Who is responsible for your data
BootDesk is operated by GRUPO OITO OÜ, registry code 17195338, VAT EE102965920, registered at Tartu mnt 67/1-13b, 10115 Tallinn, Estonia. For any personal-data matter: suporte@bootdesk.eu.
We are the controller of your account's data. When your team uses BootDesk to serve its own customers, the service data is processed by you — your organization is the controller and we act as processor, under Article 28 GDPR.
What data we collect
Account data. Name, work email, password (stored only as a hash) and, where applicable, your organization's billing details.
Service data. The conversations, contacts and attachments your team handles in BootDesk: WhatsApp messages, emails, transcribed audio, tickets, internal notes. This data belongs to your organization and we only process it to provide the service.
Technical data. Access logs, IP address, device type and essential session cookies. We also use aggregated analytics cookies to understand which pages work — never to follow people across sites.
Why we process this data
Three legal bases, depending on the purpose: performance of a contract (providing the service you signed up for), legitimate interest (platform security, abuse prevention, product improvements) and consent (non-essential cookies and marketing communications, revocable at any time).
Where data lives and for how long
The infrastructure runs in the European Union. We keep data while your account is active; after cancellation, service data is deleted within 30 days and backups within 90 days. Billing records are retained for the statutory period.
Who can access
Your team, with the permissions you configure. Our support team, only when you ask for help — with access logging and the minimum necessary. Essential subprocessors (hosting, audio transcription, email delivery), each bound by a data processing agreement under the GDPR. We do not sell data. Ever.
Your rights
You can request access, rectification, erasure, restriction or portability of your personal data, and object to processing based on legitimate interest. Just write to suporte@bootdesk.eu — we respond within 30 days. If you believe your rights have been infringed, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.
Changes to this policy
If we change anything relevant, we give advance notice by email and inside the product. Version history is available on request.