Data Protection Policy
How OptimAIze collects, uses and protects your personal data, and the rights you have under the GDPR.
Last updated: 11 September 2026
1. Introduction
The OptimAIze brand ("OptimAIze", "we", "us" or "our"), operated by Lex Machina, a consultancy firm, is committed to protecting your personal data and respecting your privacy. This Data Protection Policy explains how we collect, use, store and share personal data when you visit this website, contact us, subscribe to our newsletter, book an intro call, or engage our consultancy services.
It applies to data we process as a controller and reflects our obligations under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Bulgarian Personal Data Protection Act.
2. Data controller
The controller responsible for your personal data is OptimAIze:
- Registered entity: Lex Machina OOD (Лекс Макина ООД)
- Company registration number (EIK/UIC): 208529146
- Registered address: Dragoman 48 str., Bulgaria
- Contact: office@optimaize.pro
We have not appointed a statutory Data Protection Officer, as our CEO has extensive experience in data protection and privacy matters. The contact above handles all data protection queries.
3. Personal data we collect
We collect only the data we need:
- Contact and enquiry data: your name, email address, organisation, role and the contents of any message when you email us, complete a form, or book a call.
- Booking data: information needed to schedule and hold an intro call, which may be processed through a third-party scheduling/calendar tool.
- Newsletter data: your email address (and any name you provide) if you subscribe to our briefing. This is held in our email marketing platform, Klaviyo, together with a record of the emails we send you and whether you opened or clicked them.
- Onsite behaviour data (only with your consent): if you allow the Marketing category in our cookie banner, Klaviyo records which pages of this site you viewed and when, linked to an identifier stored on your device. If you also subscribe to the briefing, that browsing history is connected to your subscriber profile so we can send more relevant content. If you decline, none of this is collected. Full detail is in our Cookie Policy.
- Engagement data: information you and your organisation share with us during a consultancy engagement, which may include documents and details about your business processes and systems. This is governed primarily by the engagement agreement and, where we process data on your behalf, a data processing agreement.
- Technical data: limited information your browser sends when loading the site (e.g. IP address, device and browser type), and the local-storage preferences described in our Cookie Policy.
We do not intentionally collect special categories of personal data through this website, and ask that you do not send us such data unprompted.
4. How and why we use your data (purposes and legal bases)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to your enquiries and providing requested information | Legitimate interests (Art. 6(1)(f)), to communicate with people who contact us |
| Arranging and holding intro calls; preparing proposals | Steps prior to entering a contract (Art. 6(1)(b)) |
| Delivering contracted consultancy services | Performance of a contract (Art. 6(1)(b)) |
| Sending our newsletter / briefing | Consent (Art. 6(1)(a)), you may withdraw it at any time |
| Onsite tracking of the pages you view, to tailor the briefing to your interests | Consent (Art. 6(1)(a)), given per category through our cookie banner and withdrawable at any time via Cookie settings |
| Operating, securing and improving the website | Legitimate interests (Art. 6(1)(f)), running a safe, functional site |
| Complying with legal, accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have considered and balanced those interests against your rights and freedoms.
5. Newsletter subscription: the consent you give, and how to withdraw it
Subscribing to the OptimAIze Briefing is a separate matter from the cookie banner. It has its own legal basis, its own record, and its own withdrawal route.
What you are consenting to. When you enter your email address in the signup form and press Subscribe, you are consenting to receive the OptimAIze Briefing — roughly one email a month containing practical AI use cases, compliance deadlines and tool recommendations, at that address. The form is dedicated to that single purpose, and pressing Subscribe is the clear affirmative act by which consent is given. We do not pre-tick anything, we do not bundle this consent with any other permission, and subscribing is never a condition of using the site, booking a call, or engaging us as a client.
Legal basis. Your consent, under Article 6(1)(a) GDPR, read with Article 13 of the ePrivacy Directive and the corresponding provisions of the Bulgarian Electronic Commerce Act on unsolicited commercial communications.
What we do with the address. It is sent to Klaviyo and added to our "OptimAIze Briefing" list, tagged with the source "Website newsletter form" so that we can show where and when the consent was obtained, as Article 7(1) GDPR requires. We use the address to send the Briefing and nothing else. We do not sell it, rent it, or pass it to any third party other than Klaviyo acting as our processor. The form also carries a hidden anti-spam field and a minimum completion time; these are checked in your browser and are used solely to reject automated submissions.
