Privacy Policy

Date Published: 06 Nov 2024

PRIVACY AND PERSONAL DATA PROTECTION POLICY

Introduction

We, Bolt Insight Limited (“Bolt”), hereby inform you that we collect and process personal data in full compliance with the Regulation EU2016/679- General Data Protection Regulation, the Data Protection Act 2018 and other relevant UK legislations (“UK GDPR”, “Data protection legislation”).

Bolt Insight Limited is a data controller according to EU/UK GDPR, and we process personal data in compliance with the applicable data protection legislation. Where we act as a data processor on behalf of a data controller, we provide an additional schedule setting out required information as part of that agreement. That additional schedule should be read in conjunction with this Privacy and Personal Data Protection Policy (“Privacy Policy”). We may amend this Privacy Policy from time to time. If we do so, we will supply you with and/or otherwise make available to you a copy of the amended Privacy Policy. Before submitting any personal data to Bolt, please check the latest version of the Privacy Policy available on our website (“Website”).

This Privacy Policy is dedicated to the surveys’ participants (“Respondents”), our clients and their employees/representatives (“Clients”), suppliers and their employees/representatives (“Suppliers”), website visitors (“Visitors”) and to any other person interacting with us via website such as candidates (“Candidates”), prospective respondents, prospective clients (“Others”).

As a user or visitor of our Website or Services, you hereby agree to be bound by our Terms of Use and any other policies referenced herein, and you acknowledge that you have read and understand this Privacy Policy. If you do not agree with the Terms of Use and this Privacy Policy, do not access or engage with the Website or any of our Services. You may be shown and required to accept user terms, participation terms, or enter into a contract or other terms of service (collectively as “terms of service”) before enrolling, using, or interacting with the Website or Services. The information in this Privacy Policy is intended to supplement the information in the Terms of Use. Bolt’s contact details are as follows;

Bolt’s contact details are as follows;

E-mail: [email protected]

Address: C/O Ida & Co, Building 3 Chiswick Business Park, 566 Chiswick High Road, W4 5YA London, United Kingdom

Web Site: www.boltinsight.com

For other requests not related to privacy and data protection please use the other means of contact indicated on our website on Contact section.

What does Bolt do?

Bolt runs various market research projects for global brands across industries (“Services”). We create online surveys to collect authentic responses from consumers that fit the criteria established by us or provided to us by brands. We design customized questionnaires to ask for your feedback and opinions on different topics, such as new product ideas, personal preferences and shopping behaviour.

Bolt may collect, use, store, and transfer different kinds of personal data or information, which may be filtered or grouped into identity, contact, transaction, media, statistic data, preferences, and technical data sets. We use this data to conduct our business and to serve our legitimate business purpose, given our contract with you (by the acceptance of the terms of use or concluded otherwise), ours and/or your legitimate interests, an your consent to share specific personal information, as detailed below.

Certain personal data is necessary for the performance of certain obligations, i.e. to enter into a contract with you and/or to fulfil contractual obligations we have to our Clients. If you refuse to provide such information, we may not be able to perform our obligations and we will not be able to provide you with services or respond to your requests.

However, certain personal data collected for the purposes of direct marketing, feedback and the publication thereof is not mandatory and it is up to you whether or not to provide it.

We offer innovative solutions to create the surveys, to analyse data and provide meaningful insights to share with our clients, to efficiently help optimize business operations, product development, and decision-making.

DETAILS ON THE PROCESSING SPECIFIC TO EACH CATEGORY OF DATA SUBJECTS

IF YOU ARE A RESPONDENT

If you participate in our surveys in any way, please read how we may process your data depending on the specific way you interact with us.

What types of information do we collect from you?
If you engage in our surveys or other chat on website (including Bolt Chat AI), we may collect some of the following categories of information directly from you, depending on the nature of your interaction with Bolt, the type of survey, and your choices. The categories of information listed below are not exhaustive and we may also collect other personal information directly from you.

• Identity and demographics: Age, gender, location (country, city) and demographics data (employment, education, income, number of children and marital status),
• Contact: E-mail address, name
• Technical: Internet Protocol (IP) address, browser type and operating system on the devices you use to access our web site,
• Profile: Your interests, preferences, feedback and survey responses,
• Usage: Information about how you use our web site, products and services,
• Other Personal Data you choose to share: Raw voice and/or image recording during the survey, if you choose to upload or reply by a photo and/or video voice (Not used for idenfication purposes)
• Non-Personal Data: Photos, and videos related to products, uploaded by you without any identification aspect that could link the data to a natural person.

Please do not provide any special categories of data (such as health-related information or information related to criminal convictions) or other sensitive. If you are requested to provide such information please let us know at once.. The disclosure of personal data of minors and/or other vulnerable categories of data subjects is prohibited.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific web site feature.

