TERMS OF USE OF THE PLATFORM

Version 1.0 · 26 September 2026 · Bolutions LTD · effective from the date of publication

Article 1. Introductory provisions

These Terms of Use (hereinafter: the “Terms”) govern the conditions for using the Bolutions software platform (hereinafter: the “Platform”), which is operated by the company:

Bolutions LTD, registered in England and Wales under company no. 16576182, with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, email: office@bolutions.agency (hereinafter: the “Operator”).

The Platform is a software solution intended for businesses, for automated communication with their customers and users by means of an AI chatbot, for the monitoring and taking over of those conversations by staff, for managing enquiries and for the analysis of conversations.

These Terms constitute a legally binding agreement between the Operator and the user of the Platform.

By accessing the Platform, logging in to a user account or using any functionality of the Platform, the user is deemed to have read, understood and accepted these Terms.

If the user does not accept these Terms, the user is not authorised to use the Platform.

The Operator reserves the right to amend these Terms in order to align them with applicable regulations, to improve the functionality of the Platform or for other justified business reasons. The amended Terms are published on the Operator's website and apply from the date of their entry into force, unless otherwise specified.

Article 2. Definitions

Certain expressions used in these Terms have the following meaning:

Platform — the Operator's software solution comprising the AI chatbot, the inbox for monitoring and managing conversations, the records of enquiries and contacts, conversation analysis, as well as all modules, services, APIs and future upgrades.

Operator — the company Bolutions LTD, which develops and maintains the Platform and makes it available for use.

Client — a legal entity or sole trader that has contracted with the Operator for the use of the Platform for the purpose of communicating with its customers and users.

User — any natural person to whom the Client or the Operator has granted access to the Platform, including the Client's employees and associates.

Visitor — a natural person who talks to the Client's Bot, on the Client's website or via the Channels.

Bot — the Client's AI chatbot, which answers Visitors using artificial intelligence models, on the basis of the instructions and knowledge approved by the Client.

Channels — third-party messaging services (WhatsApp, Instagram, Messenger and others) whose accounts the Client connects to the Platform.

Client Content — price lists, descriptions of products and services, business rules, instructions for the Bot and other materials that the Client provides for the operation of the Bot.

User Account — an individual electronic account that enables access to the Platform.

Personal data — any data relating to a natural person whose identity is identified or identifiable, within the meaning of the Law on Personal Data Protection of the Republic of Serbia, the GDPR and the UK GDPR.

Special categories of personal data — data revealing health status, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, as well as data concerning sex life or sexual orientation.

Conversation — the messages exchanged by the Visitor, the Bot and the Client's staff, together with the files that the Visitor sends.

Article 3. Subject matter of the Platform

The Platform enables, among other things:

  • automatically answering Visitors by means of the Bot on the Client's website;
  • answering via the Channels that the Client connects;
  • monitoring conversations in the inbox, and the Client's staff taking them over and replying;
  • forwarding enquiries to the Client's staff and to systems that the Client designates;
  • managing contacts, enquiry stages and notes;
  • analysis of completed conversations;
  • other functionalities that the Operator subsequently makes available.

The Operator does not provide legal, medical, financial or other professional advice to Visitors. The Bot is a technical tool of the Client, which answers on behalf of the Client and within the limits of the knowledge and instructions that the Client has approved.

The Operator is not responsible for the accuracy of Client Content, for the Client's business decisions or for obligations that the Client assumes towards Visitors.

Article 4. User accounts

User accounts are assigned by the Operator or by the Client's administrator. Self-registration is not available.

The Client must provide the Operator with accurate, complete and up-to-date information and is responsible for its accuracy throughout the entire period of use of the Platform.

The Operator reserves the right to refuse to open, or to deactivate, a user account if:

  • the information provided is not accurate or complete;
  • there is reasonable suspicion of misuse of the Platform;
  • the user acts contrary to these Terms;
  • there is a legal or regulatory obligation requiring it.

Each user account is personal and may not be assigned to third parties.

The user is responsible for safeguarding their access credentials and must notify the Operator without delay if they suspect unauthorised use of the user account.

All activities carried out using a user account shall be deemed to be activities of the user to whom the account was assigned, unless the user proves that there was unauthorised access which they could not have prevented by applying reasonable protective measures.

