Privacy Policy
mybizopz Ltd — Privacy Policy (Including Cookie Policy)
Version 1.0 — Effective Date: 4 April 2026
Company Number: 17125266
Registered Office: Suite 118, 21 Clarence Street, Staines-upon-Thames, TW18 4SU
1. Introduction
1.1 mybizopz Ltd (“the Company”, “we”, “us”, or “our”) is a company incorporated and registered in England and Wales under company number 17125266, with its registered office at Suite 118, 21 Clarence Street, Staines-upon-Thames, TW18 4SU. Obzimo is a product of mybizopz Ltd.
1.2 We operate the Obzimo platform (the “Platform”), an all-in-one cloud-based business management software-as-a-service solution for United Kingdom small and medium-sized enterprises, accessible via app.mybizopz.com and our associated websites, mobile applications, and APIs (collectively, the “Service”).
1.3 This Privacy Policy (including the Cookie Policy set out in Section 13) explains how we collect, use, store, share, and protect personal data when you: (a) visit our website at www.mybizopz.com (the “Website”); (b) register for and use the Platform; (c) communicate with us (including via email, telephone, or our built-in help and chat feature within the Platform); (d) receive marketing communications from us; or (e) otherwise interact with us in any capacity.
1.4 This Privacy Policy is issued in compliance with our obligations as a data controller under the UK General Data Protection Regulation (the “UK GDPR”), the Data Protection Act 2018 (the “DPA 2018”), and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”) (collectively, “Applicable Data Protection Law”).
1.5 For the purposes of Applicable Data Protection Law, the data controller is mybizopz Ltd. Our data protection point of contact can be reached at legal@mybizopz.com.
1.6 This Privacy Policy should be read in conjunction with our Terms and Conditions of Service, which include a Data Processing Addendum setting out the terms upon which we process personal data on behalf of our customers in our capacity as a data processor.
1.7 Important distinction regarding Controller and Processor roles: This Privacy Policy addresses our processing of personal data in our capacity as a data controller. Where we process personal data on behalf of our customers (for example, their employees’ records, National Insurance numbers, tax reference numbers, payroll and salary data, CRM contacts, invoicing data, and other business records submitted to the Platform by our customers), we act as a data processor on behalf of the customer (who is the data controller for that data). The terms governing that processing relationship are set out in the Data Processing Addendum within our Terms and Conditions of Service. If you are an employee or contact of one of our customers and have questions about how your personal data is processed within the Platform, you should direct your enquiry to your employer or the relevant Obzimo customer.
2. Definitions
2.1 In this Privacy Policy, unless the context otherwise requires:
“Personal Data” has the meaning given to it in the UK GDPR, being any information relating to an identified or identifiable natural person;
“Special Category Data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data (where processed to uniquely identify a natural person), data concerning health, or data concerning a natural person’s sex life or sexual orientation;
“Data Subject” means the identified or identifiable natural person to whom Personal Data relates;
“Processing” (and “Process”, “Processed”) has the meaning given to it in the UK GDPR;
“ICO” means the Information Commissioner’s Office, the United Kingdom’s supervisory authority for data protection;
“You” or “your” means any individual whose Personal Data we process in our capacity as a data controller, including website visitors, prospective customers, registered customers, account holders, billing contacts, recipients of marketing communications, and support correspondents.
3. Personal Data We Collect
3.1 We collect and process the following categories of Personal Data in our capacity as a data controller:
3.2 Information You Provide to Us Directly
(a) Account Registration Data: full name, email address, telephone number, business name, business address, VAT registration number (if applicable), and such other information as is required to set up and verify your Account;
(b) Billing and Payment Data: billing address and, through our payment processor Stripe, your payment card details or direct debit mandate information. We do not directly store full payment card numbers on our systems;
(c) Communications Data: the content of communications via email, telephone, or our built-in help and chat feature, together with your name, contact details, timestamps, and any attachments. Our help and chat feature is a proprietary system built into the Platform; all help and chat data is stored on our own infrastructure within the United Kingdom;
(d) Survey and Feedback Data: responses and any Personal Data contained therein if you participate in surveys, provide product feedback, or participate in beta testing programmes; and
(e) Marketing Preferences: email address, name, and communication preferences if you subscribe to our newsletter or marketing communications.
