How we handle your data

1. Who we are

Boliq Ltd ("Boliq", "we") is the data controller for your personal data. Boliq Ltd is registered in England and Wales, company number 17457536. Registered office: Unit A, James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE. Boliq designs and installs automatic rising bollards for homes, businesses, and highways. This policy covers data collected through boliq.co.uk, the customer and installer portals, the Boliq app, our bollards, and any enquiry, quote, or order you make with us.

Questions about this policy or your data can be sent to hello@boliq.co.uk, by post to our registered office, or through the request form below.

2. What we collect

Depending on how you interact with us, this can include:

• Contact details: name, email, phone number, company name, and site address, given when you enquire, get a quote, order, or create an account.
• Account details: your login email and a password, handled by our authentication provider, Supabase. We never see or store your password in readable form.
• Order and installation details: the products you've ordered, your answers about the site, photos you provide, scheduling, and installation records, including photos our installers take of the finished job.
• Bollard data: once a bollard is linked to your account, its status, battery level and position, when it was raised or lowered (and which account sent each app command), any schedules you set, and fault reports. Bollards don't record video, sound or location.
• Bollard activity: a record of each raise and lower, when it happened, and how it was asked for (the app, Siri or a phone shortcut, the approaching-home alert, a schedule, or a number plate). This is the history you see in the app, and it helps us look into faults.
• Phone control keys: if you use Siri, Android shortcuts or the approaching-home alert, the app keeps a key on your phone, in its secure storage, so it can raise and lower your bollards while the app is closed. We keep only a scrambled copy of that key, which can't be turned back into the key, plus the phone's name and type and when the key was last used. Signing out on that phone, or removing it under Account, stops the key working.
• Location, only if you turn on the approaching-home alert: you mark your home on your phone, and the app uses your phone's location in the background to notice when you are driving towards it. Your location and the home you mark stay on your phone. We don't receive or store your location; we only receive the lower request that follows. Turn the alert off, or remove location access in your phone's settings, at any time.
• Number plates, only if your site has a Boliq number plate camera: the plates on your list and any names you give them, and each time the camera reads a plate (the plate, the time, and how sure the reading was). If your camera can't read plates itself, it sends us a photo, which we pass to Plate Recognizer to read the plate. We don't keep the photo.
• People you share a bollard with: if you give someone access to your bollard in the app, the email address you enter for them, whether they have household or guest access, when guest access ends, and the raise and lower requests they make. We email them to say you have given them access, and create a login for them if they do not have one. Only you and Boliq can see who a bollard is shared with.
• Push notification tokens: if you use the Boliq app and allow notifications, a token identifying your device so we can alert you about your own bollard.
• Payment information: handled by Stripe, our payment processor, including Direct Debit for monthly plans. We never see or store your full card or bank details. We keep a record of what you paid and when.
• Communications: messages you send us through our forms, by email or by phone, and our notes of them.
• Documents we share with you: if you're a customer, we may add documents such as your installation certificate, warranty or invoice to your portal. We record when you open one.
• Planning applications: if you choose a planning service, the plans, photos and details needed for your application.

Most of this comes from you. Some comes from others: our installers (job notes and photos), our planning partner and your council (application progress and decisions), Stripe (whether a payment went through), and, for businesses, the public Companies House register (see section 3a).

You don't have to give us your details, but we can't reply, quote, take an order or install without them.

3. How we use it, and our lawful basis

Data protection law says we need a lawful basis for each use of your data. Ours are:

• To reply to enquiries and prepare quotes: because you asked us to, as a step before a contract (UK GDPR Article 6(1)(b)), or, for a business enquiry, our legitimate interest in answering it (6(1)(f)).
• To take and carry out your order: scheduling and installing, running your account, the portals and the app, showing and controlling your bollards, warranty and service plan work, planning applications you've asked for, and service messages such as order updates and low battery or fault alerts. This is needed for our contract with you (6(1)(b)).
• To keep business and tax records: orders, invoices and payments, because the law requires it (6(1)(c)).
• To keep our systems secure, prevent fraud, and improve our products and service: our legitimate interests (6(1)(f)).
• Website analytics cookies: only with your consent, which you can withdraw at any time (6(1)(a)). See section 9.
• Emailing businesses about our products: our legitimate interests, see section 3a.

