PRIVACY POLICY
Version 1.1 · 26 September 2026 · Bolutions LTD · effective from the date of publication
1. Introduction
Bolutions LTD, a company registered in England and Wales under company no. 16576182, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (hereinafter: “Bolutions”, “we”), provides an AI chatbot service for businesses and an accompanying platform on which their staff monitor and manage conversations (hereinafter: the “Platform”).
This Privacy Policy explains which personal data we process, why, on what basis, how long we keep them, to whom we disclose them and what rights you have.
It applies to three groups of persons:
- visitors to our website bolutions.agency;
- users of the Platform — employees and associates of our clients for whom an account has been opened, as well as the contact persons of our clients;
- persons who talk to the chatbot of one of our clients — on the client's website or via WhatsApp, Instagram or Messenger.
For the first two groups, we are the data controller. For the third group, the controller is the client whose chatbot it is, and we process the data only on its instructions (section 5).
In processing, we apply the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, in accordance with the Law on Personal Data Protection of the Republic of Serbia (Official Gazette of RS, No. 87/2018; hereinafter: the “ZZPL”), British regulations (the UK GDPR and the Data Protection Act 2018) and the EU General Data Protection Regulation (GDPR), where applicable.
2. Who the controller is and how to contact us
Bolutions LTD 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom Registered in England and Wales, company no. 16576182 Email: office@bolutions.agency · Telephone: +381 61 724 3379
Bolutions has not appointed a data protection officer. For all questions about privacy, write to office@bolutions.agency.
3. Visitors to the website bolutions.agency
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, telephone number and the content of the message that you send us through the contact form, by email or by telephone | To respond to your enquiry and prepare cooperation | Steps taken at your request prior to entering into a contract (Article 12(1)(2) ZZPL; Article 6(1)(b) GDPR) |
| Pages visited, duration of the visit, type of device and browser, approximate location | Visit statistics and improvement of the website | Your consent, given through the cookie banner (Article 12(1)(1) ZZPL; Article 6(1)(a) GDPR) |
| Name and email address that you leave when signing up for the “AI ponedeljak” list | Sending the “AI ponedeljak” series emails | Your consent, given by signing up (Article 12(1)(1) ZZPL; Article 6(1)(a) GDPR) |
| Technical data (IP address, time of access) | Security and correct operation of the website | Legitimate interest (Article 12(1)(6) ZZPL; Article 6(1)(f) GDPR) |
Analytics tools are switched on only when you click “Accept” on the banner. If you decline, the website works normally, without tracking. Details are in the Cookie Policy.
4. Users of the Platform and our clients
| Data | Purpose | Legal basis |
|---|---|---|
| First name and surname, business email, role and permissions, interface language | Opening and managing the account, access control | The legitimate interest of the client and of us that its staff use the Platform and that only authorised persons access it (Article 12(1)(6) ZZPL; Article 6(1)(f) GDPR) |
| Password (stored exclusively in hashed form with the authentication provider) | Logging in to the Platform | Legitimate interest |
| Audit log: who performed an action, which action, when and from which IP address (without the content of the modified data) | Security, detection of misuse, evidence of actions performed | Legitimate interest |
| Data of the client's contact persons, contracts, invoices and payments | Conclusion and performance of the contract, collection of payment | Performance of the contract; legal obligation |
| Correspondence with support and problem reports | Providing support | Performance of the contract; legitimate interest |
Accounts are not opened by self-registration — they are assigned by Bolutions or by the client's administrator.
Whether you have to provide data. Providing data is not a legal obligation. Without a name and contact details we cannot respond to an enquiry, without login details there is no account on the Platform, and without invoicing details we cannot conclude a contract.
5. Conversations with the chatbot of our clients
5.1. Who is responsible
When you talk to the chatbot of a company — on its website or via WhatsApp, Instagram or Messenger — the controller of your data is that company (our client). It determines why the conversation is conducted, what the bot may say and what is further done with your data. Bolutions is the processor: it processes the data exclusively on the client's instructions and on the basis of the data processing agreement it concludes with the client.
Address requests concerning your data (access, rectification, erasure) primarily to that company. If you do not know whom to contact, write to us — we will forward the request or carry it out on the client's instructions (section 10 and the “Data Deletion” page).