Article 5. Permitted use of the Platform

The Client and Users may use the Platform solely for the purpose of lawfully carrying out their business activity.

The Client is responsible for using the Platform in accordance with:

  • the applicable regulations of the country in which it does business and of the countries whose residents the Bot addresses;
  • regulations on personal data protection, including the Law on Personal Data Protection of the Republic of Serbia (Official Gazette of RS, No. 87/2018), the GDPR and the UK GDPR, where applicable;
  • regulations on consumer protection, advertising and electronic commerce;
  • the terms of use of the Channels it connects;
  • these Terms.

The Operator is not responsible for the manner in which the Client uses the functionalities of the Platform or for the lawfulness of the data processing that the Client carries out via the Platform.

Article 6. Prohibited activities

The Client and Users are not permitted to:

  • use the Platform contrary to its intended purpose or for unlawful activities;
  • use the Bot to send unsolicited messages, for misleading advertising or for fraud;
  • request that the Bot claim to be a human, or that it conceal that it is AI when the Visitor asks it;
  • collect through the Bot data that are not necessary for the purpose of the conversation;
  • attempt to circumvent the security mechanisms of the Platform or to obtain access to the data of other Clients;
  • carry out reverse engineering, decompilation or any attempt to discover the source code of the Platform, except where expressly permitted by mandatory regulations;
  • use automated tools for mass downloading of data or for disrupting the operation of the Platform;
  • introduce malicious software;
  • share their access credentials with unauthorised persons;
  • use the Platform in a manner that could compromise its security, availability or integrity.

The Operator has the right to temporarily or permanently restrict access to the Platform for a Client or User who acts contrary to this Article, without prejudice to the right to compensation for damage if such damage has occurred.

Article 7. Artificial intelligence

The Bot composes answers using third-party artificial intelligence models, which the Operator selects and lists in the List of Subprocessors. The Operator may change the model for reasons of quality, price or availability of the service, and informs the Client thereof.

The Bot's answers are generated automatically and may be inaccurate, incomplete or inappropriate, despite the instructions and checks that the Operator applies. The Client is responsible:

  • for the accuracy and currency of Client Content;
  • for reviewing and approving the instructions under which the Bot operates;
  • for notifying the Operator without delay of any inaccurate answer it notices;
  • for obligations towards the Visitor that arise from the conversation.

The Bot does not conclude contracts, does not confirm prices or deadlines beyond what the Client has approved, and does not make decisions that produce legal effects concerning the Visitor.

The Bot is configured to confirm, when the Visitor asks, that it is an AI assistant. Where the Bot is also intended for persons in the European Union, or where another regulation so requires, the Bot presents itself as an AI assistant at the latest in the first interaction — by means of a greeting message or a label next to the input field. The Client must inform the Operator if its Bot also addresses persons in the European Union, and may not request a configuration that would remove this notice.

The Client's staff may take over a conversation from the Bot at any time. The Visitor is then informed that a person from the Client's team is joining them.

The Operator does not use conversations or Client Content to train artificial intelligence models. The Operator uses model providers exclusively at a service tier in which the provider does not use the data sent to it to train its models.

Article 8. Messaging Channels

The Operator connects the Platform to the Channels as a technical service provider (Tech Provider), on behalf of and on the instructions of the Client, exclusively for accounts that the Client connects itself.

By connecting an account, the Client accepts the terms of the Channel provider and is responsible for complying with them, including in particular, for the Channels of the company Meta: the Meta Terms for WhatsApp Business Platform and the WhatsApp Business Messaging Policy, the Meta Business Tools Terms, the Meta Platform Terms and the policies for Messenger and Instagram Messaging.

The Client is in particular responsible:

  • for having the Visitor's consent for messages that the Client sends to the Visitor on its own initiative, and for complying with the rules on the response time window and on template messages;
  • for providing the Visitor with a clear and direct route to a person from the Client's team — by taking over the conversation in the inbox, by telephone number or by email;
  • for using the Bot on WhatsApp as an auxiliary function of its own business, and not as a general-purpose AI assistant;
  • for not using Messenger and Instagram for direct conversations between individuals and healthcare providers, or for sending or collecting patient data.

