Privacy Policy
What personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it.
1. Who we are
Business Opt is a trading name of Business Opt L.L.C-FZ, a company registered in Meydan Free Zone, Dubai, United Arab Emirates, under licence number 2653102.01. We are the controller of the personal data described in this policy.
Registered office: Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E.
Email: admin@business-opt.com
This policy covers our website business-opt.com, our client portal at portal.business-opt.com, enquiries you make through our forms, adverts, email or WhatsApp, our newsletter, and the services we provide to clients.
When we handle personal data on a client's behalf, for example their customers' reviews or enquiries, we act as the client's processor under our Data Processing Agreement, and the client's own privacy policy applies to that data.
2. Personal data we collect
- Enquiries: your name, email address, phone number, business name, trade, area and website, and which page or advert brought you to us, such as campaign tags and the Facebook click identifier.
- Client accounts: your login email, business details, subscription and billing history. Card payments are taken by Stripe; we never see or store your full card number.
- Connected platforms: when you connect your Google Business Profile, Google Search Console, Google Ads, Facebook Page or Instagram account, we hold the account identifiers, the access tokens that let us work on them, which are encrypted before they are stored, and the data those platforms give us, such as performance figures, posts, and reviews with the reviewer's public name.
- Content you send us: photos, videos, documents and information for your website or social media, including anything you send us on WhatsApp.
- Communications: emails, WhatsApp messages and notes of calls with you.
- Newsletter: your email address and first name, and, through small tracking images and links in our emails, whether you open or click them. You can stop this by unsubscribing, or by turning off images in your email app.
- Website use: the data the Meta pixel collects about your visit (see section 9). Our hosting provider also records technical logs, such as IP address and browser type, to keep the site secure.
We do not ask for special category data, such as health or religious information. Please do not send it to us.
Where it comes from. Most of this data comes from you. We also receive it from Meta when you enquire through a Facebook or Instagram form, from the Google and Meta accounts you connect, from public sources such as your Google Business Profile, website and business directories, and from BrightLocal and DataForSEO, which supply search and directory data about businesses.
Do you have to give it? You do not have to give us any personal data, but we cannot answer an enquiry without a way to contact you, or provide our services without the information and access they need.
3. How we use your data and our lawful bases
| Purpose | Examples | Lawful basis |
|---|---|---|
| Answering enquiries | Preparing your free analysis, replying by email, phone or WhatsApp, sending a proposal | Legitimate interests, or steps you ask us to take before a contract |
| Providing our services | Managing your Google Business Profile, posting updates, replying to reviews, directory listings, reporting, adverts, social media and websites | Contract |
| Billing and accounts | Taking payments, invoices, tax and accounting records | Contract and legal obligation |
| Measuring and improving our adverts | The Meta pixel on our website; telling Meta that an enquiry was made or became a client | Legitimate interests, which you can object to at any time |
| Newsletter and marketing | Our newsletter, and occasional emails to clients about similar services | Consent, or legitimate interests for existing clients; you can unsubscribe at any time |
| Security and running the service | Access control, logs, preventing fraud and abuse, fixing faults | Legitimate interests |
| Legal matters | Meeting legal duties, dealing with disputes and claims | Legal obligation and legitimate interests |
Where we rely on legitimate interests, our interest is running and growing our business and serving our clients well, and we only do so where it does not override your rights.
4. AI and automated content
We use AI services to help write Google posts, review replies, social media captions and images, using the information about your business that you give us or that is public, and the text of reviews left for you. Our systems check this content before it is published, and you can ask us to change or remove anything at any time.
We do not make decisions about individuals that have legal or similarly significant effects on them by automated means alone.
5. Who we share your data with
We do not sell your personal data. We share it only with the providers that help us run our business, under contracts that limit what they can do with it:
| Provider | What they do for us |
|---|---|
| Vercel Inc. | Hosting for our website and client portal |
| Supabase Inc. | Database for the client portal, stored in Ireland |
| Stripe | Card payments and subscriptions |
| Resend | Sending account and service emails |
| Kit (ConvertKit) | Our newsletter |
| Web3Forms | Delivering website form submissions to our inbox |
| Meta Platforms Ireland Ltd and WhatsApp Ireland Ltd | Advert measurement, Facebook and Instagram lead forms, and WhatsApp messaging |
| Dualhook | Connecting our WhatsApp Business number to our systems |
| The Google platforms we manage for you, through their official interfaces | |
| Anthropic and OpenAI | AI services used to draft content and images |
| BrightLocal | Building and checking business directory listings |
| DataForSEO | Search and business listing data used for analyses and reports |
We may also share data with our professional advisers, with authorities where the law requires it, and with a buyer if our business is sold, who would be bound by this policy.
