1Who we are and what this policy covers
Blits B.V., trading as Blits.ai, is established at Prins Hendrikkade 21-E, 1012 TL Amsterdam, the Netherlands, and is registered with the Dutch Chamber of Commerce.
This policy covers the personal data Blits.ai determines the purpose and means for: visitors to www.blits.ai and our other websites, people who contact us or request a demo, contact persons at our customers, suppliers and partners, and people who apply for a job with us.
It does not cover the personal data a customer processes inside its own environment on the Blits.ai platform, including the content of conversations with that customer's bots and agents. For that data the customer decides the purpose and means, and section 2 explains what that means for both of us.
Questions about this policy, and requests about your personal data, go to privacy@blits.ai.
2Our two roles
Blits.ai appears in two different roles, and confusing them is the mistake this section exists to avoid.
Controller. For our websites, our marketing, our sales and support correspondence, our customer administration and our recruitment, Blits.ai decides why and how personal data is processed. This policy describes that processing.
Processor. For everything a customer puts into its environment on the platform, and for the conversations its bots and agents hold with end users, the customer is the controller and Blits.ai processes on its instructions. What we may and may not do with that data is set by the agreement with the customer and the data processing agreement that forms part of it, which Blits.ai provides on request.
If you are an end user of a bot built by one of our customers and you want to exercise a right over your data, contact that organisation. They decide what is processed and for how long. Where you contact us instead, we forward the request to them and tell you that we have done so.
3What we process, why, and on what basis
The table below lists, per group of people, what we process, for which purpose and on which legal basis under article 6 of the General Data Protection Regulation.
| Who | What | Purpose | Legal basis |
|---|---|---|---|
| Website visitors | IP address, device and browser type, pages visited, referring page, timestamps, and the cookies described in section 4 | Operating and securing the site, measuring how it is used, and, with your consent, marketing and advertising measurement | Legitimate interest for security and aggregated statistics; consent for the trackers that require it |
| People who contact us | Name, business email address, telephone number, company, and the content of your message or demo request | Answering your question, arranging a demo, and following up on it | Steps prior to a contract at your request, and our legitimate interest in doing business |
| Contacts at customers, suppliers and partners | Name, role, business contact details, correspondence, support requests and account history | Performing the agreement, supporting the service, invoicing, and keeping a record of what was agreed | Performance of a contract, and a legal obligation for the financial administration |
| Marketing contacts | Business contact details, company, interactions with our emails and website where you consented to tracking | Newsletters and business information about our services | Consent, or legitimate interest for existing business contacts, with an unsubscribe link in every message |
| Job applicants | The information in your application, correspondence and interview notes | Assessing your application | Steps prior to a contract at your request, and consent where we keep your details longer |
| Everyone | Security and access logs, and records of abuse or fraud signals | Protecting the platform, our systems and our customers | Legitimate interest in the security of our services |
We do not sell personal data, and we do not use automated decision making that produces legal effects for you or similarly significantly affects you.
5Artificial intelligence and conversation content
The platform sends what a user types or says to artificial intelligence services in order to produce an answer. This section states what happens to it.
Blits.ai does not use customer data or conversation content to train, fine tune or improve any artificial intelligence model, whether our own or that of a third party, unless a customer expressly asks us to and we agree it in writing.
We contract with the model providers we operate on terms that prohibit training on the content we send them. Where a customer supplies its own provider credentials, hosts its own model or requires a particular provider, that provider's terms apply to that processing and we cannot control them.
Whether conversation content is stored, and for how long, is a setting the customer controls. The platform supports masking of personal data, marking questions as sensitive so answers are not retained, and zero retention of conversation inputs and outputs. Blits.ai does not keep conversation content for its own purposes.
We do keep technical measurements about how the platform performs, such as timing, volumes, error codes and which model handled a request. We keep those minimal and use them to run and improve the service, not to analyse individuals.
7Transfers outside the European Economic Area
Some of our providers, including our customer relationship system and several artificial intelligence model providers, are established in the United States or process data there.
Where personal data goes outside the European Economic Area, we rely on an adequacy decision of the European Commission where one covers the provider, and otherwise on the European Commission's standard contractual clauses together with additional measures where the transfer requires them.
