Privacy Notice

1. bolttech Privacy Notice

This Privacy Notice (“Notice“) describes how bolttech and its affiliates (collectively referred to as “bolttech“, “we“, “us” or “our“) collect, use and share personal data in the context of our websites, business contacts, suppliers, employment candidates, (together referred to as “you” or “your“) or otherwise for the purposes of conducting or developing business relationships with you. This Notice also explains your ability to edit, update, correct, or delete your personal data, and the security procedures that we have implemented to protect personal data in line with relevant data protection legislation.

In this Notice, you can find out more about:

How we collect personal data, the types of personal data we collect and the purposes for which personal data is collected
Direct marketing and how you can manage your marketing preferences
How we share information within bolttech and with our service providers, regulators and other third parties
International transfers of personal data
Cookies and third-party links
How we store and protect personal data
Your rights, how to assert those rights
Modifications to this Notice
How you can contact us for more information

2. Who is responsible for your personal data

The bolttech entity responsible for your personal data will be the member of bolttech group that originally collects information from or about you. This is explained in the privacy notice made available when your personal data are first collected by that bolttech entity (the “Specific Notice”), for example where you or the business you work for engages us to provide a service. If there is any conflict between the Specific Notice and this Notice, the Specific Notice prevails.

For personal data collected through the contact forms on this website, or where you are providing information through our Careers site, the data controller will be the bolttech entity that is collecting your information. For example, the bolttech entity that is managing the sales process for your location or the bolttech entity that is hiring for the position that you have applied for.

A list of locations and contact information for bolttech data controller entities can be found in the “Our worldwide office locations” section of our website: https://bolttech.io/contact-us. You can also find out more by contacting us in the How to contact us section.

3. When we collect personal data, the types of personal data we collect and the purposes for which personal data is collected

In this section, you can find out more about:

When we collect personal data
The types of personal data we collect and how we use personal data
Legal basis for the processing

This website is not intended for children and we do not knowingly collect data relating to children unless it is an identified part of a product or service that you obtain from us, in which case it will be covered in the Specific Notice for that product or service.

4. When we collect personal data

We may collect personal data about you if you:

use one of our websites or online services, you are a registered user, or you choose to register on our websites (Website Users);
purchase one of our services (Customers);
work with us as a business partner (Business Partners); or
apply to work at bolttech (Candidates).

5. The types of personal data we collect and how we use personal data

Website Users

On using our website, bolttech collects metadata that result from your usage of our websites including referral page, date and time of access, type of web browser, IP-address, geographic location as determined by your IP address, operating system and interface, language and version of browser software, session information (such as download errors and page response times).

Your IP-address will be used to enable your access to our websites. The metadata will be used to improve the quality and services of our websites by analyzing the usage behavior of our users.

If you commence direct communications via our websites enquiry form, by telephone, or writing to us, the nature of the enquiry (e.g., as tick box selection from service type/careers/other) and your message will also be collected and processed to respond to your communications and to improve our services.

If you are a registered user or choose to register on a bolttech website, you may be asked to provide the following personal data about you: first and last name, work phone number, company name, email address, personal telephone number, address, and primary usage.

Bolttech will process this personal data to provide you with the services for registered users, verify the legitimacy of your account, to avoid fraudulent accounts being opened, provide you with the products and services requested by you, customer support, contact forms, marketing materials as selected by you, inform you about system issues, comply with legal obligations, and defend, establish and exercise legal claims.

The personal data collected from Website Users is also used to personalize your experience of our websites. We may use such information in the aggregate to understand how you use our services and the resources provided on our websites. We may also use the feedback you provide to improve our services.

Customers

If you purchase products or services from bolttech, you may be asked to provide, among other things, the following personal data about you, your representative and/or your contact person: first and last name, suffix, credentials, work phone number, personal phone number, email address, job title, mailing address, tax identification number, credit card information, billing address, types and amount of products ordered. You may also be asked to provide additional information as part of the claims or service request process to enable us to process the claim or provide the requested service, product repair, or replacement. If you do not provide the requested information, we may not be able to process your claim or service request.

bolttech will use this personal data to process your order, deliver the products or services requested, process related claims or service request, provide customer care services, provide you with marketing materials as selected by you, provide you with bolttech updates and/or newsletters, to maintain our client relationship management systems, to investigate any complaint you may make, provide evidence in any dispute or anticipated dispute between you and us, to detect, investigate, report and seek to prevent fraud and anti-money laundering, for example through know-your-customer (KYC) checks, anti-money laundering (AML) and counter terrorism financing (CTF), economic and financial sanctions screening and other identity checks, comply with other legal obligations, defend, establish and exercise legal claims, and aggregate it on an anonymous basis with other data for data analytic and reporting purposes. We may also need to conduct credit and fraud checks on business customers and certain officers of your business, such as your directors.