6. Meta, advertising and WhatsApp
Meta pixel. Our website uses the Meta pixel, which sets cookies so we can see which of our Facebook and Instagram adverts lead to visits and enquiries. For collecting this data and sending it to Meta, we and Meta Platforms Ireland Ltd are joint controllers under Meta's Controller Addendum: we are responsible for this notice, and Meta is responsible for its own processing afterwards, which is covered by Meta's Privacy Policy. You can use your rights with either of us, and you can block these cookies in your browser settings or limit ad tracking in your Facebook and Instagram ad preferences.
Enquiries from our website. When you send us an enquiry, we tell Meta that an enquiry was made, with your email address, phone number and name in hashed (scrambled) form, your IP address and browser details, so Meta can match it to the advert you saw. Lawful basis: legitimate interests; you can object at any time by emailing us.
Enquiries from Facebook and Instagram forms. If you enquire through a form on Facebook or Instagram, Meta already holds that enquiry. Using the reference Meta gave us, we tell Meta how it progressed, for example contacted or became a client, so our adverts reach people more likely to need us. We do not send Meta your contact details for this. You can object at any time by emailing us.
WhatsApp. If you give us a mobile number when you enquire, we may contact you about that enquiry on WhatsApp. If you send us photos or files on WhatsApp, we keep only a reference to each file until we have downloaded it for your work, and that reference is deleted within 30 days at most.
7. Where your data is stored and international transfers
We are based in the United Arab Emirates. Our client portal database is stored in Ireland, and some of our providers are based in, or process data in, the United States and other countries.
Where UK or EU data protection law requires it, we protect these transfers with the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or rely on the UK-US Data Bridge where the US recipient is certified under it. We also aim to meet the cross-border requirements of UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. You can ask us for details of the safeguards for a particular transfer.
8. How long we keep your data
| Data | How long |
|---|---|
| Enquiries that do not lead to work, including Facebook and Instagram form enquiries | Up to 24 months after our last contact |
| Your client account and our records of the work we did for you | While you are a client, then up to 12 months so we can hand things back or restart work |
| Personal data we handle for clients, such as their customers' reviews | As set out in our Data Processing Agreement |
| Emails, WhatsApp messages and call notes | While you are a client or an open enquiry, then as for the rows above |
| Hosting and security logs | Kept by our hosting providers for their standard periods, typically no more than 30 days |
| Access tokens for connected platforms | Until you disconnect the platform or your service ends |
| Invoices, payments and accounting records | 7 years, as tax law requires |
| WhatsApp file references | Until the file is downloaded, and never more than 30 days |
| Newsletter subscription | Until you unsubscribe |
| Meta pixel cookies | Up to 90 days |
When we no longer need data, we delete it or make it anonymous.
9. Cookies and similar technologies
Our website uses the cookies and similar technologies below. You can block or delete cookies in your browser settings at any time; the site still works without them.
| Name | Purpose | Type and duration |
|---|---|---|
| bo_attr_v1 | Remembers which advert you came from, so your enquiry is credited to it | Advertising, deleted when you close the tab |
| _fbp, _fbc | Meta pixel: measures visits and enquiries from our adverts | Advertising, up to 90 days |
| Client portal sign-in cookies | Keep you signed in to portal.business-opt.com | Strictly necessary, for your session |
The client portal also uses Vercel Web Analytics, which counts page views without cookies and without identifying you.
10. Your rights
Under the UK GDPR, and under UAE data protection law where it applies, you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict how we use it;
- object to our use of it, including an absolute right to object to direct marketing;
- receive data you gave us in a portable format;
- withdraw your consent at any time, where we rely on consent, without affecting what we did before.
Email admin@business-opt.com to use any of these rights. There is normally no charge. We reply within one month, which can be extended by two months for complex requests; if so, we will tell you why. We may need to confirm your identity first.
11. Complaints
If you are unhappy with how we have handled your data, please tell us first at admin@business-opt.com. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
If you are not satisfied, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the UAE Data Office for matters under UAE law.
12. Security
We protect personal data with encryption in transit, encryption of stored platform access tokens, access limited to the people and systems that need it, and monitoring for misuse. If a breach puts your rights at risk, we will tell you and the relevant regulator as the law requires.
13. Children
Our services are for businesses and are not aimed at anyone under 18. We do not knowingly collect children's personal data.
14. Changes to this policy
We will update this policy when our practices change and show the date at the top. If a change materially affects how we use clients' data, we will also tell clients by email before it takes effect.