3.3 Information We Collect Automatically
(a) Technical and Device Data: IP address, browser type and version, operating system, device identifiers, screen resolution, and time zone setting;
(b) Usage and Log Data: pages and features visited, clickstream data, session duration, referring URLs, search queries, timestamps, error logs, and performance data;
(c) Analytics Data: we use Google Analytics and our proprietary in-house event tracking system to collect anonymised and pseudonymised data about user behaviour, feature adoption, and engagement patterns. Our in-house event tracking system is entirely proprietary, runs on our own infrastructure within the United Kingdom, and does not share data with any third party;
(d) Cookie Data: see Section 13 (Cookie Policy);
(e) Communication Metadata: whether emails were opened, which links were clicked, and the date and time of interaction; and
(f) Help and Chat Data: date and time of your interaction, the page or feature you were using, and technical context information to assist our support team.
3.4 Information We Receive from Third Parties
(a) Payment Processor Data: confirmation of payment status, transaction identifiers, and limited payment method details from Stripe; and
(b) Publicly Available Data: we may supplement Personal Data with information from business directories, Companies House, and social media profiles (such as LinkedIn), solely for the purposes of verifying business identity and enriching account records.
3.5 Public Booking Page Data
(a) Booking Submission Data: when a customer books an appointment through a public booking page (accessible at /book/{slug}), we collect: full name, email address, telephone number (optional), and any free-text notes provided. This data is encrypted at rest (AES-256-GCM) and stored within our UK-hosted infrastructure. The customer’s email address is also used to create or match a CRM contact record within the relevant business’s account.
(b) Booking Page View Analytics: we record non-personally-identifiable page view events (page identifier, timestamp, and the referrer domain only — e.g. “google.com”). No IP addresses, device fingerprints, or cookies are stored as part of booking page analytics.
(c) Cancellation Tokens: each booking generates an HMAC-based cancellation token, enabling the customer to cancel their appointment via a unique URL without requiring an account. These tokens contain no personal data and cannot be reversed to obtain the customer’s identity.
(d) Retention: booking submission data is retained for as long as the relevant business account is active on the Platform. If the business deletes the appointment record, the associated PII is redacted (replaced with “redacted”) and the row is soft-deleted. Booking page view analytics are retained for 90 days and automatically purged thereafter.
3.6 Special Category Data
We do not intentionally collect or process Special Category Data in our capacity as a data controller. If Special Category Data is inadvertently submitted, we shall process it only to the extent necessary to respond to your enquiry and shall delete it promptly thereafter unless retention is required by law.
3.7 Personal Data We Process as Processor (Not Covered by This Policy)
The Platform is designed to store and manage a wide range of sensitive personal data on behalf of our customers, including employees’ National Insurance numbers, HMRC tax reference numbers, PAYE tax codes, payroll and salary data, bank account details, leave and attendance records, performance review records, and other employment information. This data is processed by us solely as a data processor under the instructions of the relevant customer. This Privacy Policy does not govern the processing of such data.
4. Purposes of Processing and Lawful Bases
4.1 We process your Personal Data for the purposes and on the lawful bases set out below. Where we rely on legitimate interests, we have conducted a balancing assessment.
4.2 Performance of a Contract (Article 6(1)(b) UK GDPR)
We process your Personal Data where it is necessary for the performance of a contract, including: (a) creating and administering your Account; (b) providing the Service; (c) processing subscription payments through Stripe; (d) communicating about your Account; (e) providing customer support; and (f) fulfilling our obligations under the Terms and Conditions of Service.