Customers who purchase or rent our devices and / or cyber protection or monitoring products may choose to provide additional personal data to enable the monitoring and protection services. These services are performed by bolttech partners, and you will provide your personal data directly to them under the terms of their privacy notices. We do not store or process the data related to cyber protection or monitoring products, other than basic information required for account management or billing. For more information about these service partners, please contact us using the information provided in the How to contact us section. The information that you choose to provide can include email addresses and contact information, identification or driver’s license numbers, national ID or social security numbers, banking or credit card information, or other information that the service has the capability of monitoring. If you do not provide this information, these accounts or identifiers will not be able to be monitored by the service. You may also choose to provide this same information about family members or others who share an account with you, and you must only do so if you have their permission to add them to the cyber protection account.

Business Partners

If you work with us as a Business Partner or a service provider, we will collect personal data from you, your representative and/or your contact person such as your full name, job title, email address, phone number.

Most of the personal data is obtained directly from you. In addition, we will collect personal data from other public sources such as credit reference agencies.

We use this information to review/assess your suitability as a Business Partner or service provider, to comply with our legal obligations, to detect investigate, report, and seek to prevent fraud and anti-money laundering, for example through know- your-customer (KYC) checks, economic and financial sanctions screening and other identity checks and to meet our obligations under any contracts we have with you, we may also need to conduct credit and fraud checks on your business and certain officers of your business, such as directors.

Employment Candidates

If you apply to work at bolttech, we will collect personal data from you, such as your full name, email address, phone number, employment history, education history, and other relevant information such as certifications or credentials. Most of this data is collected directly from you. However, we may also collect personal data from other sources, such as former employers, educational institutions, or government sources.

This information will be used to review and assess your suitability for employment through selection tests, assessment interviews, background checks, and other means, either directly by bolttech or through a third party. We will also use this information determine to the preliminary remuneration and benefits package to be offered to a successful applicant. If you accept an offer of employment from us, we will upload the personal data collected onto our internal employee recordkeeping and payroll systems. Your data may also be used to meet our legal obligations or risk mitigation programs relating to screening Candidates for fitness to perform a certain role or function.

6. Emails

If you send to, or receive emails from us, we may monitor their content to ensure compliance with our internal policies and to protect our business.

7. Legal basis for the processing

We will only collect, use and share your personal data where we are satisfied that we have an appropriate legal basis to do this. Depending on where you are located, one or more legal basis for processing may apply. We carry out the processing of your personal data on the following legal bases:

you have provided your consent to using your personal data, for example if you have completed a form to request information or have agreed to receive marketing communications;
the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. For example, where you purchase our products or services, we will collect your payment information to process your payment and your address to facilitate delivery of the product or service. We will also collect your email address and phone number to update you on the progress of your purchase and to answer any of your queries;
the processing is necessary for compliance with a legal obligation to which we are subject to. For example, in order to set you up as a business customer or business partner, we are obliged to carry out certain know-your-customer (KYC) checks to prevent money laundering and fraudulent activities. This will involve the collection and verification of your personal data;
the processing is necessary for the purposes of the legitimate interests pursued by us, i.e. to provide you with our products and services, except where such interests are overridden by your interests or fundamental rights and freedoms. For example, we use personal data in the aggregate to understand how Website Users use our services and the resources provided on our websites and use this information to improve our services.

In many cases, the provision of your personal data is not required by a statutory or contractual obligation and failing to provide it will not result in legal consequences for you. In some instances, where the processing of personal data is necessary for purposes of legal reporting, the provision of your personal data is a statutory requirement. In others, the provision of your personal data is a contractual requirement. Where the provision of your personal data is necessary to enter into a contract with bolttech or to receive our services and products as requested by you, not providing your personal data may likely result in disadvantages for you, e.g. you may not be able to use the full functionalities of our websites or to receive the products and services requested by you, or we may be unable to consider you as a candidate for a role.

If you would like to find out more about the legal basis for which we process personal data, please submit a query as set out in the How to contact us section.

8. Direct marketing and how you can manage your marketing preferences

How we use personal data to keep you up to date with our products and services

We may use personal data to let you know about our products or services that we believe will be of interest to you and/or provide you with our newsletters. We may contact you by email, post, or telephone or through other communication channels that we think you may find helpful. In all cases, we will respect your preferences for how you would like us to manage marketing activity with you.

As a rule, we will obtain your consent prior to sending you marketing materials. We will only contact you with marketing materials without your prior consent if this is permitted by law.