We only send you marketing emails if you've agreed to them, or if you're a customer and the law allows it, and every one lets you opt out. We don't use your data for third-party advertising, and we don't sell it. We don't make any decision about you with legal or similarly significant effects by automated means alone.

3a. Businesses we contact about our products

We sometimes email businesses that we think could use rising bollards, such as farms, depots, estates and leisure sites, before they have contacted us. If you received one of those emails, this section explains what we hold and why.

• What we hold: the business name, its registered details from the public Companies House register, the business address, phone number and website, and a work email address and, where the business publishes them, a name and job title. We also record the emails we send and whether you reply, click a link or ask us to stop. We don't use hidden tracking images to see whether you opened an email.
• Where it comes from: the business's own website and the Companies House register, or a contact you gave us yourself, for example at a show. We record the source for every contact.
• How we find businesses: we use automated tools, including an AI service from Anthropic, to read a business's public website and suggest whether our products may suit it and which published address to use. A person at Boliq sets up and oversees this, and it only ever uses details the business has published itself.
• Why, and our lawful basis: to tell businesses about products relevant to them, under our legitimate interests in marketing to other businesses (UK GDPR Article 6(1)(f)). We only send unsolicited marketing email to incorporated bodies, such as limited companies and LLPs, as the Privacy and Electronic Communications Regulations allow. We do not email sole traders or partnerships (other than Scottish partnerships) about our products unless they have agreed to it.
• Stopping it: every email has an unsubscribe link, or you can reply asking us to stop. We stop straight away and keep your address on a suppression list so you are not contacted again. You have an absolute right to object to direct marketing.
• How long we keep it: if you ask us to stop, or the address doesn't work, we delete your details 30 days later. If you don't reply, we delete them 12 months after our last email. If you reply but it doesn't lead anywhere, we delete them 24 months after we were last in touch. The suppression list keeps only the email address or domain, and only so we can honour your request.
• Who processes it: our database host (Supabase), our website host (Vercel), the email provider that hosts the mailbox the email came from (Microsoft or Google), and Anthropic for the research described above.

You can object, ask for a copy of what we hold, or ask us to delete it at any time, using the request form below or by emailing hello@boliq.co.uk. Your rights are set out in section 7.

4. Who we share it with

We use a small number of service providers to run Boliq. They act on our instructions under written contracts, and each only receives what it needs to do its job:

• Supabase, to host our database, files and account logins.
• Vercel, to host the website and the systems behind the app.
• Stripe, to take card payments and Direct Debits.
• Xero, our accounting software, for customer records and invoices.
• Resend, to send quote, order and account emails.
• Microsoft (or Google), which host our email.
• Expo, Apple and Google, to deliver push notifications to the app, if you've enabled them.
• emnify, the mobile network your bollard uses to connect to us. It carries the bollard's status and commands, not your own details.
• Plate Recognizer, to read number plates from camera photos, only for sites with a Boliq number plate camera.
• Anthropic, for the business research described in section 3a only. It is not given customer data.
• Google, for Google Analytics on the website, only if you accept analytics cookies.

Our installers, whether employed by us or working for us as subcontractors, see the details of the jobs they're assigned to.

If you choose one of our planning services, we also share your name, address, contact details, photos and plans with the independent architect or building company we appoint to prepare your application, and with your local council. Councils publish planning applications, including the applicant's name and address, on their public planning register.

We don't share your data with anyone else unless the law requires it, for example with HMRC, or to protect our legal rights. If Boliq or its business were sold, your data would pass to the new owner under this policy.

5. Transfers outside the UK

Some of our providers, including Stripe, Vercel, Resend, Xero, Expo, Apple, Google, Microsoft and Anthropic, are based in or process data in the United States or the European Economic Area. Where data leaves the UK, it is protected by UK adequacy regulations (including the UK-US data bridge, for providers certified under it) or by the UK's International Data Transfer Agreement or Addendum to the EU standard contractual clauses. You can ask us for details of these safeguards.

