Last update:
Privacy Policy
1. Data Controller
Boostified AB
Malmö, Sweden
info@boostifiedpay.com
2. Personal Data We Collect
2.1 User Account Data
-
Full name
-
Email address
-
Password (encrypted)
-
Profile information
-
Notification preferences
2.2 Workspace Data
-
Workspace name and settings
-
Team member emails
-
Uploaded Workspace Content
-
Logs and activity data
-
Workspace billing settings
2.3 Technical & Usage Data
-
IP address
-
Device identifiers
-
Browser and operating system
-
Login timestamps
-
Navigation and feature usage
2.4 Billing Data
-
Payment method
-
Transaction history
-
VAT and invoicing details
2.5 Communication Data
-
Emails sent from BOOSTIFIED—Pay
-
Responses and support messages
3. How We Use Your Data
We process your personal data to:
-
Provide and operate the platform
-
Secure and authenticate User accounts
-
Process payments and subscriptions
-
Improve platform performance
-
Deliver customer support
-
Send service announcements and product updates
-
Send marketing communications (opt-out available)
-
Comply with EU legal obligations (tax, accounting, fraud prevention)
3.1 Public content on our website
Boostified AB may display selected public workspaces, campaign presentations and related content on boostifiedpay.com to present and promote BOOSTIFIED—Pay. Website presentations may include workspace names, logos, descriptions, images and videos, and may appear in carousels, galleries or customer cases.
This use is subject to the permissions described in our Terms and Conditions and any applicable separate permissions. A content licence does not, by itself, supply a legal basis for processing personal data or consent from people depicted.
Private workspace content, messages, CRM records, internal notes, campaign applications, unpublished deliverables and compensation information are not covered by this promotional use.
Published content is available to the public worldwide and may be indexed by search engines. It may contain personal data, such as a person’s name, professional profile, image or voice. Boostified AB acts as the data controller for its own website promotion, even where it acts as a processor for other information stored on behalf of a customer.
This website-use permission does not cover paid advertising, social media posts or newsletters. Those uses require a separate assessment and the necessary permissions.
4. Legal Basis under GDPR
BOOSTIFIED—Pay processes data under the following legal bases:
-
Contract (Art. 6(1)(b)) – to provide the service
-
Legitimate Interest (Art. 6(1)(f)) – product improvement, security, fraud prevention
-
Consent (Art. 6(1)(a)) – marketing emails and newsletters
-
Legal Obligation (Art. 6(1)(c)) – tax, accounting, and compliance requirements
4.1 Legal basis for website presentations
For personal data in public professional listings, we may rely on legitimate interests under Article 6(1)(f) only where we have assessed and documented that the particular use is necessary, proportionate, reasonably expected and not overridden by the person’s rights. You may object to such processing.
For marketing presentations of identifiable people where consent is required, we obtain or verify consent covering the specific website use. Where we rely on consent under Article 6(1)(a), it must be freely given, informed and specific. It is not inferred from account creation, uploading material, making a profile public or accepting general Terms.
You may refuse or withdraw such consent without losing access to the Service. Consent for website promotion does not include permission to send marketing emails or use your content in paid advertising. A brand or workspace administrator’s approval does not automatically constitute another person’s consent.
5. Sharing of Data
We may share data with:
-
Payment processors
-
Hosting and cloud providers
-
Analytics and monitoring tools
-
Integration partners
-
Legal authorities when required
We do not sell personal data.
All processors operate under GDPR-compliant agreements.
6. International Transfers
Data may be transferred outside the EU/EEA only when adequate safeguards exist, such as:
-
EU Standard Contractual Clauses (SCCs)
-
Adequacy decisions
-
GDPR-compliant data processing agreements
7. Data Retention
We retain:
-
User account data while the account is active
-
Workspace content until deleted by the Workspace Owner
-
Billing data for 7 years as required by EU accounting law
-
Technical logs only as long as necessary for security and diagnostics
7.1 Promotional content and permission records
We retain website presentation material only while the relevant purpose, permission and legal basis remain valid. When content becomes private, is deleted, the relevant account is closed, or the necessary permission ends, we stop new uses and remove the material from our active website without undue delay.
We may retain limited records of the scope and date of a permission, the information provided at the time and any subsequent withdrawal to demonstrate compliance or handle legal claims. Where necessary, this separate recordkeeping relies on our legitimate interest in establishing compliance or legal rights, or an applicable legal obligation. Records are retained only as long as necessary for that purpose and are not used to continue promotional publication.
8. Your GDPR Rights
You may request at any time:
-
Access to your personal data
-
Correction of inaccurate data
-
Deletion (“right to be forgotten”)
-
Restriction of processing
-
Data portability
-
Objection to processing based on legitimate interest
-
Withdrawal of consent (for marketing emails)
To exercise your rights, contact: privacy@boostifiedpay.com
You may also contact info@boostifiedpay.com to object to a website presentation, withdraw consent or request removal of particular material. Where consent was given through another channel, we will facilitate withdrawal through an equally straightforward channel. Withdrawal does not affect the lawfulness of processing before withdrawal. External search engines or caches may retain copies temporarily outside our control.
You may lodge a complaint with your national Data Protection Authority.
9. Cookies & Tracking
BOOSTIFIED—Pay uses cookies and similar technologies for authentication, performance monitoring, analytics, and personalization.
A cookie banner will allow you to accept, reject, or manage categories of cookies in compliance with the ePrivacy Directive and GDPR.
10. Security Measures
We implement industry-standard measures including:
-
Encryption in transit and at rest
-
Access controls
-
Regular security audits
-
Monitoring and intrusion detection
-
Secure development practices
No system is fully secure, but we work continuously to protect your data.
11. Automated Decision-Making
BOOSTIFIED—Pay does not perform automated decision-making that produces legal or significant effects under GDPR Article 22.
12. Changes to This Policy
We may update this Privacy Policy from time to time.
Where changes materially affect our processing, we will provide additional notice as required by law. Publishing an update does not itself establish acceptance of new contractual terms or consent to new processing. Where new consent is required, we will obtain it before the relevant processing.
13. Contact Information
For questions, rights requests, or concerns:
Boostified AB
Kärleksgatan 2A, Malmö
211 49