves the device until you submit again, and clearing site data removes it. When a link in one of our emails brings you here, a one-shot ping records which email link you followed (a short source slug, the page it landed on, and your browser family — no IP, no cookies). This tells us which emails actually help people. Initial Discovery answers are used to prepare your findings sheet. When you submit a form we also record where you arrived from — the referring page and any UTM campaign tags in the link you followed. This tells us which outreach actually works. We receive standard server logs (IP, user agent) via our hosting provider. Page-load performance is measured via Cloudflare Web Analytics — aggregate visits, timings and referrers with no cookies, no pixels and no fingerprinting.

Lawful basis — per purpose.
  • Enquiry, Initial Discovery and verification replies — contract, or steps before a contract, at your request.
  • Optional marketing emails and calls — consent (separate unticked boxes, never bundled with your report).
  • Server logs, Turnstile bot-checks and rate-limit keys — legitimate interest in keeping the site and forms secure.
  • Referrer and UTM attribution — legitimate interest in measuring our own marketing. Stored only against the submission it arrived with.
  • Email link telemetry (source slug + landing page + browser family) — legitimate interest in measuring our own emails. Contains no identifiers.
  • Page-load telemetry (Cloudflare Web Analytics) — legitimate interest in measuring site speed and reach. Cookieless and aggregate, it identifies no one.
  • Device-local form prefill — the copy lives only in your browser storage. You can clear it any time via your browser settings.
  • Data about a named third party in a verification request — legitimate interest in confirming who works with us, balanced by the Article 14 notice below.

Processors. This site is hosted on Cloudflare Pages. Form submissions are emailed to us via Resend and stored in our email mailbox (Migadu). Bot protection uses Cloudflare Turnstile. Cloudflare also stores short-lived rate-limit keys (a hashed client IP, ~1 hour TTL) in its KV store to throttle form floods. Each processes personal data on our behalf under its own terms. Site measurement uses Cloudflare Web Analytics — cookieless and aggregate. This site runs no advertising trackers. A current processor list is available on request.

International transfers. Some processors operate outside the UK. Where personal data is transferred internationally we rely on an appropriate safeguard (UK IDTA, the UK Addendum to EU SCCs, or an adequacy regulation). Our Sri Lanka delivery arrangements are governed the same way. Sri Lanka is not an adequacy country, so engagement contracts are designed to carry IDTA terms and a transfer risk assessment.

Data about you from others (Article 14). Our employment-verification form lets third parties (lenders, landlords, referees) name a person they want verified. Where we receive personal data about you from someone else we inform you within one month. This does not apply if you already know, or if an Article 14(5) exemption applies.

Retention. Enquiry and Initial Discovery data is kept for up to 24 months, then deleted unless an engagement begins. Engagement records are kept for the contract term plus the statutory limitation period.

What we never do. Sell your data, cold-call from a bought list, or send SMS unless you explicitly opt in.

Your rights. Access (a "subject access request"), correction, deletion, restriction, portability, objection — email us and it happens. You can withdraw consent at any time. Formal complaints: the Information Commissioner's Office (ico.org.uk).

A full data-processing schedule — including the IDTA schedule for delivery data — will be provided with every engagement agreement.