Personal data protection policy

1. Purpose and scope

This policy describes how IKKI’S DIGITAL OÜ, a company under Estonian law operating the continuous operational intelligence platform BOUCLR, collects, processes, protects and deletes personal data in the course of its activities.

It applies to all processing carried out by the company, whether acting as a data controller (for its own purposes) or as a processor within the meaning of Article 28 GDPR (on behalf of its business clients).

The company’s clients are currently mainly established in the European Union. Should the company open its services to clients established outside the Union, the safeguards described in chapter 8 (international transfers) apply, and relevant local legislation is analysed case by case before entering into a relationship.

2. Identity and contact details of the controller

• Company: IKKI’S DIGITAL OÜ (osaühing, private limited company under Estonian law).
• Estonian commercial register (registrikood): 17422679.
• EU VAT number: EE102948413.
• Registered office: Järvevana tee 9, 11314 Tallinn, Kesklinna linnaosa, Harju maakond, Estonia.
• Legal representative: Bernard Quenon, CEO.
• Data protection contact: through the form on the Contact page (bouclr.com/en/contact).
• The company has not appointed a Data Protection Officer (DPO), as its processing does not require one under Article 37 GDPR. The contact point above centralises all requests relating to personal data.

3. The company’s two roles

Data controller: for data processed for the company’s own purposes. Examples: visitors of bouclr.com, B2B prospects, business contacts, platform user accounts, invoicing.

Processor (Article 28 GDPR): for data processed on behalf of and under the documented instructions of business clients, through the BOUCLR platform. Examples: retailers’ customer files (identity, contact details, purchase history), transactional data from the client’s systems (e-commerce, ERP, POS, PMS, marketing).

Principle: when BOUCLR processes the data of a retailer’s end customers, that retailer remains the data controller. IKKI’S DIGITAL OÜ acts exclusively on its instructions, under a data processing agreement (DPA) concluded with each client and annexed to the services contract.

4. Processing carried out as a data controller

• Platform user accounts: email, display name, role, login records. Legal basis: performance of a contract (art. 6.1.b). Retention: account lifetime, then deletion.
• Business relationship and invoicing: contact identity, professional contact details, billing data. Legal basis: performance of a contract and legal obligation. Retention: 7 years (Estonian accounting obligation).
• B2B prospecting: company name, VAT number, identity and role of professional contacts, professional email and phone, website, public online presence. Legal basis: legitimate interest (art. 6.1.f), business-to-business prospecting with a simple and immediate right to object. Retention: 3 years after the last contact; objection requests are kept durably to guarantee they are honoured.
• bouclr.com contact form and signup: first name, last name, company, email, phone, subject of the request and message. Legal basis: pre-contractual measures (art. 6.1.b). Retention: 3 years after the last contact.
• bouclr.com audience measurement: anonymised browsing data (truncated IP), only after explicit consent through the consent banner. Legal basis: consent (art. 6.1.a). Consent cookie: 12 months.
• No decision producing legal effects is taken in a solely automated manner with regard to data subjects. No data is ever sold or rented to third parties.

5. Processing carried out as a processor (BOUCLR platform)

BOUCLR is a continuous operational intelligence platform. On the client’s instruction and with the access credentials the client provides, it connects to the systems the client already uses (e-commerce platform, marketing tool, ERP, POS, PMS, CRM), consolidates the relevant data in a dedicated and isolated space, produces analyses and recommendations, then carries out the validated actions according to the execution mode chosen by the client (manual, assisted, semi-automatic or automatic). Humans always remain in the loop, at the level they choose.

Categories of data processed on behalf of clients:

• Identity: first and last name of the retailer’s end customers.
• Contact details: email address, phone number, city, region, country.
• Commercial data: order history (amounts, currency, channel, items), POS receipts, store visit dates, home store, loyalty number.
• Marketing consents: email and SMS subscription status as managed in the client’s tools.
• Contact history: campaign events (email, SMS, WhatsApp) and associated revenue.
• Technical identifiers: profile identifiers in the client’s third-party systems, used for synchronisation.

6. Data subjects, purposes and limits

Data subjects: end customers and prospects of business clients, B2B professional contacts of business clients, members of business clients’ teams with access to the platform.

Data is processed exclusively to provide the subscribed services: activity analysis and indicators, churn prevention, communication plans, order preparation, B2B prospecting, team training and other contractually activated modules. Any use for other purposes is excluded.

The platform does not process any special category of data within the meaning of Article 9 GDPR (health, opinions, biometrics, etc.) and is not intended to receive any. Clients contractually undertake not to inject such data into the platform.

7. Data access management

• Per-client isolation: every record stored in the platform is attached to a unique client identifier. All application queries are systematically filtered on that identifier: a user attached to a business client can technically only access that client’s data.
• CLIENT role: access limited to the data of their company or companies, as listed in their authorisation table.
• ADMIN role: full administration, strictly bounded to the companies they are authorised for. Cannot manage a higher-level account or extend their own rights.
• SUPER_ADMIN role: reserved for the IKKI’S DIGITAL OÜ team for operations, supervision and support. The only cross-tenant role.
• Authentication: OAuth SSO (Google, Microsoft) with minimal scopes (identity and verified email only); authentication tokens are not kept after verification. When a password is used, it is stored exclusively in hashed form with a random salt; no password is ever stored in clear text.
• Cryptographically signed sessions, httpOnly and secure cookies, automatic expiry after 7 days.

8. Sub-processors and transfers outside the EU

The company uses the following sub-processors. Only those corresponding to the modules actually activated by a client are engaged for that client. The up-to-date list is communicated to each client, who is informed of any change and has a right to object under the conditions of the DPA.

