Global Privacy Notice for Bolt Business

Account Data

We generate and collect information used to identify your specific Bolt account on our systems, as well as:

• Date of your account creation 
• Your account status (e.g., active / suspended)
• Records of your account changes, including password reset requests

Profile Data

We collect personal data about you when you register to access the Bolt Business Portal:

• Full name
• Phone number
• Email address (optional)
• Your business data such as your company name, country, number of employees
• Preferences and settings related to the account, such as language preferences or communication preferences.

Payment Data

If you connect your personal credit card or your personal bank account as a payment method, we will collect details of such payment methods including payment card type, bank name, bank account number, bank account sort code, related payment verification information and transaction history on the Bolt Business Business Portal. For the Bolt Business Card, this also includes Wallet funding details, payment receipts, and Business Card activation information.  

Survey / Interview Data 

We collect the content of your replies or attachments you may send us, during the course of surveys and interviews that we conduct.

Communications Data

We collect communication and correspondence data when you engage with our Customer Support Team via the chat function in the Business Portal, communicate via emails, web forms, or speak with our Customer Support agents. We record the date and time of the communications and its content and your phone number (where you use the call feature). We will record calls, only where you are notified in advance that the call may be recorded.

Background Check Data

In countries where it is required by applicable laws or in accordance with market practices and requirements, we may collect personal data about you and your business after you submit your application to use Bolt Business services, in order to verify your identity and assess any compliance or financial risks. This may include:

• Personal data of the business representative, such as name, date of birth, identity documents, and photographs (e.g., a selfie)
• Business-related information and documentation, including tax identification numbers, business registration certificates, and other relevant credentials necessary for compliance and risk assessment

Category of personal data

Description of personal data

Usage Data

This includes information collected about how the services are accessed and used. This can encompass details like the dates and times of access, the interactions with the service, technical data like IP addresses, system crashes, and other system activity. For the Bolt Business Card, this also includes data related to the use of the Card Admin Dashboard and Card User Dashboard such as transaction authorisations, spending limits, and declined transactions.

User Generated Data

We collect personal data when you use the Business Portal. This may include:

• Content like pictures, videos, files in connection with a Customer Support request.
• Metadata related to the method you use to communicate with Bolt.

Cookies, SDKs, Analytics, and Third-Party Technologies Data

We collect information through the use of cookies, tracking pixels, data analytics tools, SDKs, and other third-party technologies like advertising IDs to understand how you navigate through the Bolt Business Portal, to make your experience safer, to improve your experience with the Bolt Business Portal, to serve you better ads on other sites (according to your marketing preferences), and to save your preferences. For more information about cookies, see our Cookie Declaration.

Device Data

We collect data about the devices you use to access the Bolt Business products, including the hardware model, device IP address and other unique device identifiers (such as your UUID and advertising identifiers), device operating system, browser version, device vendor name, manufacturer, and preferred languages.

Security Data

This includes security logs, authentication data, and data generated during Business Card issuance and activation (such as activation timestamps). It also includes data collected for security monitoring and fraud prevention, such as flagged IP addresses, unusual login attempts, and high-risk transaction patterns.

Category of personal data

Description of personal data

Profile Data

We collect contact data about you when you connect to the Bolt Business Portal via a third party service such as Google or when another Customer’s Representative creates your account. In this case, we will process your:

• Full name
• Phone number
• Email address
• User ID (optional)

Security Data

We may additionally collect Security Data from third-party security monitoring services, e-money and debit card issuers, payment processors, and financial institutions regarding potentially fraudulent activities, chargebacks, or suspicious transactions related to the use of the Bolt Business Card.

Background Check Data

In countries where it is required by applicable laws, we may obtain background check data about you and your business from publicly available sources and third-party service providers. This may include:

• Publicly available information about the business representative, such as professional profiles (e.g., LinkedIn)
• Results of regulatory screenings, including checks against global sanctions lists, watchlists, and databases of politically exposed persons (PEPs)

Business Development Data

We may collect personal data about you from publicly available professional sources, business directories, or third-party business contact databases to understand your potential interest in Bolt Business products and services. This may include:

• Full name
• Business email address
• Job title and employer
• Publicly available information about the business representative, such as professional profiles (e.g., LinkedIn)

To create, update and maintain your account and manage your Business Card 

• Performance of a Contract 

• Profile Data
• Communications Data
• Device Data
• Account Data

To make sure the Bolt Business Portal and the Card Admin Dashboard work optimally

We use your Profile Data to notify you of updates to the Bolt Business products so you can keep using them. We also use Device Data and Usage Data to ensure you can connect to the Bolt Business Portal and to help keep your account safe through authentication and verification checks.