We ask that you minimize the data you provide to us through the media files you choose to upload during the survey. Please do not provide any personal information that is not specifically requested by Bolt. Please do not disclose data belonging to other people when filling in the surveys and in any interaction with us. If you do choose to disclose such data, you agree to inform those individuals in advance about the disclosure of data to Bolt and the content of this Privacy Policy, including obtaining their specific consent to do so.

Purposes and legal basis

Recipients

We may share your personal data with:

• Our Clients, Our Contractors and Subcontractors (e.g., IT suppliers, consultants, auditors).
• Law enforcement or public bodies, if required to do so by law

Data retention

Personal data will be kept for as long as necessary to fulfill the purposes for which it was collected, taking into account legal retention periods and our legitimate interests in protecting or defending our legal interests . You can write to us for more specific details about the retention periods.

Personal data collected through the survey will be kept generally for 1 year, except for aggregated and statistical data, which may be kept for another research. Certain categories of data, such as those relating to any payment made to you, may be kept for a longer period in accordance with applicable law and our internal policy (e.g. 6 years after the end of the financial year in which the documents were created). Other data related to your complaints, GDPR requests could be kept for a longer period (e.g., 6 years after the end of the inquiry, request, complaint). Other contact details could be kept until you object or withdraw your consent (if applicable) to contact you for other surveys or to present our Services that we may offer to you.

IF YOU ARE OUR CLIENT

If you are a Client, including an employee or a representative of the Client (legal entity), please read below how we process your personal data and with whom we may share it.

What types of information do we collect from you?

The categories of information listed below are not exhaustive, and we may also collect other personal information directly from you.

• Identity: Name, company name, title,
• Contact: E-mail address, telephone number,
• Payment data: Bank account number,
• Usage: Information about how you use our website, platform and services,
• Marketing: Your preferences in receiving marketing from us and our third parties and your communication preferences.

Please provide us with only the minimum information necessary to develop your relationship with Bolt and to access the Services (including our platforms). Please ensure that any information you provide to us (e.g. about your employees, representatives, customers) is processed lawfully and that you have the right to disclose it to us. Please also ensure that you have informed these individuals in advance about the disclosure of their data to Bolt and the content of this Privacy Policy.

Purposes and legal basis

Recipients

We may share your personal data with:

• Our Respondents (if they ask us to disclose the third parties with whom we have shared their personal data)
• Our Contractors and Subcontractors (e.g., IT suppliers, consultants, auditors).
• Law enforcement or public bodies, if required to do so by law

Data retention

Personal data will be kept for as long as necessary to fulfil the purposes for which it was collected, taking into account legal retention periods and our legitimate interests in protecting or defending our legal interests.. You can write to us for more specific details about the retention periods.

Certain categories of data, such as those relating to any payment made to you, may be kept for a longer period in accordance with applicable law and our internal policy (e.g. 6 years after the end of the financial year in which the documents were created). Other data related to your complaints, GDPR requests could be kept for a longer period (e.g., 6 years after the end of the inquiry, request, complaint).

IF YOU ARE A SUPPLIER

If you are a contractor or sub-contractor, employee or representative of a contractor/sub-contractor providing services to Bolt, please read the information below about how we may process your personal data and with whom we may share it.

What types of information do we collect from you?

The categories of information listed below are not exhaustive and we may also collect other personal information directly from you.

• Identity: Name, company name, title,
• Contact: E-mail address, telephone number,
• Payment data: Bank account number.

Purposes and legal basis The processing activities are mainly based on our legitimate interest in managing the contractual relationship optimally, i.e., performing the contractually agreed services, taking the necessary steps, dealing with any requests arising during the contract, etc.

In case you act as an individual or a sole trader, the legal basis for processing your personal data is the contract you concluded with us.

This personal data is necessary for the performance of contracts with you/the supplier you act for or represent. If you refuse or object to this processing, we may not be able to fulfil our contractual or legal obligations, as the case may be.

In certain circumstances, we might use your personal data for internal communications, reports, statistics, internal evaluations, based on our legitimate interests to organize our activity and ensure a proper quality and efficiency in the company’s activities.

If you choose not to provide certain information, we may not be able to enter into and perform the contract with you.

Recipients

We may share your personal data with:

• Our Respondents (if they ask us to disclose the third parties with whom we have shared their personal data),
• Our Clients.
• Law enforcement or public bodies, if required to do so by law

Data retention

Personal data will be kept for as long as necessary to fulfill the purposes for which it was collected, considering legal retention periods and our legitimate interests in protecting or defending our legal interests. You can write to us for more specific details about the retention periods. 7 Certain categories of data, such as those relating to any payment made to you, may be kept for a longer period in accordance with applicable law and our internal policy (e.g. 6 years after the end of the financial year in which the documents were created). Other data related to your complaints, GDPR requests could be kept for a longer period (e.g., 6 years after the end of the inquiry, request, complaint).

