1. Who we are

The data controller is the sole trader who carries on business under the name Butterfly Media and trades as WPFixit from Ireland. Butterfly Media is a business name registered with the Irish Companies Registration Office. It is not a company, and the business name is not itself the controller. This notice does not publish the controller's personal name.

WPFixit provides WordPress support, website maintenance, technical and development services, and related customer account and purchasing features. This notice explains how personal data may be processed in providing those services.

Where we process personal data contained on a customer’s website on that customer’s behalf, separate service arrangements may apply.

2. Information we process

Depending on how you interact with the website, relevant information can include:

  • Contact and account details provided by you, such as name, email address, billing contact details, and account identifiers.
  • Service, order, subscription, payment status, invoice and purchase records needed to administer the contract.
  • Messages, support inquiries, instructions, and technical issue descriptions you send to us.
  • Website URLs, authorized access information, and diagnostic material you provide for service delivery.
  • Technical information used to operate and secure the website, such as session identifiers, access logs, IP addresses, browser/device data, and security events, where actually collected.
  • Marketing preferences or communications, where you choose to receive them.
  • Cookie and similar-technology information as described in the Cookie Policy.

3. Why we use personal data and lawful bases

Depending on the actual processing activity, relevant purposes may include:

  • Providing contracted services: fulfilling orders, managing customer accounts and subscriptions, arranging website access, responding to service requests — typically where processing is necessary to perform a contract or take requested pre-contract steps.
  • Legal and financial records: keeping invoices and other records where required by law — compliance with legal obligations.
  • Security and service administration: protecting accounts, detecting misuse, and maintaining service continuity — potentially legitimate interests, assessed against individuals' rights.
  • Support communication: responding to questions and customer requests — contract or legitimate interests, depending on the context.
  • Optional marketing or non-essential tracking: where undertaken, subject to the appropriate legal basis, consent and direct-marketing rules.

4. Who receives information

Personal data may be shared with providers supporting our website, hosting, payment processing, email, customer support and security, where required to provide the relevant service. The providers used by this website are described below. The recipients and arrangements depend on the services you use.

We may disclose information if legally required or where necessary to protect legal rights, subject to applicable law.

Cloudflare — delivery and security

The website is delivered through Cloudflare. Cloudflare processes technical connection data, including IP address, to serve and protect the site. It sets a short-lived __cf_bm cookie for bot management. That cookie is not an analytics cookie and does not depend on the analytics choice. Details are in the Cookie Policy.

The public contact form loads Cloudflare Turnstile from `https://challenges.cloudflare.com`. Turnstile checks that the person using the form is submitting it. Our server sends Cloudflare the Turnstile result and, when it is available, the visitor's IP address, and receives a pass or fail result. Turnstile is a security control for the contact form. It is not used for advertising or analytics.

This processing is based on our legitimate interests in keeping the website and the contact form available and resistant to abuse, balanced against the individual's rights. Where you ask us to send a message, the check also supports that request.

Brevo — transactional email

Brevo transmits email. This website does not use Brevo for a marketing list.

  • Contact form. Your name, email address, topic and message, and any company or website you choose to add, are sent to Brevo so the message can be delivered to WPFixit support. Your email address is the reply address. This website does not keep its own copy of the enquiry after Brevo accepts it.
  • Website details after purchase. If you are signed in and send website details for an order, Brevo delivers them to WPFixit support. The message can include your name and email address, order and service identifiers, the website URL, the description of the work, page URLs, hosting-provider text, the access option you select, extra answers for that service, and up to three screenshots. The form does not ask for a password, API key or FTP credential. Your email address is the reply address.

This processing is necessary to perform a contract or to take steps you request before a contract. For a general enquiry that is not yet a contract, it is based on our legitimate interest in reading and answering the message you sent.

Stripe — card payments

When you pay by card, the card field is provided by Stripe. The card details are sent to Stripe, with the billing name, telephone number and address you enter. This website receives a payment reference. It does not store the full card number. If the card requires a further authentication step, Stripe and the card issuer handle that step.

This processing is necessary to perform the purchase contract.

Google Analytics 4 — optional measurement

Google Analytics 4 is optional and runs only with your consent. It is limited to public information pages and does not run on sign-in, checkout or customer-account pages. The measurement and how to withdraw consent are described in the Cookie Policy.

Accounts and orders

Customer accounts, orders and subscriptions are administered in our WordPress and WooCommerce service. Sign-in leaves this website for that authentication step and returns here afterwards. That processing is necessary to provide the account and the purchases you request.

5. International transfers

Where personal data is transferred internationally, applicable data protection requirements, including any required transfer safeguards, apply.

Cloudflare, Google and Stripe may process personal data outside the European Economic Area. Brevo is established in the European Union and may use providers in other countries. This notice does not state that a provider is certified under the EU-US Data Privacy Framework, or that a particular contract with that provider is in place. Those details are not recorded in this website.

6. Retention

We retain personal data only for the period necessary for the specified purpose and applicable legal, contractual and record-keeping requirements.

Accounts and orders. Account details are kept while the account is used to provide a service you requested. Order and subscription records are kept while needed to deliver the purchase, manage the service, and handle a related question or dispute. When that purpose has ended, they are removed unless a record still has to be kept for a legal duty.

Tax and financial records. Invoices, payment records and other financial records that Irish tax law requires us to keep are retained for six years, unless the law requires a longer or shorter period for a particular record.

Messages. This website does not keep its own copy of a contact enquiry after Brevo accepts the email. That website copy is separate from the copy Brevo holds in order to transmit the message, and from the copy in the support mailbox. The mailbox keeps a message while the enquiry is being handled. After the enquiry is closed, the mailbox keeps it only where it is still needed to follow up, to deal with a dispute, or to meet a legal duty, including the six-year period where the message is part of a tax or financial record. This notice does not give one date on which every mailbox message is deleted.

This browser. The analytics choice is stored only in your browser, for six months, as described in the Cookie Policy. It is not stored by Brevo or in the support mailbox. The signed-in session cookie does not last longer than the account credential, and never longer than 12 hours. The sign-in handshake cookie expires after 10 minutes. The Cloudflare __cf_bm cookie set on the public site expires 30 minutes after it is set.

Google Analytics events. How long Google Analytics keeps event data is a setting of that Google Analytics property. It is not set in this website, and this notice does not state that period.

7. Security

We use measures intended to protect personal data appropriate to the services provided and their risks. No internet service can guarantee absolute security.

8. Your privacy rights

Depending on the applicable law and circumstances, you may have rights to access, correct, erase or restrict personal data, receive portable data, object to certain processing, and withdraw consent where processing is based on consent. Some rights are subject to lawful exemptions or retention obligations. Contact support@wpfixit.org to make a request. You can also raise concerns with Ireland's Data Protection Commission or another competent supervisory authority as applicable.

9. Cookies and tracking

See our Cookie Policy for information about cookies and similar technologies.

10. Changes and contact

We may update this notice if our actual processing practices change. Material changes may be communicated where required by law. For questions contact support@wpfixit.org.