• Performance of a Contract 
• Consent - your opt-in consent is required for the use of Cookies, SDKs, Analytics, and Third-Party Technologies Data.

• Usage Data
• Device Data
• Cookies, SDKs, Analytics, and Third-Party Technologies Data
• Account Data

To calculate and facilitate payments, refunds, Wallet funding, and Business Card transactions

We process personal and transaction data to calculate and execute payments, issue refunds, fund Wallet balances, and facilitate Bolt Business Card transactions. 

• Performance of a Contract 

• Profile Data
• Payment Data
• Security Data

To get your feedback on your level of satisfaction with Bolt services through surveys and interviews 

• Consent - your opt-in consent will be required. 
• Legitimate Interests - It is in our interest and in the interest of Customers to improve our services.

• Profile Data
• Survey / Interview Data
• Account Data

To reach out with instructions on how to use the Bolt Business Portal and the Bolt Business Card, including via calls/messengers

• Legitimate Interests - It is in our interest to ensure that you understand how to use our services efficiently, which improves user experience and engagement.

• Profile Data
• Usage Data
• Device Data

For logistics and Business Card delivery

• Performance of a Contract - Processing is necessary to deliver the Bolt Business Card as requested by you or your company.

• Profile Data
• Usage Data
• Communication Data
• Security Data

To set and change spending limits on Business Cards, suspend or cancel Business Cards, and decline transactions

• Legitimate Interests - It is in Bolt’s and Customers’ interest to enforce Customer’s spending terms, and prevent excessive spending, or unauthorised transactions.

• Profile Data
• Payment Data
• Usage Data
• Security Data
• Device Data

To improve our websites and Bolt Business products

We collect and may use your Usage Data to improve our websites and Bolt Business products (including their security features) by analysing it to better understand our business and services.

• Legitimate Interest - to improve the performance, security, and user experience of our websites and the Bolt Business Portal. 

• Usage Data
• Cookies, SDKs, Analytics, and Third-Party Technologies Data

Purpose of processing 

Legal Basis

Categories of Personal 

Data

To provide customer support services and receive and process feedback

We process your personal data to investigate and address your queries including reported safety incidents/alleged criminal acts and complaints. We also use the data you share to address quality issues and to improve our services.

We may use automated processes for complaint resolution purposes via our automated chat function. For further information regarding how to object to the above activities, please see Section 9 “What are your rights?” below.  

• Performance of a Contract 
• Legitimate Interests - it is in our interest and in the interest of our Customers to continuously  improve and develop our customer relationship management processes.

• All Data

Purpose of processing 

Legal Basis

Categories of Personal 

Data

To ensure compliance with our General Terms and Conditions for Bolt Business and issue temporary suspensions

In order to provide a safe and reliable service, we monitor Customer’ compliance with our General Terms and Conditions for Bolt Business and may temporarily suspend access to the Bolt Business Portal for Representatives and/or Customers:

• If the you and/or the Customer cause any abuse or harm to the Bolt Business products, 
• If Bolt has reasonable belief of fraudulent acts by the you or/and Customer when using the Bolt Business products, or
• If you and/or the Customer otherwise fails to comply with the obligations under the General Terms and Conditions for Bolt Business.

• Performance of a Contract 
• Legitimate Interests - It is in our interest to prevent and address violations of our General Terms and Conditions for Bolt Business, and ensure a reliable and trustworthy service and Bolt Business products sustainability.

• Profile Data
• Usage Data
• Payment Data 
• Communication Data
• Background Check Data
• Security Data
• Account Data

To manage risks of financial transactions, ensure compliance with sanctions, and prevent, detect and investigate fraud or other unlawful acts

Our automated anti-fraud system will identify fraudulent accounts, payments, abuse of Bolt’s services and other malicious activity on the Bolt Business Portal. To enable us to investigate, a temporary suspension may be applied to Representatives and/or Customers.  

While Bolt may use automated processes for fraud detection purposes, decisions on the blocking are taken following human review by our staff, and no account is blocked automatically without first undergoing a verification process. For further information regarding how to object to the above activities, please see Section 9 “What are your rights?” below. 

• Legitimate Interests - It is in our interest to detect, prevent and address fraud or other harmful or illegal activity and maintain the safety and security of our systems and financial transactions.
• Compliance with Legal Obligations - Bolt may be subject to regulations requiring action by Bolt to prevent and respond to fraud, money laundering, and other unlawful acts.

• Profile Data
• Usage Data
• Payment Data 
• Communication Data
• Background Check Data
• Security Data

To monitor financial transactions and account activity for security threats, such as unusual spending behavior, unauthorised login attempts, or high-risk transactions

• Legitimate Interests - It is in Bolt’s and Customers’ interest to detect security breaches, respond to unauthorised access, and ensure the integrity of financial transactions.