4.3 Legitimate Interests (Article 6(1)(f) UK GDPR)
Our legitimate interests include: (a) service improvement and product development; (b) security and fraud prevention; (c) business operations; (d) direct marketing to existing customers (under the “soft opt-in” permitted under Regulation 22 of PECR); (e) customer relationship management; (f) help and chat quality improvement; (g) aggregated analytics and benchmarking; and (h) establishing, exercising, or defending legal claims.
4.4 Consent (Article 6(1)(a) UK GDPR)
We process your Personal Data on the basis of your consent where: (a) you subscribe to our marketing newsletter (where the soft opt-in does not apply); (b) we place non-essential cookies on your device; and (c) you provide us with Personal Data for a specific purpose for which consent is the appropriate lawful basis. You may withdraw consent at any time by contacting legal@mybizopz.com or using the unsubscribe mechanism in any marketing communication.
4.5 Legal Obligation (Article 6(1)(c) UK GDPR)
We process your Personal Data where necessary to comply with: (a) accounting and tax records requirements; (b) lawful requests from law enforcement or regulatory authorities; (c) anti-money laundering legislation and sanctions screening obligations; and (d) employment law and health and safety legislation in relation to our own employees.
5. Marketing Communications
5.1 We shall only send marketing communications where: (a) you have provided explicit, freely given, specific, informed, and unambiguous consent; or (b) you are an existing customer and the communication relates to similar products or services (the “soft opt-in” under Regulation 22 of PECR).
5.2 Every marketing communication shall include a clear mechanism for you to opt out.
5.3 Even if you opt out of marketing, we may continue to send non-marketing transactional and service-related communications.
5.4 We may use third-party email marketing platforms as data processors under our instructions.
6. Data Sharing and Disclosure
6.1 We do not sell, rent, or trade your Personal Data to third parties for their own marketing purposes.
6.2 Service Providers and Sub-processors
We engage trusted third-party service providers who process Personal Data on our behalf, including: (a) Amazon Web Services (AWS) — cloud infrastructure hosting (eu-west-2, London, United Kingdom); (b) Stripe — payment processing; (c) Google LLC (Google Analytics) — website analytics; (d) email service provider — delivery of email communications; and (e) other operational service providers as necessary. Our built-in help and chat feature is proprietary and operated entirely on our own infrastructure.
6.3 Professional Advisers
We may disclose your Personal Data to our professional advisers (including lawyers, accountants, auditors, bankers, and insurers) where necessary for the provision of their professional services.
6.4 Law Enforcement and Regulatory Authorities
We may disclose your Personal Data where required by law, regulation, or court order, or where necessary to protect our rights, property, or safety.
6.5 Corporate Transactions
In the event of a merger, acquisition, or other corporate transaction, your Personal Data may be transferred to the acquiring or successor entity, subject to appropriate data protection obligations.
6.6 Advertising and Remarketing Partners
Where you have consented to advertising and targeting cookies (see Section 13.3.4), certain Personal Data may be shared with third-party advertising platforms, including Google Ads, Meta (Facebook), and LinkedIn.
6.7 With Your Consent
We may share your Personal Data with third parties where you have given your explicit consent to such sharing.
7. International Data Transfers
7.1 Your Personal Data is primarily stored and processed within the United Kingdom on Amazon Web Services infrastructure in the London region (eu-west-2). Our proprietary in-house systems are hosted entirely within the United Kingdom.
7.2 Certain third-party service providers may process data outside the United Kingdom. Where Personal Data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place, including: (a) adequacy decisions; (b) the International Data Transfer Agreement (IDTA); or (c) the UK Addendum to the EU Standard Contractual Clauses.
7.3 Copies of the relevant transfer mechanism documentation are available upon request at legal@mybizopz.com.
7.4 We shall only transfer Personal Data outside the United Kingdom where we have verified compliance with Chapter V of the UK GDPR.
8. Data Retention
8.1 We retain your Personal Data only for as long as is necessary to fulfil the purposes for which it was collected, including for satisfying legal, regulatory, accounting, or reporting requirements.
