Legal
Privacy Notice
This notice explains what personal information Boklink collects through this website, why it is collected, how it is handled, and the choices available to the people it relates to.
The section headings below follow the structure a privacy notice is expected to cover, so your legal adviser has a complete frame to work from. Sentences that describe facts about Boklink — the contracting entity, retention periods, processors, contact addresses — are deliberately left blank and marked as required inputs instead of being invented.
Do not publish this page as-is. Replace every marked placeholder with text approved by Boklink legal, then remove the draft notice at the top of the page.
Required inputs before publication
The following facts must be supplied by Boklink and confirmed by legal counsel. Until they are provided, the corresponding sections below remain marked as placeholders.
Not part of the published notice
- Full legal entity name, registration number, and registered address of the data controller.
- The contact address for privacy requests, for example
privacy@…. - Whether a Data Protection Officer or EU/UK representative has been appointed, and their contact details.
- The list of categories of recipients and the current list of sub-processors, by name.
- Retention periods per data category, or the criteria used to determine them.
- The countries or regions where data is hosted and processed.
- The specific legal bases relied on for each processing purpose.
- Whether the notice is extended by regional addenda, and if so for which regions.
Scope of this notice
This notice applies to personal information collected through the Boklink website, the forms on it, and the sales and support conversations that start there. It covers visitors, people evaluating Boklink, and contacts at customer organizations.
Information held inside the Boklink software on behalf of a customer organization is handled under the agreement with that organization, not under this notice. That organization decides what is stored and why, and questions about that data should be directed to it.
To be supplied before launch
- Confirm which domains this notice covers, and whether subdomains or regional sites are included.
- Confirm whether mobile applications are in scope.
Information we collect
Information is collected in three ways: what you enter into a form, what is recorded automatically when a page is used, and what is exchanged when you contact Boklink.
- Details you provide. Contact and business details entered into the free trial, demo, login, or contact forms — such as name, work email address, company name, company size, industry, and any message you write.
- Details from a conversation. Notes from sales and support exchanges, including the channel they took place on.
- Information recorded automatically. Technical and usage information such as IP address, browser and device type, pages viewed, and referring address, recorded through standard server logs and any analytics in use.
- Information from cookies and similar technologies. Described separately in the Cookie Notice.
To be supplied before launch
- Confirm the exact field list of every live form, and whether any field captures special-category data.
- Confirm whether analytics, session recording, or advertising pixels are actually deployed.
- Confirm whether a CRM or marketing automation system receives the form submissions, and its name.
- Create the side-by-side category table, mapping each data category to purpose, legal basis, and retention.
How we use information
- Responding to enquiries, demo requests, and trial requests.
- Providing, operating, and supporting the services a customer has subscribed to.
- Confirming identity and managing access to accounts.
- Understanding how the website is used, so it can be improved.
- Sending service messages, and marketing communications where consent or another lawful basis applies.
- Meeting legal, tax, accounting, and security obligations.
To be supplied before launch
- State, per purpose, the legal basis relied on (contract, legitimate interests, consent, legal obligation) for the regions you serve.
- Confirm whether legitimate interests are relied on, and describe the balancing assessment if so.
- Confirm whether automated decision-making or profiling takes place. If it does, this must be described explicitly.
When we share information
Information is shared only where it is needed to run the website and the services behind it, or where the law requires it. Categories of recipients are disclosed here so they can be reviewed.
- Service providers that host, secure, and operate the website and its forms.
- Providers that support sales, support, and email delivery.
- Professional advisers, where advice is required.
- Authorities, where disclosure is legally required and properly requested.
- A successor organization, if a business transfer takes place.
Boklink does not sell personal information.
To be supplied before launch
- Provide the named sub-processor list and confirm whether the page links to a maintained public list.
- Confirm the statement that personal information is not sold, and check it against the practices of any advertising tools in use.
- Confirm whether data is shared with group companies outside the contracting entity.
International transfers
Where information is transferred outside the region it was collected in, the transfer is made under a recognized safeguard, and the mechanism used is identified here.
To be supplied before launch
- List the hosting and processing regions in use, by provider.
- Identify the transfer mechanism relied on, such as standard contractual clauses, and where a copy can be requested.
- Confirm whether a transfer impact assessment has been completed.
How long we keep data
Information is kept only as long as it is needed for the purpose it was collected for, or as long as the law requires it to be kept. Retention periods differ by category.
To be supplied before launch
- Provide a retention period, or the criteria used to set one, for each category listed in section 2.
- Confirm what happens to enquiry data from people who never became customers.
- Confirm the deletion process and where deletion is enforced by the systems in use.
How we protect data
Access to personal information is limited to people who need it, transfers use encryption in transit, and systems are monitored for unauthorized activity. The controls in place are described in more detail on the security page.
To be supplied before launch
- Confirm whether an independent certification or audit report exists, and state its scope and date.
- Provide the incident response and breach notification commitments, including the notification window.
Your rights and choices
Depending on where you live, you may have the right to be informed about how your information is used, to request a copy of it, to have inaccurate information corrected, to have information deleted or its use limited, to object to certain processing, to receive information in a portable format, and to withdraw consent where processing is based on it.
Requests can be made using the contact details in section 11. Requests are answered within the period required by the applicable law, and identity may need to be verified first.
To be supplied before launch
- Confirm which regional regimes apply to the visitors you serve, and add any rights those regimes grant beyond the list above.
- Confirm the response deadline to be stated, and the internal process for handling requests.
- State how to contact a supervisory authority, and how to opt out of marketing communications.
Cookies
This website uses cookies and similar technologies for the purposes described in the Cookie Notice, which also explains how to control them.
Changes to this notice
This notice is updated when practices change or when the law requires it. The effective date is shown at the top of this page, and material changes are communicated through the website or by direct notice.
To be supplied before launch
- Confirm how effective dates are recorded and where previous versions are archived.
- Confirm how customers will be notified of material changes, and how much advance notice is given.
How to contact us
Questions about this notice, and requests relating to personal information, can be sent to the contact address below. Questions about the software workspace are best directed to your account administrator.
Contact details to be supplied
- Privacy contact email address, and whether postal requests are accepted.
- Postal address for the responsible entity.
- Details of the Data Protection Officer or representative, if one has been appointed.