• Security Data
• Usage Data
• Background Check Data
• Payment Data
• Profile Data
• Security Data

To ensure the security of the Bolt services

Depending on the issue, All Data may be used for technical and cyber security reasons: for example measures for combating piracy and ensuring the security of the service, website, Bolt Business Portal as well as for making and storing back-up copies and preventing/repairing technical issues.

• Legitimate Interests - It is in our interest and in the interest of our Customers to protect, guard and maintain Bolt’s security systems, respond to suspected or actual criminal acts and repair any technical issues.

• All Data

To market and advertise Bolt services and those of partners according to your preferences and measure the effectiveness of Bolt’s ads

This includes using your personal data to send and personalise emails, text messages (including WhatsApp messages), and other communications marketing Bolt’s products, services, features, offers, promotions, sweepstakes, news, and events of Bolt and our partners.

We use pixels and similar technologies to track which emails are opened and which links are clicked by you, to help us measure the results of our campaigns. We may also share your personal data with third parties, or collect data regarding your visits and actions on third-party apps or websites, for the purposes of personalised ads.

• Legitimate Interests - It is in our interest and in the interest of our Customers to inform them about our services and features or those offered by Bolt partners. It is also in our interest to promote and advertise our services, including engaging in contextual (non-data driven) and personalised direct marketing and advertising, analytics, and measurement of ad performance, in order to expand our user base by deepening relationships with existing Customers and developing new ones. You can opt out of these communications at any time by clicking the 'unsubscribe' link at the bottom of our emails, typing “STOP” for messages and SMS, or updating your communication preferences in your account settings.
• Consent - your opt-in consent will be required for example, when the law requires consent for email marketing and for certain tracking technologies.

• Profile Data
• Usage Data
• Device Data
• Cookies, SDKs, Analytics, and Third-Party Technologies Data
• Account Data

For business development and informational outreach

To inform you about Bolt Business products and services that may be relevant to your role or organisation, and to invite you to participate in informational sessions such as webinars or product briefings. This may include contacting you through publicly available professional channels or business contact databases, where appropriate.

• Legitimate Interests - It is in our interest to share relevant information about our services with professionals who may benefit from them, and to foster engagement through informational events.
• Consent - your opt-in consent will be required for example, when the law requires consent for sending any direct marketing communications and for certain tracking technologies.

• Business Development Data
• Cookies, SDKs, Analytics, and Third-Party Technologies Data

To perform research, testing, and analytics to better understand and improve our business and services

For example, we use Usage Data, Security Data, and Communication Data to conduct research to develop or improve our products, services, technology, algorithms, machine learning, and other modelling. 

We use Communication Data related to incidents to monitor our security practices and improve our operations and processes. 

• Legitimate Interests - it is in our interest to measure the use of our services in order to inform business decisions and to enable provision of accurate and reliable reporting and to continuously improve and develop the services we provide. 
• Consent - for certain analytics we may require your consent. If so, you'll be prompted to provide consent for specific purposes and processing activities, with details on how to withdraw consent.

• Usage Data Communications Data
• Survey / Interview Data
• User Generated Data
• Device Data
• Security Data

To develop new products, features, partnerships and services

• Legitimate Interests - it is in our interest and in the interest of our Customers  to develop and adopt new features to improve the Bolt Business products.

• All Data

To prevent, find, and resolve software or hardware bugs and issues 

• Legitimate Interests - it is in our interest and in the interest of our Customers to provide a hassle free and reliable service.

• All Data

Purpose of processing 

Legal Basis

Categories of Personal 

Data

To communicate with you, including sending you service-related communications and to keep you informed

Your name, phone number and email address will be used to communicate with you to send you reports, to let you know that an order or a transaction has been completed, and to inform you about important service updates.

• Performance of a Contract

• Profile Data
• Usage Data
• Account Data

Purpose of processing 

Legal Basis

Categories of Personal 

Data

To investigate and respond to claims and disputes relating to the use of Bolt services, and/or necessary for compliance with applicable legal requirements or with requests from government/law enforcement bodies

Depending on the claim, All Data may be processed for establishing, exercising or defending legal claims, including:

• supporting our own internal investigations; 
• the assignment of claims and the use of debt collecting agencies; and
• the use of legal advisors.

In some circumstances, we are legally obliged to share information with external recipients. For example, under a Court Order or where we cooperate with a data protection supervisory authority in handling complaints or investigations. We also respond to requests, such as those from law enforcement agencies, when the response is required by law or furthers a public interest task such as an emergency situation or where someone’s life is at risk. We will take steps to ensure that we have a lawful basis on which to share the information, and we’ll make sure that we document our decision. 