Fees for messages that Meta calculates are charged to the Client directly, in accordance with the price list and terms of the company Meta.

The Operator is not liable for interruptions, restrictions or closure of accounts determined by the Channel provider, or for changes to its terms.

Article 9. Intellectual property rights

The Platform, its source code, design, user interface, databases, documentation, trade marks, business solutions, algorithms, graphic elements, texts and other intellectual property rights constitute the exclusive property of the Operator.

By using the Platform, the user does not acquire ownership or any other intellectual property right in the Platform.

The Operator grants the Client a limited, revocable, non-transferable and non-exclusive licence to use the Platform solely for the duration of the contractual relationship and in accordance with these Terms.

The Client is not permitted to:

  • sell the Platform;
  • sublicense the Platform;
  • distribute the Platform to third parties;
  • copy the Platform except to the extent necessary for its regular use;
  • remove copyright notices;
  • develop a competing product using the source code or other protected elements of the Platform.

Client Content remains the property of the Client. The Client grants the Operator the right to use Client Content solely for the purpose of providing the Platform to that Client, for the duration of the contractual relationship.

All feedback, suggestions and recommendations that the user voluntarily provides to the Operator regarding the improvement of the Platform may be used by the Operator without any obligation to compensate the user, provided that this neither transfers nor impairs the user's rights to the data they have entered into the Platform.

Article 10. Processing of personal data

The Operator processes personal data in accordance with applicable regulations, including the Law on Personal Data Protection of the Republic of Serbia (Official Gazette of RS, No. 87/2018), the UK GDPR and the Data Protection Act 2018, as well as the General Data Protection Regulation of the European Union (EU) 2016/679 (GDPR), where applicable.

Data are processed solely to the extent necessary for:

  • enabling the use of the Platform;
  • providing the contracted services;
  • maintaining, developing and improving the Platform;
  • protecting the security of the information system;
  • fulfilling the legal obligations of the Operator;
  • other purposes prescribed by applicable legislation or by the contract concluded with the Client.

The Operator processes only data that are adequate, relevant and limited to what is necessary to achieve the purpose of their processing, in accordance with the principle of data minimisation.

More detailed information on data processing is contained in the Privacy Policy, which forms an integral part of these Terms.

Article 11. Roles of the data controller and the data processor

In relation to the data of Visitors, the Client acts as the controller of personal data, while the Operator acts as the processor, within the meaning of the applicable regulations on personal data protection. Their mutual rights and obligations are governed by the Personal Data Processing Agreement (DPA), which the Client and the Operator conclude before the Bot starts operating.

The Operator processes the data of Visitors exclusively:

  • on the documented instructions of the Client;
  • to the extent necessary for the functioning of the Platform;
  • in accordance with the concluded contract and these Terms.

The Client is responsible for:

  • ensuring a lawful legal basis for processing the data of Visitors;
  • making a notice on data processing available to Visitors, including the fact that they are talking to an AI chatbot (the Operator provides a template for this purpose);
  • obtaining consent where it is required, including consent for cookies and pixels on its website;
  • responding to requests of Visitors to exercise their rights, with the assistance of the Operator;
  • keeping the records prescribed by applicable legislation.

The Operator will not use the data of Visitors for its own marketing, commercial or other purposes that are not related to the performance of the contracted services.

Article 12. Special categories of personal data

The Platform is not intended for processing special categories of personal data. The Bot does not ask for them, except where the Client — for example a healthcare institution — expressly uses the Bot specifically for that purpose, on its own legal basis and with its own data protection impact assessment.

If the Client intends to process special categories of personal data via the Bot, it must inform the Operator of this before the processing begins, so that it can be stated in the Personal Data Processing Agreement.

The Visitor may also write such data in the conversation of their own accord, without prompting by the Bot. Such data then become part of the conversation and are protected by the same measures as the other data.

Article 13. Security of the information system

The Operator applies appropriate technical and organisational measures to protect the confidentiality, integrity, availability and resilience of the information system, taking into account the nature, scope, context and purposes of the data processing, as well as the risks to the rights and freedoms of natural persons, all in accordance with Article 50 of the Law on Personal Data Protection and Article 32 of the GDPR and the UK GDPR, respectively.