5.2. What data the Platform processes
- the content of the conversation — the messages you write, the bot's replies and the replies of the client's staff;
- data that you provide yourself in the conversation, for example your name, telephone number, email, delivery address or a description of what you need;
- files that you send, if the client has enabled that option (photographs and PDF documents, up to 10 MB);
- a random visitor identifier, by which the bot recognises that you are returning to the same conversation;
- the page on which you are chatting (address and title) and, after you have started using the chat, the paths and viewing times of other pages of the same site, so that the bot knows which product or service you are asking about;
- the language of your browser or the language you have chosen;
- data on arrival from Meta ads — the _fbc and _fbp markers, which are set by the client's Meta Pixel, and the fbclid parameter in the page address; when the page carries them, the chat sends them with the messages, and only the record from the first message of the conversation is kept;
- on WhatsApp, Instagram and Messenger — the telephone number or account identifier and the profile name that the network provides;
- technical data — the IP address, which is used only temporarily to limit the number of requests and may be found in the system logs of the hosting provider.
The bot does not ask for special categories of personal data (for example health data), unless the client is a healthcare institution that uses it for that purpose on its own legal basis. If you write such data yourself, they become part of the conversation. Please do not include in the conversation data that are not needed for your question.
5.3. How the bot replies
The bot is a program based on artificial intelligence (AI), not a person. Replies are composed by a large language model, to which the conversation, the instructions and knowledge prepared by the client, and the page you are viewing are sent. We currently use the Google Gemini model, exclusively at the paid service tier, in which Google does not use the data sent to it to train or improve its models. The bot's replies may be inaccurate or incomplete; for decisions that are important to you, check the information with the client's staff.
The client's staff may monitor the conversation and take it over. When this happens, you will receive a message in the chat window that someone from the team is joining you.
5.4. Analysis of completed conversations
If the client has enabled this option, after the conversation ends an AI model automatically records its outcome, the topics, the products mentioned and a short summary, so that the client can see which questions the bot answers successfully and which it does not. This analysis is not a decision about you and does not produce legal or similarly significant effects.
5.5. Meta channels
On WhatsApp, Instagram and Messenger, messages are transmitted by Meta Platforms Ireland Ltd., under its own terms and privacy policy. We receive and send messages on behalf of the client, only for accounts that the client has itself connected to the Platform.
5.6. Measuring the client's ads
If the client uses the Meta Pixel on its website and has enabled this in the Platform, the chat on its website reports the following moments to its pixel: opening the chat, the first message, contact details left, a click on call or WhatsApp and, when the bot confirms it, the placing of an order with the order amount. Neither the content of the conversation nor your contact details are sent. The pixel and the consent for it are managed by the client.
5.7. What we do not do
- we do not sell data and do not share them for advertising purposes;
- we do not use conversations to train AI models, nor the conversations of one client for the bot of another client;
- we do not create profiles of persons for advertising purposes;
- we do not make automated decisions that produce legal effects concerning you.
We may review the conversations of a particular client in order to improve that client's own bot (knowledge, instructions, test examples) and to correct errors — exclusively on that client's instructions.
6. To whom we disclose data
We do not sell data. We disclose them only to:
- service providers (subprocessors) who perform hosting, data storage, operation of AI models and background jobs for us — an up-to-date list, with the country of processing, is on the “List of Subprocessors” page (https://www.bolutions.agency/en/legal/subprocessors/);
- the client whose chatbot it is, and to systems that the client has itself chosen (its CRM, email, notifications for its staff);
- for our website and our correspondence — to the website hosting provider (Vercel), the email provider (Hostinger), the automation service provider (Make), through which messages from the contact form and sign-ups for the list reach us, and, only with your consent, to Google (Analytics);
- competent authorities, where required by law or by a binding decision.
Each subprocessor is contractually obliged to process data only for the provision of its service and with appropriate protective measures.
7. Transfer of data to other countries
Bolutions has its registered office in the United Kingdom. The Platform's databases are located in the European Union (Ireland and Germany), and the bot's server in the EU. The United Kingdom and the EU Member States are on the list of countries with an adequate level of protection referred to in Article 64 of the ZZPL, and the EU has adopted an adequacy decision for the United Kingdom.
Certain providers have their registered office in, or process data in, the United States of America — primarily the AI model provider (Google) and the parent companies of the hosting providers. The USA appears on the list of countries with an adequate level of protection referred to in Article 64 of the ZZPL only under the “Privacy Shield” framework, which has not been valid since 2020, so we do not rely on that list. For transfers to the USA, we rely on the standard contractual clauses that form part of the data processing agreements with those providers (with the addendum for the United Kingdom) and on their certification under the EU–US Data Privacy Framework, where it exists. The countries of processing for each provider are listed on the “List of Subprocessors” page. You may request a copy of these safeguards at office@bolutions.agency.