• Compliance with Legal Obligations - We process personal data to comply with an obligation, when there is a request from a regulator, law enforcement or other governmental body. 
• Legitimate Interests - In the context of litigation or other disputes, it is in our interest to protect our interests and rights,  our Customers or others, including as part of investigations,  regulatory inquiries or litigation.

• All Data

To fulfil our tax obligations and comply with tax legislation 

• Compliance with a Legal Obligation

• Profile Data
• Payment Data 
• Usage Data

To reorganise or make changes to our business

• Legitimate Interests - it is in our interest to process personal data for organisational and business planning purposes. 

• All Data

Bolt Group Companies and partners

We may share your personal data with our Bolt Group Companies (including Bolt local subsidiaries), third party partners, their affiliates and representatives, who may use your personal data in the manner described in this Notice. If Bolt local subsidiaries are responsible for processing your personal data, they may share your personal data with Bolt Operations OU as the main data controller for Bolt.

Third-party service providers

Our third-party vendors and other service providers and contractors have access to your personal data to help carry out the services they are performing for us or on behalf of us. This may include vendors and providers who provide email or electronic communication services, tax, legal services, product fulfilment, credit checks, payment processing, customer relationship management, fraud prevention and detection, web hosting and cloud storage, research, including surveys, analytics, crash reporting, performance monitoring and artificial intelligence, machine learning and statistical services. For the Bolt Business Card product, this also includes third parties such as payment processors, e-money and debit card issuers, card schemes, financial institutions, and risk management service providers who assist with card issuance, card delivery and courier services, transaction processing, Wallet funding, security monitoring, and regulatory compliance. We may also use providers to support our business development and outreach activities.

Promotional, marketing and strategic partners

We may share limited data like your email address with our promotional, marketing and strategic partners so that they can inform you about promotional events and provide you with information and marketing messages about products or services that may interest you. 

In addition, we may share your personal data with marketing platform providers, including social media advertising services, advertising networks, third-party data providers, to reach or better understand our users and measure the effectiveness of our ads on other platforms and with social media platforms, including Facebook and Google, for sign-in purposes. 

Other third parties

In the event of a likely change of control of the business (or a part of the business) such as negotiations for a sale, an actual sell, a merger, and acquisition, or any transaction, or reorganisation, we may share your personal data with interested parties, including as part of any due diligence process with new or prospective business owners and their respective professional advisers. We may also need to transfer your personal data to that third party or re-organised entity after the sale or reorganisation for them to use for the same purposes as set out in this Notice.

Public authorities and law enforcement

We may disclose information under a court order or where we cooperate with a data protection supervisory authority in handling complaints or investigations. For example, we may also share your personal data with law enforcement or other public authorities, including responding to requests when the information is required by law or furthers a public interest task. In any  scenario, we will take steps to ensure that we have a lawful basis on which to share the information, and we’ll make sure that we document our decision.

Personal data retained until you remove/delete it

It's your right to request that we delete your personal data. See Section 9 “What are your rights?” below for more information.

Personal data that expires after a specific period of time

We have set certain retention periods so that some data is not retained after a specific period of time. See table below for further details.

After a retention period has lapsed, the personal data is securely deleted, unless it is necessary for the establishment, exercise or defence of legal claims. 

Personal data retained until the Customer deletes its account.

We keep your data until the Bolt Business account is deleted unless further retention of certain personal data are required for the purposes described in the second table below. 

Tax, accounting and financial reporting purposes

We retain data for up to 10 years after the last order if your personal data is necessary for tax, accounting and financial reporting purposes.

Provision of services purposes

We retain your data as long as you have an active account. If your account is deleted, personal data will be deleted (according to our retention schedule and rules), unless such data is still required to meet any legal obligation, or for accounting, dispute resolution or fraud prevention purposes. You may request deletion of your account at any time via the Bolt Business Portal or by contacting our Customer Support Team. See Section 9 “What are your rights?” below for more information.

Formal investigations of a criminal offence, fraud or false information

We retain data for as long as necessary according to the internal, legal, and regulatory requirements, in the event that there are formal investigations of a criminal offence, fraud or false information having been provided.

Disputes

We retain data for the purpose of exercising or defending legal claims, including supporting our own internal investigations, including claims related to the unlawful processing or collection of user’s consent, until the claim is satisfied or the expiry date of such claims. 

Complaints

We retain a record of all complaints which we make available to an authorised officer of the licensing authority on request in the case of an investigation for 12 months.

Customer Support 

We retain data in relation to support tickets submitted via the Bolt Business Portal, phone calls, web forms, and emails for 3 years from the last communication. For data related to the Bolt Business Card product, this retention period is extended to 5 years in accordance with regulatory requirements.