IF YOU ARE A WEBSITE VISITOR

The categories of information listed below are not exhaustive. We may also collect other personal information directly from you, depending on your interaction with us via our Website.

What kinds of information do we collect from you?

• Identity: Name, company name, title (if you fill contact form),
• Technical: Internet Protocol (IP) address, browser type and operating system on the devices you use to access our web site,
• Usage: Information about how you use our website, products and services,
• Marketing: Your preferences in receiving marketing from us and our third parties and your communication preferences.

Purposes and legal basis

The processing activities are mainly based on our legitimate interest in ensuring the proper functioning of our website, optimizing the user experience, visual design and content of surveys for better engagement and higher conversion, and respond to your requests submitted via Website. If you choose not to provide certain information, we may not be able to resolve your requests and provide you with a proper experience on our Website.

Recipients

We may share your personal data with:

• Our Contractors and Subcontractors (e.g., IT suppliers, consultants, auditors).
• Law enforcement or public bodies, if required to do so by law

Data retention

Personal data will be kept for as long as necessary to fulfil the purposes for which it was collected, taking into account legal retention periods and our legitimate interests in protecting or defending our legal interests. You can write to us for more specific details about the retention periods.

Information relating to your activity on our website is stored for the purpose of usage analytics for 26 months. Certain categories of data related to your complaints, GDPR requests could be kept for a longer period (e.g., 6 years after the end of the inquiry, request, complaint).

IF YOU ARE A CANDIDATE

If you apply for a job with us via our website, or we receive your personal data from people who have recommended you or otherwise, please read the following information to find out how we may process your personal data and with whom we may share it.

What types of information do we collect from you?

• Identity and demographics: Name, surname, address, age,
• Contact: E-mail, telephone number,
• Education and professional information: The information you have provided to us in your curriculum vitae and/or cover letter related to you education, qualifications, former jobs and other professional data,
• Other Personal Data you choose to share: image, hobby, preferences.

Depending on your interaction with us, if we contact you for an interview, we may process other personal data relating to the interview process, the overall candidate score across all personal and professional attributes of a candidate when considering them for the position they are applying for, throughout all interview stages.

Purposes and legal basis

• We will use the personal data we collect about you to for the following purposes and based on the following legal bases:
• Assess your skills, qualifications, and suitability for the role; communicate with you about the recruitment process, based on the necessity to enter into a contract between you and us,
• Carry out reference checks, where applicable based on our legitimate interest in assessing the suitability of the candidate, taking into account our vision and objectives, in order to provide a safe place to work and to ensure high-quality services to our clients,
• Keep records related to our hiring processes, on the basis of our legitimate interest in the proper organization and management of our human resources activities,
• Comply with other legal or regulatory requirements, as the case may be.

We will need to process your personal information to decide whether to enter into a contract of employment with you. However, we are under no obligation to enter into a contract. We will assess each case on its merits, to decide whether to appoint you in the role since it would be beneficial to our business to appoint someone suitable based on the job description and requirements.

Once we have received your application and your CV, we will process this information to decide whether you meet the basic requirements to be shortlisted for the role. If so, we will decide whether your application is strong enough to invite you for an interview. If we decide to invite you for an interview, we will use the information you give us at the interview to decide whether to offer you the role. If we decide to offer you the role, we will then check your right to work and obtain references if necessary, before confirming your appointment.

If you decide not to provide the information necessary for us to consider your application (such as evidence of qualifications or work history), we will not be able to process your application successfully. For example, if we require details on a certification or references for this role and you do not provide us with relevant details, we will not be able to take your application further.

Recipients

We may share your personal data with:

• Our Contractors and Subcontractors, if the case (e.g., job platforms, recruiters, IT suppliers, consultants, auditors).

Data retention

Personal data will be kept for as long as necessary to fulfil the purposes for which it was collected, taking into account legal retention periods and our legitimate interests in protecting or defending our legal interests, in accordance with our internal policies. You can write to us for more specific details about the retention periods.

We will retain your personal information for a period of 12 months for unsuccessful candidates after we have communicated to you our decision. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with our data retention policy if there is no legitimate interest or legal obligation or other legal basis for keeping the data for a longer period.

If we wish to retain your personal information on file, on the basis that we may wish to consider you for a future opportunity, we will ask your consent to retain your personal information for a fixed period. If your application is successful and you subsequently become employed by us, the information will become part of your personnel file in accordance with the information that will be provided to you as employee, worker, or contractor.

Certain categories of data related to your complaints, GDPR requests could be kept for a longer period (e.g., 6 years after the end of the inquiry, request, complaint).

HOW DOES BOLT COLLECT INFORMATION FROM YOU?