Subscribing does not switch on tracking. If you have refused the Marketing cookie category, subscribing to the newsletter does not override that refusal. Your browser is not linked to your subscriber profile, and your onsite behaviour is not recorded. You receive the newsletter, not a browsing history. The reverse is equally true: accepting the Marketing category does not subscribe you to anything.
How to withdraw your consent. You may withdraw at any time, with no reason given and no consequence, by any of the following routes, each of which is equally effective:
- Click the unsubscribe link in the footer of any Briefing email. This takes effect immediately and is the fastest route.
- Email office@optimaize.pro asking to be removed. We will action it without undue delay and in any event within one month.
- Reply "unsubscribe" to any Briefing email.
Withdrawing is as easy as giving consent: no account, no password and no login is required, and we will not ask you to explain yourself or route you through a retention offer.
What happens after you withdraw. We stop sending the Briefing. Withdrawal does not affect the lawfulness of anything we sent before you withdrew. Your address is retained in Klaviyo in suppressed form, so that we can honour the withdrawal and demonstrate that it was honoured; this is the record-keeping basis recognised under Article 5(1)(e) and Article 7(1) GDPR, and it is what stops the address being re-added by a later import. If you would prefer the record erased entirely rather than suppressed, write to office@optimaize.pro and say so, and we will erase it. You should know that doing so removes the very record that keeps you off the list.
Your other rights. Access, rectification, erasure, restriction, portability and objection apply to your subscriber record as they do to any other personal data we hold. Section 10 of this policy explains how to exercise them, and you may lodge a complaint with the Bulgarian Commission for Personal Data Protection.
6. Sharing your data
We do not sell your personal data, and we do not share it with advertisers. We share it only where necessary with:
- service providers who process data on our behalf under appropriate contracts. The ones that handle personal data from this website are Klaviyo, Inc. (email marketing, newsletter delivery and, where you have consented, onsite tracking) and Calendly LLC (scheduling the intro call) and Usercentrics A/S (Cookiebot — the consent banner and the record of your consent decision), alongside our email and IT hosting providers. The other third-party services this site loads are described in our Cookie Policy;
- professional advisers (such as accountants, lawyers, IT personnel) where reasonably required or explicitly contracted with you;
- public authorities or regulators where we are legally obliged to do so.
7. International transfers
Some of our service providers process data outside the European Economic Area. In particular, Klaviyo and Calendly are established in the United States, so newsletter and booking data, and any onsite behaviour data you have consented to, is transferred there.
Where this happens, we ensure an appropriate safeguard under Chapter V of the GDPR is in place, such as an adequacy decision of the European Commission (including the EU–US Data Privacy Framework, where the provider is certified) or Standard Contractual Clauses, together with any supplementary measures required, so that your data continues to receive an essentially equivalent level of protection.
8. How long we keep it
We retain personal data only for as long as necessary for the purposes for which it was collected:
- enquiry and intro-call data that does not lead to an engagement, typically up to 12 months;
- newsletter data, until you unsubscribe, after which we keep a minimal suppression record so we do not email you again by mistake;
- onsite behaviour data, for up to 12 months, or until you withdraw consent or ask us to delete it, whichever comes first;
- engagement and contract records, for the duration of the engagement and for the period required by law (including accounting and limitation periods) afterwards.
When data is no longer needed, we securely delete or anonymise it.
9. How we protect your data
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or misuse, including access controls, encryption in transit where supported, and limiting access to those who need it. Reflecting our own consultancy practice, data protection and security are considered by design in the tools and processes we adopt.
10. Your rights
Subject to the conditions in the GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased ("right to be forgotten");
- restrict or object to certain processing, including processing based on legitimate interests;
- data portability;
- withdraw consent at any time, without affecting processing carried out before withdrawal.
To exercise any of these rights, contact us at office@optimaize.pro. We will respond within one month, as required by the GDPR.
Two of these you can act on immediately, without contacting us: every email we send carries an unsubscribe link, and you can withdraw or grant consent to onsite tracking at any time via Cookie settings, available in the footer of every page.
11. Complaints
If you believe we have not handled your personal data properly, we would welcome the chance to resolve it directly. You also have the right to lodge a complaint with the Bulgarian supervisory authority, the Commission for Personal Data Protection (Комисия за защита на личните данни), www.cpdp.bg, or with the data protection authority in your country of residence.
12. Changes to this policy
We may update this Data Protection Policy from time to time. The "Last updated" date above indicates when it was last revised, and we encourage you to review it periodically.
13. Contact
Requests or questions regarding your personal data can be sent to office@optimaize.pro.
Questions about your data?
Get in touch and we'll be happy to explain how your information is handled.
Book a call