Privacy Policy

Boostra is a tool for online stores. Depending on the type of data, we act in two different roles, and this is the most important thing to keep in mind before reading the rest of this document:

1. we process the data of the person who creates an Account with us and uses the Application as a controller. We are responsible for that data, and this Policy is about it.

2. we process buyers' data, which we retrieve from the Store and from the advertising accounts connected by the User, as a processor, on the Store's instructions. The controller of that data is the Store, and the rules are set out in the data processing agreement.

Controller: BOOSTRA Sp. z o.o., contact: kontakt@boostra.pl. You have the right to access your data, to have it rectified, erased, and its processing restricted, to data portability, to object, and to lodge a complaint with the President of the Personal Data Protection Office. We do not use data to train artificial intelligence models. Full information is set out below.

1. Who is the Controller

The controller of personal data to the extent described in points 3-11 is BOOSTRA Sp. z o.o. with its registered office in Wrocław, ul. Sudecka 153, 53-128 Wrocław, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0001172942, NIP (tax identification number) 8993025273, REGON (statistical number) 541730975.

Contact for data protection matters: kontakt@boostra.pl.

We have not appointed a data protection officer. For matters concerning data protection, please contact us at the above address.

2. Boostra's Role

The separation of roles determines who is responsible for the data and to whom requests should be directed.

If you are a buyer at a Store using Boostra and want to exercise your rights, direct your request to the Store where you made the purchase. If a request reaches us directly, we will forward it to that Store and support it in fulfilling it, because we are not the controller of that data.

3. What Data We Process as Controller

1. Account data: first name and surname, e-mail address, telephone number, company name, position, the entrepreneur's identifying data.

2. Billing data: invoicing data, payment and subscription history.

3. Technical data: IP address, device and session identifiers, login data, information about the browser and operating system, system logs.

4. Data on the use of the Application: User activity, action history, Account settings, use of functionalities, the content of chat conversations, and generated materials.

5. Contact details of the person administering a connected Integration, if the external platform provides them during the authorisation process.

6. Contact details of entrepreneurs and the persons representing them, obtained from publicly available sources for business contact purposes: first name and surname, position, company, business e-mail address, telephone number, and professional profile address.

We do not collect special category data within the meaning of Article 9 GDPR, and we ask that it not be provided to us.

Source of the data. We obtain the data of the person creating the Account directly from that person. We receive the data of other Users from the Service Recipient, who grants them access to the Account. We obtain the data of persons to whom we address a business offer from entrepreneurs' publicly available websites, from public registers, and from professional social media services; on first contact, we provide these persons with the information required by Article 14 GDPR, together with an indication of the source of the data.

4. Purposes, Legal Bases and Retention Periods

The above periods may be extended if this is necessary to handle a reported security incident or ongoing proceedings.

5. Artificial Intelligence

The Application uses artificial intelligence models to analyse business data, generate recommendations, reports and content, and to operate the chat. Content generated by AI is marked in the Application's interface, and images are additionally marked in a machine-readable format. A User of the chat is informed that they are interacting with an artificial intelligence system. The detailed rules are described in the AI Transparency Policy.

We do not use Users' data or buyers' data to train artificial intelligence models - whether our own models or those of our providers. We do not reserve the right to use data in this way, even after it has been pseudonymised. In queries sent to the models, the Application does not transfer buyers' identifying data. It does not, however, block content entered independently by the User: data entered by the User into a query is transferred to the model provider together with that query.

We allow the use of synthetic data and of aggregate data that has been completely and irreversibly anonymised for statistical purposes and industry comparisons. This is conditional on it not being possible to identify a person or a specific Store, on an adequate minimum group size, and on it not being possible to reconstruct the source data.

Access to the content of conversations and to a specific User's data may be obtained only by a limited group of authorised technical and support personnel, and only where this is necessary to handle a request or an incident. Access is time-limited and logged.

The Application does not make decisions with legal effects, nor decisions of a legal, financial, tax, accounting or HR nature. Actions in connected external systems are performed only after the User's approval.

6. Recipients of Data

Data may be entrusted to the following categories of recipients:

1. infrastructure and hosting providers;

2. providers of artificial intelligence models and content-generation services;

3. providers of tools for sending transactional and marketing messages;

4. payment operators and providers of invoicing systems;

5. providers of support, request-handling and meeting-scheduling tools;

6. providers of monitoring, event-logging and process-orchestration tools;

7. external advisors, including accounting and legal advisors, bound by a duty of confidentiality;

8. public authorities, where an obligation to disclose data arises from law.