• Direct Interactions: People fill in our research surveys, forms on our website and correspond with us by email or choose to answer our research survey questions by voice. This includes personal data that people provide when they:
  • Answer questions in our research surveys o participate in gift card draws at end of surveys;
  • request demo of products or services;
  • apply for a job position with us;
  • subscribe to our publications or newsletter; or
  • give us some feedback.
• Automated technologies or interactions: As people interact with our websites, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies.
• Third parties: We may receive personal data about you from various third parties. We may receive technical data from the following parties: analytics providers such as Google based in Ireland and Fingerprint based in the USA.

WHAT ABOUT ARTIFICIAL INTELLIGENCE (AI) CHAT BOT?

We use AI Chat Bot services in some of our surveys.

When you participate in AI Chat Bot surveys, the AI Bot asks you questions instead of the real person in the opened chat.

The data created with the answers given to these questions is deidentified and/or aggregated. In these surveys, no data relating to an identified or identifiable natural person is collected or stored.

All questions asked by the Bot are prepared by Bolt and/or Client, or created by the Bot and are filtered according to content.

DOES BOLT USE COOKIES?

A cookie or other similar technologies is a small file which asks permission to be placed on your computer’s hard drive, except those are strictly necessary for the functioning of the website or application. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to collect information and respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

In our surveys and Website, we use the following type of cookies:

• Technical cookies: Enable core functionality such as survey sessions, website visit sessions, security and verification of identity
• Marketing cookies: To store communication preferences.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

INTERNATIONAL TRANSFERS

We operate the Website and Services and platforms in the UK. All our cloud architecture is based in the UK and EU. We don’t do any processing in other regions.

In certain cases, personal data may be transferred outside EU/EEA, in which case we ensure the conclusion for the appropriate SCCs, and/or other appropriate safeguards for the transfer (e.g., to India in case in providing the services to us our service provider for Bolt platform located in India acting as our processor, will require access to personal data).

AUTOMATED DECISIONS

No Automated Decision Making. We do not take any automated decisions involving the use of algorithms or profiling that significantly affect you.

DATA SUBJECTS RIGHTS

Requesting Personal Data we hold about you (Subject Access Requests)

You have a right to request access to your personal data that we hold. Such requests are known as “Subject Access Requests” (“SARs”). Please provide all SARs in writing marked for the attention of Data Protection Officer, Bolt Insight Limited. To help us provide the information you want and deal with your request more quickly, you should include enough details to enable us to verify your identity and locate the relevant information.

DPA 2018 requires that we comply with a SAR promptly and in any event within one month of receipt. There are, however, some circumstances in which the law allows us to refuse to provide access to personal data in response to a SAR (e.g. if you have previously made a similar request and there has been little or no change to the data since we complied with the original request). We will not charge you for dealing with a SAR.

In case someone else requests information on your behalf – for example, a friend, relative or solicitor we must have your authority to respond to a SAR made on your behalf. You can provide such authority by signing a letter which states that you authorize the person concerned to write to us for information about you, and/or receive our reply. Additional information may be required by Bolt in order to confirm the identity and the authority you gave to third parties.

Putting things right (Right to Rectification)

You have a right to obtain the rectification of any inaccurate personal data concerning you that we hold. You also have a right to have any incomplete personal data that we hold about you completed.

Deleting your records (Right to Erasure)

In certain circumstances you have a right to have the personal data that we hold about you erased. In certain circumstances we have the right to refuse to comply with a request for erasure. If applicable, we will supply you with the reasons for refusing your request.

The Right to Restrict Processing

In certain circumstances you have the right to block or suppress the processing of personal data. If you choose to restrict this processing, we may not be able to provide you with certain services. We may keep lists of people who have asked to restrict processing in order to make sure the restriction is respected in the future.

The Right to Object

You have the right to object to certain types of processing of your personal data, in particular processing based on our legitimate interests. If you choose to object to processing, we may not be able to provide you with certain services. You may also object at any time to the use of your personal data for direct marketing purposes (including profiling in connection with such direct marketing).

Withdrawal of Consent

Where you have consented to our processing of your personal data, you have the right to withdraw that consent at any time, with effect for future processing.

The Right to Data Portability

You have the right to request that we transfer the personal data you have provided to us based on a contract or your consent, to you or to another organization, in a format that is easily readable and transferrable. Automated decision-making We do not intend to use automated decision-making in relation to your personal data.

Requests and Complaints

In accordance with the applicable regulations, you have the rights as we explained above.

Please send your requests and your complaints to [email protected]. You can submit by filling the GDPR Contact Form available on our website here.

If you are not happy with our response or you think we have not complied with the UK GDPR in some other way, you can complain to the Data Protection Authority.

Further information is available on the ICO web site (www.ico.org.uk).

OTHERS

If we undergo a business acquisition, merger, or sale of assets, we may transfer your personal data to the successor entity. If we go out of business or enter bankruptcy, your personal data would be an asset transferred to or acquired by a third party.