The protective measures referred to in the preceding paragraph include in particular:

  • control of access to the information system and separation of the data of each Client;
  • user authentication and management of permissions;
  • encryption of data in transit and, through the database provider, at rest;
  • encrypted storage of access keys for Clients' systems and for the Channels;
  • private file storage with time-limited access;
  • allowing the Bot to operate only from websites approved by the Client, and limiting the number of requests;
  • keeping a record of actions in the inbox (audit log);
  • a separate testing environment, which does not write data into Clients' systems, except where this has been expressly agreed with the Client.

The Operator takes reasonable measures to prevent unauthorised access to data, their loss, alteration, destruction or any other form of unlawful processing.

Users must use the Platform in a manner that does not compromise its security or the security of the data of other users.

Article 14. Data storage and infrastructure

The Platform's databases are located on servers in the European Union.

Certain subprocessors of the Operator, as well as the parent companies of certain cloud infrastructure providers, have their registered office outside the European Economic Area and the United Kingdom, primarily in the United States of America, as a result of which data are transferred to, or accessed from, a third country. Such transfers are carried out with the safeguards described in the Privacy Policy and in the Personal Data Processing Agreement, having regard to Articles 63–65 of the Law on Personal Data Protection and Articles 44–49 of the GDPR and the UK GDPR, respectively.

An up-to-date list of subprocessors, indicating the type of service and the country of processing, is published on the Operator's website and constitutes Annex III to the Personal Data Processing Agreement.

Conversations are automatically deleted 12 months after the last message, as specified in more detail in the Privacy Policy and the Personal Data Processing Agreement.

Article 15. Confidentiality of data

The Operator undertakes to treat as confidential all data to which it gains access in the course of providing the services, unless their disclosure is a legal obligation or is necessary for the performance of the contracted services.

Access to the data is granted exclusively to persons for whom such access is necessary to perform the tasks within their remit and who are bound by an obligation of confidentiality.

The Operator takes appropriate organisational measures to prevent unauthorised disclosure, copying, alteration or use of the data at its disposal.

The obligation of confidentiality continues to apply after the termination of the contractual relationship between the Operator and the Client.

Article 16. Security incidents

A security incident is any event that may lead to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, data processed via the Platform.

Upon becoming aware of a security incident that may affect the data of the Client or of Visitors, the Operator will, without undue delay, take appropriate measures to limit the consequences of the incident and to restore the normal operation of the system.

The Operator will notify the Client of a personal data breach within the time limit set out in the Personal Data Processing Agreement and will provide reasonably necessary cooperation for the fulfilment of the obligations that the Client has as the data controller.

The Operator keeps a record of security incidents.

Article 17. Access to data by the Operator

Persons working for the Operator may access conversations and other data of the Client exclusively to the extent necessary for:

  • providing technical support to the Client;
  • diagnosing and correcting errors;
  • improving that Client's Bot — its knowledge, instructions and test examples, exclusively for that Client;
  • implementing security measures;
  • performing legal obligations or complying with a binding order of a competent state authority.

Any access to data is limited to the minimum scope of data that is objectively necessary to achieve the specific purpose, in accordance with the principle of least privilege and the principle of data minimisation.

Persons who may access data on behalf of the Operator are bound by a written instrument to keep the data confidential and to apply appropriate protective measures.

The Operator will not use the data it accesses for profiling Visitors, developing marketing activities, selling data or for any other purposes that are not directly related to the provision of the contracted services.

Article 18. Anonymised and aggregated data

The Operator may use anonymised and aggregated data on the operation of the Platform — the number of conversations, consumption, response speed, frequency of errors — solely for statistical, development and security purposes, provided that no natural person and no individual Client can be directly or indirectly identified from such data.

The content of the conversations of one Client, including its anonymised or derived forms, is not used for the operation or improvement of the Bot of another Client, or for the development or training of artificial intelligence models. For messages received via WhatsApp, this applies without exception.

The Operator will not attempt to re-link anonymised data to the identity of a particular person.

Article 19. Availability of the Platform and maintenance

The Operator makes reasonably expected professional efforts to ensure the continuous availability of the Platform and its uninterrupted functioning.

The Client agrees that, owing to the nature of information systems, as well as dependence on the providers of artificial intelligence models and of the Channels, it is not possible to guarantee uninterrupted operation of the Platform or the absence of all errors or interruptions in its operation.