8.2 The following retention periods apply:
| Category | Retention Period | Basis |
|---|---|---|
| Account registration data | Duration of Account plus 6 years | Contractual performance; limitation periods |
| Billing and payment data | Duration of Account plus 6 years after last transaction | Legal obligation (tax and accounting records) |
| Transactional invoices and receipts | 6 years from date of transaction | Legal obligation under Companies Act 2006 and VAT Act 1994 |
| Communications and support records (including help and chat) | 3 years from last communication | Legitimate interests (service improvement, dispute resolution) |
| Website analytics data (Google Analytics) | 26 months from collection | Legitimate interests (product improvement) |
| In-house event tracking data | 24 months, then irreversibly anonymised | Legitimate interests (product improvement) |
| Marketing consent records | Duration of consent plus 3 years | Legal obligation (demonstrating lawful consent) |
| Cookie data | As specified per cookie in Section 13 | Consent or legitimate interests |
| Advertising and remarketing data | As determined by third-party platform (typically 90 days) | Consent |
8.3 Upon expiry of the applicable retention period, we shall securely delete or irreversibly anonymise your Personal Data.
8.4 We may retain Personal Data for longer periods where required by law, subject to a legal hold, or necessary for legal claims.
9. Data Security
9.1 We take the security of your Personal Data seriously and have implemented appropriate technical and organisational measures in accordance with Article 32 of the UK GDPR.
9.2 Our security measures include: (a) encryption in transit using TLS 1.2 or above; (b) encryption at rest using AES-256; (c) hosting on AWS infrastructure in the United Kingdom; (d) all proprietary systems hosted within the United Kingdom; (e) daily automated backups with point-in-time recovery; (f) role-based access controls (RBAC); (g) multi-factor authentication for administrative access; (h) comprehensive logging and monitoring; (i) regular vulnerability scanning and penetration testing; (j) adherence to OWASP security best practices; (k) incident response procedures; and (l) security awareness training for all personnel with access to Personal Data.
9.3 No method of transmission over the internet or electronic storage is completely secure. You are responsible for keeping your Account credentials confidential.
10. Your Rights Under the UK GDPR
10.1 Under Applicable Data Protection Law, you have the following rights in relation to your Personal Data that we process as a data controller. These rights are not absolute and may be subject to exemptions.
10.2 Right of Access (Article 15)
You have the right to request confirmation as to whether we process your Personal Data and to obtain access to a copy of that data. We shall respond within one (1) calendar month.
10.3 Right to Rectification (Article 16)
You have the right to request that we correct any inaccurate Personal Data and complete any incomplete Personal Data without undue delay.
10.4 Right to Erasure (Article 17)
You have the right to request erasure of your Personal Data where: (a) it is no longer necessary; (b) you withdraw consent; (c) you object to the processing; (d) the data has been unlawfully processed; or (e) it must be erased for compliance with a legal obligation.
10.5 Right to Restriction of Processing (Article 18)
You have the right to request that we restrict the processing of your Personal Data in certain circumstances.
10.6 Right to Data Portability (Article 20)
You have the right to receive your Personal Data in a structured, commonly used, and machine-readable format (such as CSV or JSON) where processing is based on consent or contract and carried out by automated means.
10.7 Right to Object (Article 21)
(a) You have the right to object at any time to processing based on our legitimate interests. (b) You have the absolute right to object at any time to processing for direct marketing purposes.
10.8 Rights Relating to Automated Decision-Making (Article 22)
As at the date of this Privacy Policy, we do not make any decisions based solely on automated processing that produce legal effects or similarly significant effects.
10.9 Right to Withdraw Consent
Where we process your Personal Data on the basis of consent, you may withdraw consent at any time by: (a) using the unsubscribe link in any marketing email; (b) adjusting your cookie preferences; or (c) contacting legal@mybizopz.com.
