Privacy Statement

1. Personal Data We Process & How It Is Collected

rightWFM Ltd. processes personal data that you provide voluntarily when interacting with our website or booking tools, as well as technical data generated during your visit:

• Stage 1 — Commercial Enquiry & Qualification: When you complete the qualification form and select “Continue to choose a date and time”, your responses are transmitted to rightWFM via our form processor (Formspree, Inc.). This transmission occurs at Step 1, regardless of whether you subsequently select a time on the calendar. Collected data includes your name, work email address, organisation name, preferred consultant, and any optional operational details you provide (operating scope, workforce scale, current WFM tooling, and notes).
• Stage 2 — Consultation Scheduling: When Step 2 loads, our embedded calendar provider (Cal.com, Inc.) receives your pre-filled name and business email, together with your IP address and standard browser connection information, even if you do not complete a booking. If you book an appointment, Cal.com also processes your chosen date, time, time zone, and booking details.
• Technical Connection Data: When you browse our website, our edge hosting provider (Cloudflare, Inc.) automatically processes technical request telemetry (including IP address, browser type, and request headers) strictly to deliver the website, balance traffic, and defend against malicious requests.

Fields marked as required (organisation, name, work email, and preferred consultant) are needed for us to respond to your enquiry and arrange a call. You are under no statutory obligation to provide them, but without them we cannot process your request; you may alternatively email us directly at [email protected].

2. Purposes & Lawful Bases for Processing

Under Article 6 of the EU GDPR and UK GDPR, rightWFM processes personal data under the following lawful bases:

• Legitimate Interests (Article 6(1)(f) GDPR) — Qualifying & Responding to Enquiries: We process corporate business contact details and submitted operational context under our legitimate commercial interests in evaluating prospective client requirements, preparing for diagnostic consultations, and allocating senior consulting resources effectively.
• Performance of Pre-Contractual Steps (Article 6(1)(b) GDPR): Where an individual enquirer acts in a personal capacity or as a sole trader, processing is conducted to take pre-contractual steps at their direct request prior to entering into a formal agreement.
• Legitimate Interests (Article 6(1)(f) GDPR) — Website Security: Processing transient edge network logs to protect our website against automated abuse, denial-of-service attacks, and technical vulnerabilities.
• Compliance with Legal Obligations (Article 6(1)(c) GDPR): Retaining commercial contracts, accounting ledgers, and tax invoices in accordance with applicable Bulgarian statutory legislation.

3. Service Providers & International Transfers

We do not sell prospect data or share it with third parties for their own commercial marketing. We share personal data strictly with the infrastructure providers necessary to operate our website, handle enquiries, and conduct consulting communications:

• Formspree, Inc. (USA): Captures Stage 1 qualification responses and routes notification emails to our consulting inbox.
• Cal.com, Inc. (USA): Delivers the embedded calendar interface for booking and managing diagnostic consultation appointments.
• Microsoft Corporation (USA / Ireland): Provides corporate email mailboxes (Exchange Online) and video teleconferencing (Microsoft Teams). We do not record, transcribe, or run automated AI meeting summaries on introductory diagnostic calls.
• Cloudflare, Inc. (USA): Provides edge content delivery, static web hosting (Cloudflare Pages), DNS resolution, and network security.

International Data Transfers (Chapter V GDPR): Where our service providers process personal data in the United States, processing is governed by standard commercial data protection terms incorporating European Commission Standard Contractual Clauses (SCCs) or active certifications under the EU-U.S. Data Privacy Framework (DPF) and UK Extension. You can request a copy of the relevant safeguards by contacting [email protected].

4. Cookies & Browser Storage

rightWFM adheres to a strict privacy-by-design approach:

• Zero Tracking or Advertising Cookies on rightwfm.com: We do not deploy marketing cookies, social media tracking pixels, or cross-site profiling scripts on our website.
• Temporary Session Storage (sessionStorage): When you interact with our qualification form, temporary technical storage is held within your browser tab session solely to preserve your entered form responses between Step 1 and Step 2 so you can review or edit without losing data. Session data is automatically cleared upon confirmed booking, when you click “Start new enquiry”, or normally when you close the browser tab (unless browser tab restoration is enabled).
• Embedded Calendar Cookies: The embedded Cal.com calendar may set its own strictly necessary technical cookies and storage for scheduling functionality, fraud prevention, and session security; see Cal.com’s Privacy Policy.
• No Persistent Local Storage: rightWFM does not write persistent localStorage items to your device.

5. Data Retention & Deletion

Personal data is retained only for as long as necessary to fulfil the operational, commercial, and statutory purposes for which it was collected:

• Enquiries & Non-Client Consultation Notes: Qualification responses and manual notes taken during introductory diagnostic calls that do not proceed to a commercial engagement are retained for 12 months following the last interaction, and purged on a regular monthly review cycle overseen by Lars Hollatz.
• Client Operational Records: Where an enquiry leads to a commercial consulting engagement, relevant project documentation and correspondence are retained for the duration of the engagement plus 5 years following contract termination, aligned with the general statutory limitation period under Article 110 of the Bulgarian Obligations and Contracts Act.
• Statutory Accounting & Tax Documentation: Commercial invoicing and financial registers are retained for 5 to 10 years pursuant to statutory requirements under the Bulgarian Accountancy Act and Tax and Social Insurance Procedure Code.

6. Your Statutory Rights Under GDPR

Under the EU GDPR and UK GDPR, you have the following rights regarding your personal data:

• Right of Access & Rectification: Request confirmation of what personal data we hold about you and request correction of inaccurate records.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where retention is no longer justified.
• Right to Restriction & Objection: Object to processing based on legitimate interests or request temporary restriction of processing.
• Right to Data Portability: Request transmission of your provided data in a structured, machine-readable format.
• Right to Lodge a Complaint: You have the statutory right to lodge a complaint with the Commission for Personal Data Protection in Bulgaria (CPDP / КЗЛД, cpdp.bg) or, in the United Kingdom, the Information Commissioner’s Office (ICO, ico.org.uk), or your local European supervisory authority.

To exercise any of these rights, contact us at [email protected]. We respond to verified requests within one calendar month.

7. Technical Security Measures

We implement appropriate technical and organisational safeguards to protect personal data against unauthorised access, alteration, disclosure, or loss:

• Full HTTPS encryption enforced across all website traffic;
• Restricted, multi-factor authenticated access to consulting mailboxes and Formspree submission dashboards; and
• Strict data minimisation on embedded booking forms, collecting only the details necessary to schedule and conduct the requested meeting.

If you have any questions about this Privacy Statement or our data practices, please contact Lars Hollatz at [email protected].