6. How long we keep it

• Orders, accepted quotes, invoices, payments and installation records: 6 years after the end of the financial year the order was completed in, as tax and company law require, or longer if a warranty claim or dispute is still open.
• Enquiries that don't become an order, and quotes that aren't accepted: 24 months, then deleted automatically. Applications to become an installer: 12 months.
• Customer records for people who never ordered: deleted 24 months after we were last in touch, once nothing else is linked to them.
• Your account login: until you delete your account (see section 7). Order records are kept as above, without the link to your login.
• Documents: files we keep about your order are kept as the order is (6 years). A document that is deleted waits in a bin for 30 days and is then removed for good.
• Records of who opened or changed a document: 24 months, then deleted automatically.
• Bollard activity history (raise, lower, battery and fault events): 24 months, then deleted automatically.
• Number plate readings (only for sites with a Boliq number plate camera): 90 days, then deleted automatically. Readings that didn't match a plate on your list are deleted after 7 days.
• Push notification tokens: until you sign out of the app, turn notifications off, or delete your account.
• Shared access: until you remove the person, their guest access ends, or either of your accounts is deleted. The raise and lower requests they made stay in the bollard's history for the period given above for bollard activity.
• Data protection requests and complaints: 24 months after we receive them, so we can show how we handled them.
• Businesses we contacted: see section 3a.
• Website analytics: no more than 14 months in Google Analytics.

7. Your rights

Under UK data protection law, you have the right to:

• get a copy of the personal data we hold about you;
• have anything inaccurate corrected;
• have your data deleted, where we're not required to keep it;
• ask us to limit how we use it while a concern is looked into;
• receive the data you gave us in a format you can take elsewhere;
• object to us using it on the basis of legitimate interests, and to stop direct marketing at any time;
• withdraw consent you've given, such as for analytics cookies, at any time.

Use the request form below, email hello@boliq.co.uk, or write to our registered office. It's free. We reply within one month. If a request is complex we can take up to two more months, and we'll tell you within the first month if we need to. We may ask you to confirm who you are before we act on a request.

You can delete your Boliq account at any time from the app: open Account, then Delete my account. This removes your login and app data straight away, and stops any control keys on your phones. We keep order, quote and invoice records for as long as the law requires, but they are no longer linked to a login. You can also ask us to do it for you using the form below.

8. Requests and complaints

Use this form to make any of the requests above, or to complain about how we've handled your personal data. We'll email you straight away to confirm we've received it, then reply within one month and keep you updated while we look into it.

If you're unhappy with our reply, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We'd appreciate the chance to put things right first.

9. Cookies and analytics

Essential. We use the cookies and browser storage needed to keep you signed in to the customer, commercial, installer or admin portal, and to remember your cookie choice. These do not need your consent.

Analytics, only with your consent. If you click Accept on our cookie banner, we use Google Analytics (provided by Google Ireland Ltd) to understand how people use the website, such as which pages are visited, how people find us, and when an order or enquiry is completed. Google Analytics sets cookies (named _ga and _ga_ followed by an ID) that last up to 2 years. We do not use advertising cookies, and advertising features are switched off. We don't send Google private parts of page addresses, such as order or quote references. If you click Reject, or do not choose, Google Analytics is not loaded at all.

The website's fonts are served from our own site, so your browser doesn't contact Google to display them.

When you pay, you go to Stripe's secure checkout page, which uses its own cookies to prevent fraud. Stripe's privacy policy covers these.

Here is everything the website stores on your device:

You can change your choice at any time using Cookie settings, also in the footer of every page.

10. Keeping your data safe

Data is encrypted in transit, and our database only lets each person see what their role needs: customers see their own orders and bollards, installers see the jobs they're assigned, and only Boliq admins see everything. Admins sign in with a password and a code from an authenticator app. Documents and photos are kept in private storage and shared only through links that expire. If something goes wrong that puts your data at risk, we'll tell you and the Information Commissioner's Office where the law requires it.

11. Children, and changes to this policy

Boliq's services are intended for adults placing or managing an order, not children. We may update this policy as the business and app develop. The version on this page is always the current one, and we'll tell customers about significant changes by email.

Last updated 16 October 2026.