How you can manage your marketing preferences

To protect privacy rights and to ensure you have control over how we manage marketing with you:

we will take steps to limit direct marketing to a reasonable and proportionate level and bolttech will only send you communications which we believe may be of interest or relevance to you;
you can ask us to stop direct marketing at any time. You can ask us to stop sending email marketing, such as by following the “unsubscribe” link you will find on all the email marketing messages we send you. Alternatively, you can submit a request as set out in the How to contact us section. Please specify whether you would like us to stop all forms of marketing or just a particular type (e.g. email); and
you can change the way your browser manages cookies, which may be used to deliver online advertising, or by updating your cookie preference by following the steps outlined in our Cookie Policy.

We share your personal data in the manner and for the purposes described below:

With other bolttech entities within our group: Your personal data will be received by different recipients such as other bolttech entities. We make such transfers where it is necessary to provide you with our services or to manage our business.
With third parties who help manage our business and deliver services: bolttech engages external service providers such as legal services, website service providers, marketing service providers, IT support service providers, cloud service providers, email administrators, payment processors, banks, scoring service providers, account information service providers, insurers, credit / economic information bureaux, sales support, couriers, device repair services, device producers, vendors, and customer service providers. When providing such services, the external service providers may have access to and process your personal data. We request those external service providers to implement and apply security safeguards to ensure the privacy and security of your personal data. These third parties have agreed to confidentiality restrictions and to use of any personal data we share with them or which they collect on our behalf solely for the purpose of providing the contracted service to us.
In the event of a corporate merger and acquisition, your personal data will be transferred to the third parties being involved in the merger and acquisition in accordance with applicable law.

10. International transfers of personal data

The personal data that we collect or receive about you may be transferred to and processed by recipients who are located within or outside your location (such as our offices in the United Kingdom, Switzerland, Singapore, Hong Kong, or Malaysia), where the level of data protection may not be equivalent to the level of protection applicable in your location.

Where we are required to do so (such as for transfers of personal data to parties located in countries outside the European Economic Area (EEA)), data transfers will be made pursuant to legally acceptable mechanisms that ensure an adequate level of protection. Please submit a query as set out in the How to contact us section for more details on the third countries to which the data will be transferred.

11. Cookies and third-party links

bolttech websites use cookies. Generally, we use cookies to understand how our services are used, track bugs and errors, improve our services, verify account credentials, allow logins, track sessions, prevent fraud, and protect our services, as well as for targeted marketing and advertising, to personalize content and for analytics purposes. For further information please view our Cookie Notice or submit a query as set out in the How to contact us section.

Our websites contain links to websites operated and maintained by third parties over which bolttech has no control. Any information you provide to third-party websites will be governed under the terms of each website’s privacy notice, and we encourage you to investigate and ask questions before disclosing any information to the operators of third-party websites. We have no responsibility or liability whatsoever for the content, actions, or policies of third-party websites. The inclusion of third-party websites on our site in no way constitutes an endorsement of such websites’ content, actions, or policies.

12. Profiling

Profiling is a form of automated processing of personal data to evaluate your behavior, such as to analyze or predict aspects concerning your preferences, interests, behavior, and actions. Profiling also enables us to detect, investigate, report and seek to prevent fraud and anti-money laundering, for example through know-your-customer (KYC) checks, anti-money laundering (AML) and counter terrorism financing (CTF), economic and financial sanctions screening and other identity checks, review creditworthiness and assess credit risk, identify suitability for employment, comply with other legal obligations, defend, establish and exercise legal claims, and aggregate it on an anonymous basis with other data for data analytic and reporting purposes. This analysis also enables us to tailor and personalize its digital content, offerings, and advertisements to better align with your preferences.

13. Solely automated decision making, including profiling performed for customer’s solvency check

The process of solvency check for rental is a solely automated process, that performs a solvency assessment and predicts the customer’s ability to repay new, planned obligations in real time. On our behalf, our provider analyses the customer’s solvency, income, expenses, fraud patterns, potential solvency problems, spending categories and finally, a risk rating (score) based on bank account information of outgoing and incoming cash flows for the three months preceding the current month or a certain period of time. This involves assessing the solvency of the customer through profiling. Based on the logic of profiling, our provider, on our behalf, uses the customer’s bank account information to predict the customer’s ability to repay his or her new planned obligations in real time, thus revealing the customer’s ability to pay.

On the basis of the risk rating, we may decide not to enter into a contract with the customer if the customer’s solvency check has identified risks to the customer’s solvency.

14. How we store and protect personal data

How long does bolttech keep your personal data?

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Details of retention periods for different aspects of your personal data are outlined in our retention policy. For queries about bolttech data retention processes please submit a query as set out in the How to contact us section.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may retain this information indefinitely without further notice to you.

