GDPR
Effective date: July 30, 2026
Last updated: July 30, 2026
This page supplements our Privacy Policy for individuals in the European Economic Area (EEA), United Kingdom, and Switzerland. If anything here conflicts with the Privacy Policy for those individuals, this page controls on the conflict.
1. Controller
The controller of personal data processed through BCMS Cloud and thebcms.com is:
Becomes tech, LLC
1111b South Governors Avenue
Dover, DE 19904, United States
Phone: +1 (302) 487-8938
Email: legal@thebcms.com
We are a small US company. We have not appointed a Data Protection Officer or an EU/UK Article 27 representative. If we appoint either, we will update this page and the Privacy Policy.
2. Categories of personal data
Depending on how you use the Services, we process:
- Identity and contact data (name, email, avatar)
- Account and authentication data (OAuth IDs, session tokens)
- Billing metadata (plan, seats, Stripe customer references)
- Customer Content you store in BCMS projects
- Support, demo, careers, newsletter, and security communications
- Technical and usage data (IP address, device data, logs, analytics events)
Full details are in the Privacy Policy sections on collection and sharing.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provide the account, CMS workspace, APIs, and support needed to run your project | Contract (Art. 6(1)(b)) |
| Process subscriptions, invoices, failed payments, and refunds | Contract (Art. 6(1)(b)); legal obligation for tax/accounting where applicable (Art. 6(1)(c)) |
| Secure the Services, prevent abuse, and debug outages | Legitimate interests (Art. 6(1)(f)): operating a secure SaaS platform |
| Product analytics and improvement | Legitimate interests (Art. 6(1)(f)); consent where required for non-essential cookies/trackers (Art. 6(1)(a)) |
| Newsletter and optional marketing | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Respond to legal requests and enforce Terms | Legal obligation (Art. 6(1)(c)) and/or legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, you may object as described below. Where we rely on consent, you may withdraw consent without affecting prior lawful processing.
4. Recipients and processors
We use processors listed in the Privacy Policy (including Stripe, PostHog, Google Analytics, Customer.io, Mailjet, Crisp, Sentry, storage providers, OAuth providers, Typeform, and Calendly). They process personal data on our instructions for the stated purposes.
5. International transfers
Personal data is transferred to and processed in the United States, and may be processed in other countries where our providers operate. Where required, transfers rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or equivalent UK mechanisms, adequacy decisions, or other lawful transfer tools offered by providers. Contact legal@thebcms.com for more information.
6. Retention
We retain personal data only as long as needed for the purposes in the Privacy Policy, including account lifetime, billing and legal retention needs, and limited backup windows after deletion. If you need a specific retention detail for a category of data, ask us at legal@thebcms.com.
7. Your rights
Subject to GDPR/UK GDPR conditions and exceptions, you may have the right to:
- Access your personal data
- Rectify inaccurate data
- Erase data ("right to be forgotten")
- Restrict processing
- Data portability
- Object to processing based on legitimate interests
- Withdraw consent at any time
- Lodge a complaint with your local supervisory authority
We do not use solely automated decision-making that produces legal or similarly significant effects about you.
To exercise rights, email legal@thebcms.com. You may also delete your account in BCMS account settings. We will respond within the time required by law after verifying your request.
8. Cookies
Non-essential cookies and similar technologies require consent where ePrivacy/GDPR rules apply. See the Privacy Policy cookie section. Essential cookies needed for security and core functionality may be used without consent.
9. Children
The Services are not intended for children under 16. We do not knowingly process children’s data for the Services.
10. Contact
GDPR requests and questions: legal@thebcms.com.