The Operator has the right to temporarily restrict or suspend access to the Platform for the purpose of:

  • regular maintenance;
  • installing security patches;
  • improving functionality;
  • system migration;
  • resolving technical problems;
  • protecting the security of the information system.

Where reasonably possible, the Operator will notify the Client in advance of planned interruptions that may significantly affect the use of the Platform.

Extraordinary interruptions resulting from security incidents, infrastructure failures, outages at model or Channel providers, force majeure or other circumstances that the Operator could not reasonably have foreseen or prevented shall not be considered a breach of these Terms.

Article 20. Responsibility of the Client and Users

The Client is responsible for the lawfulness of all data that it enters or otherwise makes available via the Platform, as well as for Client Content.

The Client is in particular responsible for:

  • processing personal data in accordance with applicable regulations;
  • ensuring an appropriate legal basis for processing the data of Visitors;
  • ensuring that only authorised persons have access to the Platform, and removing the account of any person whose authorisation has ceased;
  • regularly updating Client Content;
  • keeping access credentials confidential.

The user bears responsibility for all activities carried out using their user account, unless they prove that such activities are the result of unauthorised access which they could not have prevented by applying reasonable protective measures.

The Client will notify the Operator without delay of any circumstance that may compromise the security of the Platform or of the data processed through it.

Article 21. Limitation of the Operator's liability

The Operator is liable for damage caused intentionally or through gross negligence, in accordance with applicable regulations.

To the fullest extent permitted by applicable regulations, the Operator shall not be liable for:

  • inaccuracy of Client Content and of data entered by users;
  • the content of the Bot's answers that results from Client Content or from instructions that the Client has approved;
  • the business decisions of the Client and obligations that the Client assumes towards Visitors;
  • the lawfulness of the data processing carried out by the Client;
  • interruptions in operation caused by the internet connection, telecommunications networks or third-party infrastructure, including model and Channel providers;
  • acts or omissions of cloud service providers, except to the extent that the Operator is liable for them under mandatory regulations;
  • loss of data resulting from the conduct of users;
  • unauthorised use of a user account resulting from the user's failure to protect their access credentials.

The Operator does not guarantee that the Platform will be suitable for particular business needs of the Client that have not been expressly agreed.

The Operator is not liable for indirect damage, lost profit, lost business opportunities, business interruption or other consequential damage, unless such liability is prescribed by mandatory regulations.

No provision of these Terms excludes or limits the liability of the Operator in cases where, under applicable law, liability cannot be excluded or limited.

Article 22. Force majeure

The Operator shall not be liable for failure or delay in performing its obligations if such failure or delay is caused by circumstances of force majeure.

Force majeure includes in particular:

  • natural disasters, fires, floods and earthquakes;
  • wars and terrorist acts;
  • epidemics or pandemics;
  • shutdown of telecommunications or energy systems;
  • large-scale cyber attacks;
  • decisions of state authorities;
  • other circumstances that the Operator could not reasonably have foreseen or prevented.

The Operator will take reasonable measures to remedy the consequences of force majeure and to restore the regular operation of the Platform as soon as possible.

Article 23. Suspension and termination of use of the Platform

The Operator may temporarily suspend or permanently disable access to the Platform if the Client or a User:

  • seriously breaches these Terms;
  • uses the Platform unlawfully;
  • compromises the security of the Platform;
  • uses the Platform in a manner that causes harm to the Operator, Visitors or other users.

Where circumstances permit, the Operator will give the Client the opportunity to remedy the identified irregularities within a reasonable time before permanently revoking access.

Termination of use of the Platform does not affect obligations that by their nature continue to apply after the termination of the contractual relationship, including the obligation of confidentiality, data protection and respect for intellectual property rights.

Article 24. Export and deletion of data

Data that the Client enters, or that are generated through the use of the Platform for the Client — conversations, contacts, notes — remain the Client's data.

The Client has the right, during the term of the contract and no later than 30 days after its termination, to request an export of those data. The Operator will enable the export in a structured and machine-readable format, to the extent that this is technically feasible.

The Operator is not obliged to hand over to the Client:

  • the source code of the Platform;
  • internal algorithms and instructions that are not Client Content;
  • the business logic of the Platform;
  • security mechanisms;
  • information that constitutes a trade secret of the Operator.