We have adopted appropriate data collection, storage and processing practices, technical, organisational and security measures designed to protect against unauthorized access, alteration, disclosure or destruction of the personal data that you share with us. For example, such measures include:

placing confidentiality requirements on our staff members and service providers;
permanently removing personal data if it is no longer needed for the purposes for which it was collected;
following security procedures in the storage and disclosure of your personal data to prevent unauthorised access to it; and
using secure communication channels such as SSL (“secure sockets layer”) for transmitting data that is sent to us. SSL is an industry standard encryption protocol used to protect online transaction channels.

As the security of information depends in part on the security of the computer you use to communicate with us and the security you use to protect user IDs and passwords, please take appropriate measures to protect this information.

15. Your rights, including your right to object, and how to assert those rights

To make a request, please visit How to contact us section. Among the privacy requests that may be made, depending on your location are:

(i) Access to personal data:

Depending on where you live, you may have certain rights with respect to your personal data. We will comply with requests to exercise the rights that you have within the given timescales and taking into account any restrictions or exemptions under applicable law.

You may request confirmation as to whether or not personal data concerning you is being processed, and where that is the case, to request access to the personal data. The accessed information includes – among others – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipient to whom the personal data have been or will be disclosed.

You may also request a copy of the personal data undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.

(ii) Correct your personal data:

You may request the correction of inaccurate data and the completion of incomplete data. We will inform relevant third parties to whom we have transferred your data about the rectification and completion if we are legally obliged to do so.

(iii) Delete your personal data:

You may request the deletion of personal data concerning you in limited circumstances where:

it is no longer needed for the purposes for which it was collected; or
you have withdrawn your consent (where the data processing was based on consent); or
following a successful objection request; or
it has been processed unlawfully; or
the data must be erased in order to comply with a legal obligation to which bolttech is subject.

We are not required to comply with your request to erase personal data if the processing of your personal data is necessary for:

compliance with a legal obligation; or
the establishment, exercise or defence of legal claims.

(iv) Restrict personal data processing:

You have the right to obtain from us restriction of processing your personal data. In this case, the respective data will be marked and only be processed by us for certain purposes. This right can only be exercised where:

the accuracy of your personal data is contested, to allow us verify its accuracy; or
the processing is unlawful, but you do not want the personal data erased; or
it is no longer needed for the purposes for which it was collected, but you still need it to establish, exercise or defend legal claims; or
you have exercised the right to object, and verification of overriding grounds is pending.

We may continue to use your personal data following a request for restriction, where:

we have your consent; or
to establish, exercise or defend legal claims; or
to protect the rights of another natural or legal person.

(v) Data portability:

You may have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another entity without hindrance from us, but in each case only where:

the processing is based on your consent or on the performance of a contract with you; and
the processing is carried out by automated means.

(vi) Object to processing:

You may have the right to object at any time to any processing of your personal data which has our legitimate interests as its legal basis. You may exercise this right without incurring any costs.

If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms.

The right to object does not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.

(vii) Opt-out of direct marketing:

You may request that we change the manner in which we contact you for marketing purposes. You may request that we not transfer your personal data for the purposes of direct marketing or any other purposes.

(viii) Withdraw your consent:

If you have given us your consent for the processing of your personal data, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

(ix) Object to automated decision-making and request human review:

If you have been subject to a decision based solely on automated processing, which produces legal or similarly significant effects, you may be able to object to such processing. In any event, you may also request human review of an automated decision, and express your point of view to contest the automated decision.

(x) Lodge a complaint with your local supervisory authority:

You have a right to lodge a complaint with your local supervisory authority if you have concerns about how we are processing your personal data.

We ask that you please attempt to resolve any issue with us first, although you have a right to contact your supervisory authority at any time.

Please note that your ability to have the above requests fulfilled might be limited under the applicable national data protection law.

We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal data requested to you. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.

To make a request please visit the How to contact us section. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request.

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

16. Modifications to this notice

Bolttech reserves the right to change this Notice at any time. Any changes to this Notice will be effective immediately upon notice, by posting the latest version on our websites.

17. How to contact us

If you have any questions, concerns or complaints regarding our compliance with this Notice, the information we hold about you or if you wish to exercise your rights, we encourage you to first submit an Information Request or File a Complaint through the channels below. We will investigate and attempt to resolve complaints and disputes and make every reasonable effort to honor your wish to exercise your rights as quickly as possible and in any event, within the timescales provided by data protection laws.

The primary points of contact for all issues arising from this Notice can reached through the following channels:

bolttech Poland Privacy Office

bolttech Data Subject Request Portal or by email to [email protected]

You have a right to lodge a complaint with your local data protection supervisory authority (i.e. your place of habitual residence, place or work or place of alleged infringement). We ask that you please attempt to resolve any issues with us before your local supervisory authority.

Last updated: 30 September 2024