1. About this policy
This policy explains how personal data is handled by the provider of MAKE ME WEB — MAKE ME DIGITAL, currently operated by an individual trader under their existing personal legal and tax registration in Lithuania (see the Terms of Service, Section 1.1, and our Legal Notice at /imprint for the full identity) (“we”, “us”).
No separate EU/UK representative under Art. 27 GDPR is required, since the controller is established in the EU. No Data Protection Officer is required or appointed at this time, given the scale and nature of processing (the Art. 37 GDPR mandatory-DPO thresholds are not met). Both of these are reviewed periodically as the business grows.
Because the operator is currently established in the EU, this draft is written to the standard of the EU General Data Protection Regulation (GDPR), regardless of the market the service is sold into. Counsel must confirm which regimes apply and adjust accordingly.
2. Who we handle data about
- Site visitors — people who browse
makemedigital.online. - Customers and prospects — people who contact us or subscribe.
- End users of customer websites — visitors to the websites we host and manage for customers. For that data we generally act as a processor on the customer’s instructions; the customer is the controller. The full data-processing terms for this split are in the Service Agreement.
3. What we collect and why
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Contact data | name, email, company, message | to answer enquiries and manage the relationship | Consent, or steps taken at your request prior to entering a contract (Art. 6(1)(a)/(b) GDPR) |
| Account & billing data | plan, contract term, payment method reference, invoices | to provide and bill the service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Technical data | IP address, device/browser, pages viewed, timestamps | to run, secure and monitor the service | Legitimate interests — operating and securing the service (Art. 6(1)(f) GDPR) |
| Support data | correspondence, change requests | to provide support | Performance of a contract (Art. 6(1)(b) GDPR) |
| Email service data | mailbox contents and metadata for hosted business email | to operate the mailbox service on the customer’s behalf | processor, on customer instructions |
| AI conversation data | the text a visitor types to our AI sales advisor, the advisor’s replies, the language, the time and the outcome of the conversation (for example, the plan recommended or a checkout opened) | to answer the visitor’s questions and help choose a plan; and to continuously improve and train our AI services, as described in §3.1 | Legitimate interests — answering the visitor’s own question and continuously improving our service (Art. 6(1)(f) GDPR) |
| Analytics/advertising data | pages viewed, structured interaction events (e.g. which product you viewed), advertising identifiers where applicable | to measure and improve the site and, where used, advertising performance | Consent (Art. 6(1)(a) GDPR) — only collected if you accept in the Cookiebot banner |
We do not sell personal data. We do not use it for advertising profiling. The AI sales advisor is live for visitors who choose to use it — see §5 and §6.
3.1 AI conversations and continuous improvement
We keep the conversations held with our AI sales advisor and with the MAKE ME AI assistants we operate for our customers, and we use them to improve those assistants continuously. We look at where an answer was unclear, incomplete or unhelpful, and we adjust the assistant’s instructions and approved knowledge and, where the customer chooses, the AI model it runs on. The aim is that every next visitor is served better than the last.
- Each customer’s conversations improve that customer’s assistant, for that customer’s own benefit. They are never shown to another customer and never used to answer another customer’s visitors.
- Our common methods for all assistants improve only from insights drawn from many conversations in an aggregated form that identifies no person and no customer.
- The review is automated. It is carried out by MMD AI and MAKE ME AI. It never makes a decision about the visitor.
- Visitors are told before the conversation starts that it is saved to improve the service. Please do not share sensitive personal information in a chat.
For conversations with a customer’s MAKE ME AI assistant, we act on that customer’s instructions (§10).
4. Cookies and analytics
This site uses Google Tag Manager (GTM) to load measurement tags — currently Google Analytics 4 and, where configured, Google Ads — and Cookiebot, a consent management platform, to ask for your choice before any of them can set a cookie or store data about you.
On your first visit, every category of non-essential storage
(analytics_storage, ad_storage, ad_user_data, ad_personalization,
functionality_storage, personalization_storage) defaults to denied
for everyone, everywhere — no regional assumption is made. Nothing is
measured, and no cookie beyond what is strictly necessary is set, until you
make an active choice in the Cookiebot banner. You can change that choice at
any time from the same banner.