The current list of sub-processors, together with an indication of their function, processing region and the basis for the transfer, is set out in Annex No. 3 to the Data Processing Agreement and is made available to the User together with that agreement. We inform Users of an intended change or addition of a sub-processor at least 30 days in advance, via a notice in the Application or by e-mail.

Storefront, advertising and analytics platforms connected by the User, in particular WooCommerce, Shopify, Shoper, IdoSell, Google Ads, Google Analytics, Meta Ads and TikTok Ads, are not our sub-processors. These are accounts belonging to the User, from which we retrieve data on their instructions, and the rules for processing data on the part of those platforms are set out in their own documents.

7. Transfer of Data Outside the European Economic Area

The Application's production environment, database and backups are maintained with an infrastructure provider within the European Economic Area (EEA). System administration is carried out from the territory of Poland.

Some artificial intelligence model providers may process data outside the EEA, in particular in the United States. In such cases, the basis for the transfer is a European Commission adequacy decision or standard contractual clauses adopted by the European Commission, depending on the provider.

A list of the providers processing data outside the EEA, together with an indication of the basis for the transfer, is set out in Annex No. 3 to the Data Processing Agreement. We make a copy of the safeguards applied available on request sent to kontakt@boostra.pl.

8. Data Security

We apply technical and organisational measures appropriate to the risk, in particular role-based access control, two-factor authentication for accounts with access to the production environment, encryption of data in transit, encrypted storage of authentication credentials and access tokens for connected Integrations, logging of security events and access to User data, infrastructure monitoring, and regular updates of the environment.

A detailed description of the security measures is set out in an annex to the Data Processing Agreement.

9. Your Rights

With regard to data for which we are the controller, you have the right to:

1. access your data and obtain a copy of it - Article 15 GDPR;

2. rectification of your data - Article 16 GDPR;

3. erasure of your data - Article 17 GDPR;

4. restriction of processing - Article 18 GDPR;

5. data portability - Article 20 GDPR;

6. object to processing based on our legitimate interest - Article 21 GDPR;

7. withdraw your consent at any time, where consent is the basis for processing; withdrawal does not affect the lawfulness of processing carried out before it was withdrawn;

8. lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw.

We accept requests at kontakt@boostra.pl and support@boostra.pl. We respond without undue delay, no later than within one month of receiving a request. This period may be extended by a further two months, of which we will inform you within one month of receiving the request, together with the reasons for the extension.

You may object to direct marketing at any time, without giving a reason. We act on it without undue delay.

We currently handle requests manually. Self-service functions for exporting data and deleting an Account from the panel are not yet available.

10. Is Providing Data Mandatory

1. Data necessary to create an Account and provide the Service: providing it is a condition for concluding and performing the contract. Without it, we cannot provide the Service.

2. Invoicing data: providing it results from tax regulations.

3. Newsletter sign-up and marketing consents: entirely voluntary. Not giving consent does not limit the use of the Application.

4. A telephone number beyond what is necessary for billing: voluntary, used solely to enable faster contact on support matters.

11. Automated Decision-Making and Profiling

We do not make decisions concerning you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. Recommendations generated by the Application are proposals, and actions in connected systems are performed after the User's approval.

On the Store's instructions, the Application may present the User with summaries covering individual buyers, for example a list of customers with the highest order value. In this respect, the processing may constitute profiling within the meaning of Article 4(4) GDPR; the controller of this data remains the Store. We do not direct communications to buyers directly. We do not transfer buyers' contact details to advertising platforms in order to build audiences.

12. Cookies

The rules for using cookies and similar technologies, the categories of files used, and how to give and withdraw consent are described in a separate Cookie Policy, available on the Application's website. We use files other than those necessary to provide the Service only after obtaining consent given through the consent management tool.

13. Minors

The Application is intended exclusively for entrepreneurs. We do not direct our services to persons under the age of 18 and we do not knowingly collect their data.

14. Changes to the Privacy Policy

We may update this Policy. We inform Users of material changes via a notice in the Application or by e-mail, at least 14 days in advance. The current version, together with its effective date, is always published on the Application's website. We make previous versions available on request.

15. Contact

BOOSTRA Sp. z o.o., ul. Sudecka 153, 53-128 Wrocław

kontakt@boostra.pl | www.boostra.pl