10.10 How to Exercise Your Rights
To exercise any of your rights, please contact us at legal@mybizopz.com. We shall respond within one (1) calendar month. We shall not charge a fee unless the request is manifestly unfounded or excessive.
11. Children and Minors
11.1 The Service is not directed at, and we do not knowingly collect Personal Data from, children under the age of sixteen (16). No person under the age of eighteen (18) may register as a customer or account holder.
11.2 As set out in Section 4.7 of our Terms and Conditions, individuals aged sixteen (16) or seventeen (17) (“Minor Employees”) may be granted access to the Platform by their employer solely for the purpose of managing their work responsibilities. In such circumstances, the employer is the data controller, and we act as data processor.
11.3 If we become aware that we have inadvertently collected Personal Data from a child under sixteen (16), we shall take steps to delete such data as soon as reasonably practicable. If you believe that we may have collected Personal Data from a child under sixteen (16), please contact us immediately at legal@mybizopz.com.
12. Advertising, Remarketing, and Third-Party Tracking
12.1 We use third-party advertising and remarketing technologies, including: (a) Google Ads (including Google Remarketing) — opt out at Google’s Ads Settings; (b) Meta (Facebook) Pixel — manage preferences at Facebook Ad Preferences; and (c) LinkedIn Insight Tag — manage preferences at LinkedIn advertising settings.
12.2 Such processing is based on your consent and, where applicable, our legitimate interest in promoting our products and services.
12.3 You may opt out of interest-based advertising by: (a) adjusting your cookie preferences; (b) using platform-specific opt-out mechanisms; (c) installing the Google Analytics Opt-Out Browser Add-On; or (d) visiting the Digital Advertising Alliance opt-out page.
12.4 Opting out does not mean you will no longer see advertisements; it means they may be less relevant to your interests.
13. Cookie Policy
13.1 What Are Cookies
Cookies are small text files placed on your device by websites you visit. They may be “persistent” cookies (remaining until they expire or you delete them) or “session” cookies (deleted when you close your browser). We also use similar technologies, including web beacons, local storage, and JavaScript tracking.
13.2 Legal Basis and Scope
This Cookie Policy applies to our Platform (app.mybizopz.com), our promotional website (mybizopz.com), and all associated subdomains.
Under Regulation 6 of PECR, we obtain your consent before placing non-essential cookies on your device through our cookie consent banner. Strictly necessary cookies do not require consent.
13.3.1 Strictly Necessary Cookies
These cookies are essential for the operation of the Website and Platform and cannot be switched off.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| auth_token | mybizopz.com | Maintains your authenticated session (httpOnly JWT) | 30 days |
| mbo_consent | mybizopz.com | Stores your cookie consent preferences (status, categories, and timestamp as JSON) | 365 days |
| _sid | mybizopz.com | Session identifier for correlating analytics events within a single browser session | Session |
Lawful basis: Exempt from consent under Regulation 6(4) of PECR as strictly necessary.
13.3.2 Performance and Analytics Cookies
These cookies help us measure and improve the performance of our Website and Platform.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes unique users | 2 years |
| _ga_<ID> | Google Analytics | Maintains session state for GA4 | 2 years |
| _gid | Google Analytics | Distinguishes users within 24 hours | 24 hours |
| _gat | Google Analytics | Throttles request rate | 1 minute |
| mbo_evt | mybizopz.com | In-house event tracking for product improvement | 24 months |
| mbo_sess | mybizopz.com | In-house session analytics for product improvement | Session |
Lawful basis: Consent (via cookie consent banner). In-house analytics cookies (mbo_evt and mbo_sess) operate entirely on our own infrastructure and do not share data with any third party.
13.3.3 Functional Cookies
These cookies enable enhanced functionality and personalisation.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| mbo_prefs | mybizopz.com | Stores UI preferences (theme, sidebar, layout) | 12 months |
| mbo_locale | mybizopz.com | Language and regional format preferences | 12 months |
| mbo_tz | mybizopz.com | Detected time zone for correct date/time display | 12 months |
Lawful basis: Consent, except where strictly necessary for the provision of the Service.
