Privacy Policy

A. Data Provided Directly by You

We may collect the following information that you provide voluntarily:

• Identity and contact details: name, company name, position or job title, email address, telephone number.
• Account data: username, login identifier, and password (where an account is created).
• Communications: enquiry form submissions, customer support messages, chat transcripts, attachments, and call notes.
• Marketing preferences: newsletter sign-ups, consent records, and opt-in/opt-out selections.
• Recruitment data: CV/résumé, cover letter, portfolio links, interview notes, and employment history (if you apply for a role).

B. Data Collected Automatically

When you interact with our Website, we may automatically collect:

• Technical information: IP address, browser type and version, device type, operating system, time zone, referring URLs, and country/city-level geolocation.
• Usage and performance data: time spent, clicks, scrolling behaviour, page load times, and error logs.
• Cookies and SDKs: as detailed in our Cookie Policy, including strictly necessary, analytics, performance, preference, and marketing cookies.

BOSIT does not intentionally collect special category data (e.g., health, ethnicity, political opinions) and does not knowingly collect any data relating to children (see §12).

C. Live chat & pre-chat forms

When you use our live chat widget (currently provided by tawk.to), we may collect the information that you enter into the pre-chat form, such as your name, business email address, phone number, company name and company registration number, together with the content of your messages and certain technical metadata (including timestamps, browser type, and approximate location based on IP address).

We use these details to identify you and your organisation, respond to and track your enquiry, and to prevent spam, abusive, or clearly non-genuine use of the chat. Live chat is intended only for genuine business enquiries and we may choose not to respond to messages that are incomplete, fictitious, or inappropriate. You should not use the chat to send sensitive or special category data (for example information about health, children, or other highly personal details).

We process personal data only when we have a lawful basis as defined under Article 6 of the UK GDPR. Consent may be withdrawn at any time by contacting us or through the Cookie Settings panel.

Payments on our Website are processed securely through Stripe, which acts as an independent data processor under its own privacy and compliance framework. We do not have access to or store any cardholder information. Stripe is certified under the Payment Card Industry Data Security Standard (PCI-DSS). We only retain transaction-related metadata required for invoicing, accounting, and statutory compliance.

We may share limited personal data with:

• Trusted service providers and contractors, engaged under written data protection agreements, for the purpose of hosting, analytics, payment processing, or customer communications;
• Public authorities or regulators, where required by applicable law or in response to lawful requests.

These service providers include, for example, hosting and infrastructure vendors, analytics providers (such as Google Analytics), payment processors (Stripe), and our live chat provider (tawk.to), which processes chat messages and pre-chat details on our behalf.

We do not sell, rent, or trade personal data.

Where processing or storage occurs outside the United Kingdom or European Economic Area (EEA), we ensure appropriate safeguards such as: the UK International Data Transfer Addendum, the EU Standard Contractual Clauses (SCCs), and additional organisational and technical measures to ensure equivalent protection.

Controller and Processor Roles:

For the operation of its Website and analytics, BOSIT GROUP LTD acts as data controller. For bespoke client projects, BOSIT acts as a data processor under a separate Data Processing Addendum (DPA).

Personal data is retained only for as long as necessary for the purposes stated above, and then securely deleted or anonymised.

Data may be retained longer where required by legal or regulatory obligations.

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

• Access your personal data and receive a copy.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict or object to processing based on legitimate interests or direct marketing.
• Data portability of information you provided to us.
• Withdraw consent at any time (this does not affect prior lawful processing).

To exercise any of these rights, please contact us at privacy@bosit.co.uk or contact@bosit.co.uk. We reserve the right to verify your identity before fulfilling any request.

We implement appropriate administrative, technical, and physical safeguards to protect your personal data, including but not limited to:

• TLS/HTTPS encryption for all website communications;
• secure infrastructure hardened against intrusion;
• strict access controls and role-based permissions;
• encryption and secret key management;
• network firewalls and real-time monitoring;
• continuous patching and system updates; and
• employee confidentiality undertakings and training.

Despite robust measures, no online transmission is entirely risk-free. BOSIT continuously reviews and enhances its information security framework.

We do not engage in automated decision-making or profiling that produces legal or significant effects on individuals. If this practice changes in the future, we will update this Policy and provide prior notice.

Our Website and Services are not intended for individuals under 16 years of age. We do not knowingly collect personal data from minors. If you believe that a child has provided us with their data, please contact privacy@bosit.co.uk so we can promptly remove it.

Our Website may contain links to external websites or resources. These third parties have independent privacy policies, and BOSIT bears no responsibility for their content, security, or data-handling practices. We recommend reviewing their privacy statements before submitting personal information.

We may revise this Privacy Policy periodically to reflect legal, technical, or operational developments. The “Last updated” date at the top of this page indicates when this Policy was last amended. Substantive changes will be communicated through our Website and, where necessary, renewed consent will be sought.