The Operator deletes the Client's data no later than 30 days after the export has been carried out or, if no export has been requested, after the expiry of the period for requesting an export, unless:

  • a regulation to which the Operator is subject requires them to be retained further;
  • the data are contained in backup copies, which are deleted at the end of the regular retention cycle and are not used in regular operations.

The Operator will not unjustifiably hinder or prevent the Client from retrieving its data.

Article 25. Audit log

The Platform keeps a record of users' actions in the inbox (audit log), including information on who performed an action, when and from which IP address, without the content of the modified data.

The record referred to in the preceding paragraph is kept solely for the purpose of:

  • ensuring the security of the Platform;
  • data protection;
  • detecting and preventing misuse;
  • resolving technical problems;
  • fulfilling legal obligations;
  • protecting the rights and legal interests of the Operator and the Client.

The Client agrees that the Operator may use data from the audit log as evidence of actions performed in the resolution of technical problems, security incidents or court and other proceedings, to the extent permitted by applicable regulations.

Article 26. Electronic communication

The Client agrees that the Operator may deliver all notices relating to the use of the Platform electronically, including via:

  • the email of the Client's contact person;
  • notifications within the Platform;
  • other electronic communication channels that the parties use.

A notice is deemed duly delivered at the moment it is sent to the email of the Client's contact person or made available via the Platform.

The Client is responsible for keeping its contact details accurate and up to date.

Article 27. Changes to the Platform

The Operator reserves the right, at any time, to:

  • improve the functionalities of the Platform;
  • introduce new modules;
  • modify existing functionalities;
  • remove functionalities that are no longer supported;
  • carry out technical improvements to the system.

The Operator will endeavour to make changes that may significantly affect the way the Platform is used available to the Client in advance, by means of an appropriate notice.

Changes to the Platform that constitute security improvements or the remedying of technical deficiencies may be implemented without prior notice where this is necessary to protect users or the information system.

Article 28. Amendments to the Terms

The Operator has the right to amend or supplement these Terms for the purpose of:

  • alignment with applicable regulations;
  • improving the Platform;
  • developing new functionalities;
  • changes to the business model;
  • other justified business reasons.

The amended Terms are published on the Operator's website, and the Client is notified of significant amendments at least 15 days in advance.

If the Client continues to use the Platform after the amendments enter into force, the Client shall be deemed to have accepted the amended Terms.

If the Client does not accept the amendments, it may stop using the Platform in accordance with the concluded contract.

Article 29. Governing law and dispute resolution

These Terms are governed by the law of the country in which the Operator has its registered office, unless otherwise provided by mandatory regulations.

The parties will endeavour to resolve any disputes amicably, through mutual negotiations.

If amicable resolution of a dispute is not possible, the court having subject-matter jurisdiction according to the registered office of the Operator shall have jurisdiction to resolve the dispute, unless otherwise provided by mandatory regulations.

Article 30. Partial invalidity

If any provision of these Terms proves to be null and void, invalid or unenforceable, this shall not affect the validity of the remaining provisions.

In that case, the null and void or unenforceable provision shall be replaced by a provision that, in its economic and legal purpose, is closest to the original intention of the contracting parties.

Article 31. Waiver of rights

Failure or delay by the Operator in exercising any right shall not be deemed a waiver of that right.

Partial exercise of a particular right shall not prevent its later full exercise or the exercise of other rights that the Operator has under law or contract.

Article 32. Entire agreement

These Terms, together with the Privacy Policy, the Personal Data Processing Agreement (DPA), the Cookie Policy, and the offer or separate contract concluded between the Operator and the Client, constitute the single body of contractual documentation governing the use of the Platform.

In the event of any inconsistency between these Terms and a separate written contract concluded between the Operator and the Client, the provisions of the separate contract prevail. In matters of personal data processing, the Personal Data Processing Agreement prevails.

Article 33. Final provisions

These Terms enter into force on the date of their publication on the Operator's website, or on another date expressly specified in them.

These Terms apply to all users of the Platform from the date of their entry into force.

The user confirms that, before starting to use the Platform, they had the opportunity to become acquainted with the content of these Terms and that they accepted them freely and without restriction.