8. How long we keep data
| Data | Retention period |
|---|---|
| Conversation with the bot — messages, files sent, the model's working memory and the conversation analysis | 12 months from the last message, after which they are automatically deleted |
| Copy of the conversation in the Platform's inbox and notifications to staff about new messages | 12 months from the last message; it then disappears from the inbox, and is permanently deleted 14 days later |
| A conversation that the client's staff have deleted | disappears immediately from the inbox, and the copy in the bot's database is deleted in the same step (if that does not succeed at the time, at the latest on expiry of the 12-month period); it is permanently deleted from the inbox database 14 days later |
| Records of the bot's operation (technical traces of model calls) | 30 days |
| Daily message counters per visitor (identifier and number of messages) | 30 days |
| System logs of hosting providers | a limited period determined by the provider |
| Contacts, enquiry stages and notes that the client's staff keep in the Platform | until the client deletes them, and at the latest 30 days after the expiry of the period for exporting data following the termination of the contract |
| Accounts of users of the Platform | for as long as the contract with the client lasts or until the client removes the account |
| Audit log (with the email of the user who performed the action) | for as long as the contract with the client lasts; it is not deleted when an individual account is removed, as it serves as evidence of actions performed |
| Enquiries from our website and correspondence | up to 2 years from the last communication, unless the cooperation develops into a contract |
| Sign-up for the “AI ponedeljak” list | until you withdraw your consent |
| Contracts, invoices and accounting documentation | 6 years, in accordance with the regulations of the United Kingdom |
| Backup copies of databases, where they exist | until the end of the backup cycle of the database provider |
We also delete data earlier — at the request of the client or at your justified request.
Copies that the client has already received into its own systems (for example an enquiry forwarded to its CRM or to its email) are kept according to the client's rules, not according to this table.
9. How we protect data
- all traffic is encrypted (TLS/HTTPS);
- the data of each client are separated from the data of other clients; in the inbox database, this separation is enforced by the database itself (Row Level Security);
- the databases are not accessible via a public interface, and the database provider encrypts data at rest;
- access keys for clients' systems and connected accounts are stored encrypted;
- files are stored in private storage and are accessible only via time-limited links;
- the chat accepts messages only from websites that the client has approved, with a limit on the number of requests;
- accounts on the Platform are assigned, access is restricted by roles, and actions are recorded in an audit log that cannot be altered;
- testing of bots takes place in a separate environment that writes nothing into clients' systems, except where this has been expressly agreed with the client.
10. Your rights
In accordance with Articles 26–40 of the ZZPL and Articles 15–22 of the GDPR and the UK GDPR, respectively, you have the right to:
- request access to the data we process about you and a copy of them;
- request the rectification of inaccurate data or the completion of incomplete data;
- request the erasure of data;
- request the restriction of processing;
- object to processing based on legitimate interest;
- request data portability, where the conditions for this are met;
- withdraw your consent at any time, without affecting the lawfulness of processing before the withdrawal.
Send your request to office@bolutions.agency. We respond without delay, and at the latest within 30 days; this period may exceptionally be extended by a further 60 days, of which we will inform you. We may ask for information to verify that the request is really yours.
If the request relates to a conversation with the chatbot of one of our clients, we will forward it to that client and help it carry it out.
For none of the processing described in this Policy do we make automated decisions, including profiling, that produce legal effects concerning you or similarly significantly affect you.
11. Complaints
If you are not satisfied with the way we process your data, first write to us at office@bolutions.agency, marked “Complaint”. We acknowledge receipt of the complaint within 30 days and inform you of the outcome without undue delay.
You may also lodge a complaint with a supervisory authority:
- in the Republic of Serbia — the Commissioner for Information of Public Importance and Personal Data Protection (Serbia), Bulevar kralja Aleksandra 15, 11120 Beograd, office@poverenik.rs, www.poverenik.rs;
- in the United Kingdom — the Information Commission (formerly the Information Commissioner's Office), www.ico.org.uk;
- in the EU Member State in which you live — the competent data protection authority of that state.
12. Children
Our website and the Platform are not intended for children. We do not knowingly collect data of persons under the age of 15. If we learn that we have received such data, we will delete them.
13. Cookies
Cookies and similar technologies on our website, on the Platform and in the chat on clients' websites are covered by the Cookie Policy (https://www.bolutions.agency/en/cookie-policy/).
14. Changes
We amend this Policy when the way we process data changes, for example when we introduce a new service provider. The current version is always on this page, with the version number and date at the top. We notify clients of significant changes in advance.