The platform supports regional hosting and regional model routing, so a customer that must keep processing inside a region can configure that. Details are agreed in the customer's agreement.
8How long we keep personal data
We keep personal data no longer than we need it for the purpose it was collected for, and then delete it or make it permanently anonymous. Where a retention period below is longer than the purpose requires in a particular case, the shorter period applies.
Where personal data is needed to establish, exercise or defend a legal claim, or where the law requires us to keep it, we keep it for that purpose for as long as it is needed, and we use it for nothing else. That also applies where you ask us to delete data: we tell you which data we keep on that ground and why.
| What | How long |
|---|---|
| Conversation content in a customer environment | As configured by that customer, including not at all. Blits.ai keeps none of it for its own purposes. |
| Technical and security logs | 12 months |
| Support correspondence and tickets | 10 years after the request is closed, because it is the record of what was reported, agreed and delivered, and we may need it to establish or defend a claim |
| Customer contact and contract data | For the term of the agreement and 24 months after it ends |
| Invoices and financial administration | 7 years, because Dutch tax law requires it |
| Marketing and prospect contacts | 24 months after the last meaningful contact, unless you unsubscribe sooner |
| Job applications | 6 months after the procedure ends, or 2 years if you agree to it |
| Backups | Backups rotate on a short cycle. Data deleted from our live systems disappears from backups as those rotate, and is not restored selectively. |
9Security
We apply measures appropriate to the risk, including encryption in transit and at rest, role based access control, masking of personal data, audit logging and continuous monitoring, and we hold ISO 27001 and SOC 2 certification and PCI DSS Level 1 Service Provider compliance for the services in scope.
Where a personal data breach occurs, we act without undue delay: we investigate, we limit the damage, we notify the customer where the data was processed on its behalf so that it can meet its own obligations, and we notify the supervisory authority and the people affected where the law requires it.
If you believe you have found a vulnerability, please report it to security@blits.ai. We will not pursue anyone who reports a genuine finding to us in good faith and gives us reasonable time to fix it.
10Your rights
Where Blits.ai is the controller, you have the following rights.
- Access: to know whether we process personal data about you, and to receive a copy.
- Rectification: to have inaccurate data corrected and incomplete data completed.
- Erasure: to have your data deleted, where we no longer need it or where you withdraw the consent it rested on.
- Restriction: to have processing limited while a dispute about accuracy or grounds is resolved.
- Portability: to receive the data you provided in a structured, commonly used and machine readable format, and to have it sent to another party where that is technically feasible.
- Objection: to object to processing based on our legitimate interest, and, for direct marketing, to object at any time, after which we stop.
- Withdraw consent: at any time, without affecting what was lawful before you withdrew it.
Send your request to privacy@blits.ai. We answer within one month and may extend that by two months for a complex request, in which case we tell you why within the first month. We may ask for information to establish who you are, and we use that information for nothing else.
A right is not absolute. Where the law allows us to refuse or limit a request, for example because we must keep the data or need it for a legal claim, we do only what is necessary, we explain which part we cannot honour and why, and we tell you that you may complain about that decision.
You may also lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the supervisory authority of the country where you live or work. We would appreciate the chance to resolve it with you first.
11Children
Our services are intended for organisations and are not directed at children. We do not knowingly collect personal data from anyone under 16 through our websites.
Where a customer builds a bot or agent that is aimed at, or may reach, children, that customer is responsible for the lawful basis, the notices and any parental consent required.
12Changes to this policy
We update this policy when our processing changes. The version and effective date are shown at the top, and the current version is always published on www.blits.ai together with a PDF that is identical to the published page.
Where a change materially affects you, we announce it on the site at least 30 days before it takes effect, and we tell our customers directly.
13Contact
Blits B.V. (Blits.ai), Prins Hendrikkade 21-E, 1012 TL Amsterdam, the Netherlands.
Privacy questions and requests: privacy@blits.ai. Security reports: security@blits.ai. Everything else: info@blits.ai.
This policy sits alongside our General Terms & Conditions and our end user licence agreement, both published on www.blits.ai. Where this policy and one of those documents describe the same thing, this policy governs how we handle personal data and those documents govern the contractual relationship.
This policy is governed by Dutch law. Your rights under data protection law, and your right to complain to a supervisory authority, are not affected by that choice.