13.3.4 Advertising and Targeting Cookies
These cookies may be used by our advertising partners to build a profile of your interests.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Google Ads | Advertising efficiency and conversion tracking | 90 days |
| _fbp | Meta (Facebook) | Facebook advertising delivery and measurement | 90 days |
| _fbc | Meta (Facebook) | Click identifier from Facebook ad click-throughs | 90 days |
| li_fat_id | LinkedIn advertising conversion tracking | 30 days | |
| UserMatchHistory | LinkedIn ad targeting synchronisation | 30 days |
Lawful basis: Consent (via cookie consent banner). You may withdraw consent at any time.
13.4 How We Use Cookies / Your Choices
13.4.1 When you first visit the Platform, a cookie consent banner is displayed at the bottom of the screen. The banner explains which cookie categories we use and provides two options: “Accept all” (enables analytics and marketing cookies) or “Reject all” (only strictly necessary cookies are placed). Your choice is recorded in the mbo_consent cookie as a JSON object containing your consent status, the categories you accepted or rejected, and a timestamp.
13.4.2 You can update your preferences at any time by navigating to Settings > Cookie consent within the Platform. The preference centre allows you to independently enable or disable analytics cookies and marketing cookies. Strictly necessary cookies cannot be disabled. When you save your preferences, the mbo_consent cookie is updated and your choice is also recorded server-side against your user account.
13.4.3 You may also manage cookies by adjusting your browser settings or deleting cookies from your device. If you choose to block or delete cookies, some features of the Platform may not function correctly.
13.5 Do Not Track Signals
At present, we do not respond to Do Not Track (DNT) signals as there is no universally accepted standard. You can manage your preferences using the tools described in this Privacy Policy.
13.6 Updates to This Cookie Policy
We may update this Cookie Policy from time to time. Where new categories of cookies are introduced, we shall obtain your consent before placing them on your device.
14. Third-Party Links and Websites
14.1 The Website and Platform may contain links to third-party websites. This Privacy Policy applies only to our processing of your Personal Data.
14.2 We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites.
15. Data Breach Notification
15.1 In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of natural persons, we shall notify the ICO without undue delay and, where feasible, within seventy-two (72) hours.
15.2 Where a breach is likely to result in a high risk, we shall communicate the breach to the affected Data Subjects without undue delay.
15.3 We maintain an internal data breach register recording all personal data breaches.
16. Changes to This Privacy Policy
16.1 We may update this Privacy Policy from time to time. The “Effective Date” at the top indicates when it was last revised.
16.2 Where we make material changes, we shall notify you by email and/or a prominent notice on the Website and/or within the Platform.
16.3 Your continued use of the Service after the effective date of a revised Privacy Policy constitutes your acknowledgement of the revised Privacy Policy.
17. Complaints and the Right to Lodge a Complaint
17.1 If you are dissatisfied with the way in which we have handled your Personal Data, we encourage you to contact us first at legal@mybizopz.com.
17.2 You have the right at any time to lodge a complaint with the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk
17.3 You are entitled to lodge a complaint with the ICO at any time without first contacting us.
18. Contact Information
18.1 If you have any questions, comments, or requests regarding this Privacy Policy, please contact us:
mybizopz Ltd
Suite 118, 21 Clarence Street, Staines-upon-Thames, TW18 4SU
Company Number: 17125266
Data Protection Contact Email: legal@mybizopz.com
Website: www.mybizopz.com
18.2 We do not have a designated Data Protection Officer (DPO) as we do not fall within the categories required to appoint a DPO under Article 37 of the UK GDPR. Our data protection point of contact is reachable at legal@mybizopz.com.
Version 1.0 — Effective 4 April 2026 — © 2026 mybizopz Ltd (Company No. 17125266). All rights reserved.