Independently of this, our own guided product assistant and AI sales advisor
run entirely in the browser’s memory for that visit and never set a cookie
or read/write localStorage themselves; the structured, PII-free interaction
events they and the rest of the site push to the browser’s internal
dataLayer (for example, which product a visitor viewed) reach Google only
if, and to the extent, you have consented — see §5 for what receives data
and §6 for the transfer safeguard. Customer websites we build may set their
own cookies depending on what is built for them; this section covers this
marketing site only.
5. Sharing and sub-processors
We share personal data only with:
- infrastructure and email providers that host the service (available on request via the sub-processor list below);
- Stripe (Stripe, Inc. and its group companies) as our payment processor for billing — see Stripe’s own privacy policy at https://stripe.com/privacy;
- Cookiebot (Cybot A/S, Denmark — EU-established) as our consent management platform, which records the choice you make in its banner; see https://www.cookiebot.com/en/privacy-policy/;
- Google (Google Ireland Limited / Google LLC), for Google Tag Manager, Google Analytics 4 and, where configured, Google Ads — only to the extent you have consented via the Cookiebot banner (§4); see https://policies.google.com/privacy;
- AI models — MMD AI and MAKE ME AI use third-party AI models, which process the text of a conversation outside the EU, with the safeguards of the GDPR (§6). The visitor is told before the conversation starts that they are talking to an automated assistant, not a person, and that the conversation is saved;
- professional advisers and authorities where the law requires.
A current list of sub-processors is available on request via contactme@makemedigital.online.
6. International transfers
Where personal data is transferred outside the EU/EEA — currently to the United States (Stripe; Google, where you have consented) and, for the AI models that process AI conversations (§5), to other countries outside the EU/EEA — we rely on Standard Contractual Clauses or another lawful Art. 46 GDPR transfer mechanism for each transfer. Cookiebot itself is EU-established and does not transfer your consent choice outside the EU/EEA.
7. Retention
We keep personal data only as long as needed for the purpose it was collected for, then delete or anonymise it:
- Enquiries and contact data — 12 months from your last contact with us, unless you subscribe.
- Account and billing/invoice records — for as long as required by Lithuanian tax and accounting law.
- Technical/log data — 90 days.
- Support correspondence — for the life of your subscription, then 12 months.
- AI conversation data — conversations with our own AI sales advisor: for as long as we offer the advisor. Conversations with a customer’s MAKE ME AI assistant: for as long as that customer keeps MAKE ME AI. They are then included in the customer’s data package and deleted.
- Backups — kept for a limited rolling window as part of the standard hosting configuration, then overwritten.
8. Security
We apply tenant isolation, least-privilege access, multi-factor authentication, managed secrets, patching, monitoring and external backups with tested restores, and we have a documented incident-response and rollback process. If a personal data breach is likely to result in a risk to people, we notify the relevant supervisory authority and, where required, affected individuals.
9. Your rights
Subject to the applicable law, you may ask us to give you access to your personal data, correct it, delete it, restrict or object to its processing, or provide it in a portable form, and you may withdraw consent where processing relied on consent.
To exercise a right, or for any privacy question, contact contactme@makemedigital.online.
You may also complain to a data protection supervisory authority — the lead authority for the controller is Lithuania’s State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI), https://vdai.lrv.lt, or your own country’s authority if you are elsewhere in the EU.
10. Data we process for customers (processor terms)
Where we host and manage a website or mailboxes for a customer, we process the personal data of that customer’s end users only on the customer’s documented instructions, keep it confidential, apply the security measures above, assist the customer with data-subject requests and breach handling, and delete or return it at the end of the service. For MAKE ME AI, the customer’s instructions include keeping the conversations of its assistant for as long as it subscribes and using them to improve and train that assistant for the customer’s benefit (§3.1; Terms of Service, Section 18.8). The full data-processing terms are in the Service Agreement.
11. Changes
We update this policy as the service and the law change. For a material change we notify subscribers by email at least 30 days before it takes effect, consistent with the Terms of Service. The “last updated” date at the top of the page always reflects the current version.
12. Contact
MAKE ME DIGITAL — see our Legal Notice (/imprint) for full identity · contactme@makemedigital.online