• Hetzner Online GmbH: hosting of the platform and database. European Union (Germany / Finland). Safeguards: GDPR, Hetzner data processing agreement.
• Cloudflare, Inc.: DNS, proxy and network protection. United States / global network. Safeguards: standard contractual clauses (SCC), EU-US Data Privacy Framework certification.
• Anthropic, PBC: artificial intelligence models (Claude), called via API at execution time only. United States. Safeguards: SCC / Data Privacy Framework; contractual commitment not to use API data to train models.
• Google LLC / Google Ireland: depending on activated modules (SSO, Google Drive, Google Business Profile, image and video generation). EU / United States. Safeguards: SCC / Data Privacy Framework.
• Microsoft Corporation / Microsoft Ireland: SSO, mailbox connection if activated. EU / United States. Safeguards: SCC / Data Privacy Framework.
• Groq, Inc. and OpenAI, LLC: voice transcription, only if the voice companion module is activated. United States. Safeguards: SCC / Data Privacy Framework.
• Meta Platforms Ireland Ltd: WhatsApp notifications, only if activated. EU / United States. Safeguards: SCC / Data Privacy Framework.
• Brevo (Sendinblue SAS): email sending if module activated. France (EU). Safeguards: GDPR.

9. Distinction: the client’s own providers

The systems BOUCLR connects to on the client’s behalf (e-commerce platform, marketing tool, ERP, POS, PMS, CRM) are the client’s providers, under direct contract between the client and those vendors. BOUCLR accesses them only with the credentials provided by the client and on the client’s instruction; they are not sub-processors of IKKI’S DIGITAL OÜ.

Data is hosted and stored in the European Union (Hetzner infrastructure). Transfers to providers established in the United States are governed by the adequacy decision on the EU-US Data Privacy Framework for certified providers, by the European Commission’s standard contractual clauses (Decision 2021/914) supplemented where necessary by additional measures, and, for AI model calls, by the minimisation and pseudonymisation measures described in chapter 10.

10. Artificial intelligence: what transits, what does not

Full details are available on the “Data architecture and security” page.

• Data is not hosted in the AI. It resides in the platform’s database, on servers located in the European Union. AI models are called via API, statelessly, at the precise moment a task is executed.
• Minimisation: only the elements strictly necessary for the task are transmitted. For churn analysis, for example, the transmitted profile is pseudonymised: an opaque reference replaces the identity, and neither the name nor the email appears in the request.
• No training: the selected model providers contractually undertake not to use data submitted via API to train their models.
• Compartmentalisation: each client may have their own dedicated, encrypted API key, so that their AI calls are contractually and technically attached to their own perimeter only.
• Traceability: every agent execution is logged in the platform, enabling a complete audit of what was transmitted and produced.

11. Technical and organisational security measures

• Secrets encryption: all client API keys and connection credentials are encrypted with AES-256-GCM (authenticated encryption, random initialisation vector). The master key is specific to each environment, stored outside the source code, and its absence blocks any storage: no secret can be saved in clear text.
• Encryption in transit: end-to-end TLS (automatic certificates, hardened proxy upstream). The application is never directly exposed to the Internet.
• Logical per-client isolation across all tables, with systematic application-level access controls.
• Least privilege: three-level RBAC, per-company named authorisations, no self-escalation of rights.
• Authentication: OAuth SSO without token retention, hashed passwords where applicable, signed and time-limited sessions.
• Infrastructure: containerisation, separated environments (pre-production / production), regular database backups, technical log rotation.
• Structural deletion: the data model is built with cascading deletion: deleting a client mechanically deletes all data attached to it.
• Organisation: cross-tenant access limited to the operations team, security review before every production release, secret audit on the source code.

12. Retention periods and deletion

The company applies the legal retention periods in force, no more, no less.

• Data processed on behalf of a client (customer files, transactions, events): duration of the contract. At the end of the contract: return on request in a structured format, then complete deletion no later than 60 days after termination (excluding backups, purged at their normal cycle), in accordance with Article 28.3.g GDPR.
• Agent execution logs (traceability and audit): duration of the contract, exclusively for transparency and support purposes. Deleted with the rest of the client’s data.
• User accounts: deleted when the account is closed or the contract ends.
• B2B prospecting: 3 years after the last contact. Objections kept durably so they are honoured.
• Contractual and accounting records: 7 years (Estonian accounting obligation).

13. Rights of data subjects

Every person has the right of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw consent at any time where processing relies on it.

Data for which IKKI’S DIGITAL OÜ is the controller: request through the Contact page. Response within one month at most.

Data processed on behalf of a business client: the request must be addressed to that client, the data controller. The company assists its clients in handling such requests (locating, extracting, rectifying, deleting) within the timeframes set out in the DPA. Any request received directly is forwarded without delay to the relevant client.

Any person may also lodge a complaint with the Estonian supervisory authority, the Andmekaitse Inspektsioon (www.aki.ee), or with the authority of their country of residence.

14. Data breaches

In the event of a personal data breach, the company notifies its affected clients without undue delay after becoming aware of it, with the information necessary to enable them to meet their own notification obligations (72 hours to the competent authority where applicable). An incident register is maintained, and remediation measures are documented.

15. Data processing agreement (DPA) and updates

A processing agreement compliant with Article 28 GDPR is concluded with each client. It specifies in particular: the subject matter and duration of the processing, its nature and purpose, the categories of data and data subjects, the obligations and rights of the controller, the sub-processor regime, assistance, audit, and the return and deletion of data at the end of the contract. This policy constitutes its descriptive foundation.

This policy is reviewed at least once a year and whenever the platform, sub-processors or regulations change significantly. The current version is published on bouclr.com.