Privacy Policy

Introduction

Athena Veritas Ltd, trading as The Bolt Practice ("we", "us", "our"), is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal data when you use our website at boltpractice.ai, register for our events and workshops, or participate in our programmes.

We are registered in England and Wales. Our registered office is at 10-12 Barnes High Street, London, SW13 9LW.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We act as the data controller for personal data processed under this policy. We are registered with the Information Commissioner's Office as a data controller. Our ICO registration reference is ZC068246.

If you have any questions about this policy or how we handle your data, please contact us at hello@athenaveritas.ai.

What Data We Collect

We collect personal data in the following circumstances:

2.1 When You Use Our Website Diagnostic or Enquiry Forms

• Name and email address
• Company name, company website, and postcode
• Business information such as number of staff and annual revenue band
• Your responses to diagnostic and survey questions
• Any information you voluntarily provide in open text fields

2.2 When You Register for an Event or Workshop

• Name and email address
• Company name and contact details
• Attendance and registration information

2.3 When You Enrol in a Programme

• Name, email address, and contact details
• Business and professional information relevant to programme delivery
• Payment information (processed securely via our payment provider; we do not store card details)
• Participation records, session notes, and progress information
• Testimonials or feedback you choose to provide

2.4 When You Visit Our Website

• IP address and browser type
• Pages visited and time spent on the site
• Referring website or search terms
• Cookie data (see our Cookie Policy for full details)

2.5 When You Contact Us Directly

• Name, email address, and any information you include in your message

2.6 When a Participant Is Under 18

Where we accept a participant aged 16 or 17 onto a programme (see Section 9), we may collect and process the following about that young person: their name, age, session notes, progress information, and work they submit as part of the programme. A parent or guardian provides consent and holds the account, as described in Section 9.

How We Use Your Data

We use your personal data for the following purposes:

3.1 To Respond to Enquiries

Lawful basis: Legitimate interests. We use your contact details to respond to your enquiry and follow up as appropriate.

3.2 To Deliver Programmes and Workshops

Lawful basis: Contract performance. We use your data to organise and deliver the programmes and events you have registered for or enrolled in.

3.3 To Send Marketing Communications

Lawful basis: Consent. If you have opted in, we will send you newsletters, updates, and information about our programmes and events. You can withdraw consent at any time by clicking unsubscribe in any email or contacting us at hello@athenaveritas.ai.

3.4 To Improve Our Services

Lawful basis: Legitimate interests. We use aggregated and anonymised data from diagnostic surveys and programme participation to improve our content, delivery, and website.

3.5 To Meet Legal Obligations

Lawful basis: Legal obligation. We retain certain financial and contractual records as required by law.

3.6 To Manage Our Community Platform

Lawful basis: Contract performance and legitimate interests. If you join the Veritas Circle community, your profile information is shared within the platform to enable participation.

Who We Share Your Data With

We do not sell your personal data to third parties. We share data only where necessary with the following categories of trusted service providers, all of whom are bound by data processing agreements or equivalent contractual safeguards. We assess each provider for data protection compliance before we use them.

Community platform (Circle): Participant names and email addresses are shared to enable access to our Veritas Circle community platform. Circle is a US-based service; transfers are covered by the UK Addendum to the EU Standard Contractual Clauses.

Productivity and communications (Google Workspace): We use Google Workspace for email and document management. Correspondence containing your personal data may be stored within Google's systems.

Video conferencing (Zoom): We use Zoom to deliver online sessions and workshops. If you attend a recorded session, your name, image, and voice may be captured in the recording. Participants are informed before any recording takes place.

Social media and advertising (LinkedIn): If you interact with our LinkedIn presence or we use LinkedIn advertising, LinkedIn may process data in accordance with their own privacy policy. We may use LinkedIn tracking tools on our website, which is covered in our Cookie Policy.

Payment processing (Stripe): Payment for programmes is processed securely by Stripe. We do not store or have access to your full payment card details.

Website platform (Manus): Our website is built and hosted using Manus, which processes personal data submitted through our website forms, including enquiry and diagnostic data. We have requested a Data Processing Agreement from Manus and will confirm the transfer mechanism and safeguards once that agreement is in place. In the meantime, data submitted through our website is limited to what is necessary for the purpose stated on each form.

AI-assisted analysis and productivity tools: We use reputable AI-assisted tools to help us with tasks such as drafting, summarising, analysing data, and improving the efficiency of our operations. Where personal data is processed using these tools, we limit the data shared to what is necessary for the task and assess each provider's data protection and security standards before use. For our primary AI platforms operating under team or business plans, data is not used to train models by default. For other platforms, we apply available opt-out settings and review provider policies regularly. We do not use AI tools to make solely automated decisions that produce legal or similarly significant effects about you (see Section 7).

Email delivery and marketing (Resend): We use Resend to send transactional emails and marketing communications to subscribers who have opted in. Resend is bound by a data processing agreement and processes data only as instructed by us.

We may also disclose your data where required to do so by law, or to protect the rights, property, or safety of The Bolt Practice, our participants, or others.

International Transfers

Some of our service providers, including Circle, Google, Zoom, and certain AI-assisted tools, operate outside the UK. Where your personal data is transferred outside the UK, we ensure appropriate safeguards are in place. For US-based providers, we rely on the UK Addendum to the EU Standard Contractual Clauses. For providers in countries covered by a UK adequacy decision, we rely on that decision. In all cases, transfers are made in accordance with UK GDPR requirements.

How Long We Keep Your Data

• Enquiry and contact data: up to 12 months from last contact, unless you become a programme participant
• Programme participant data: up to 6 years from the end of your programme, for legitimate business and legal purposes
• Financial and payment records: 7 years, as required by HMRC
• Marketing data: until you withdraw consent or we have had no engagement with you for 24 months
• Website analytics data: as defined in our Cookie Policy

We review our data regularly and securely delete data that is no longer required.

Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to ask us to correct inaccurate or incomplete data
• Right to erasure: to ask us to delete your data in certain circumstances
• Right to restriction: to ask us to limit how we use your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests or for direct marketing
• Rights related to automated decision-making: we do not use solely automated decision-making that produces legal or similarly significant effects

To exercise any of these rights, please contact us at hello@athenaveritas.ai. We will respond within one calendar month. We may need to verify your identity before processing your request.

Where a participant is under 18, their parent or guardian exercises these rights on the young person's behalf until they reach the age of 18.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk or by calling 0303 123 1113.

Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include:

• Secure, password-protected systems and accounts
• Restricted access to personal data on a need-to-know basis
• Use of reputable third-party platforms with their own security standards
• Regular review of our data handling practices

While we take all reasonable steps to protect your data, no online system is entirely without risk. You are responsible for keeping any login credentials confidential.

Children's Data

Our programmes and website are intended primarily for adults aged 18 and over, and most participants are adults.

We do not knowingly work with anyone under the age of 16, and we do not target or market our programmes to anyone under 18.

In some cases, a parent or guardian may wish to enrol a young person aged 16 or 17 onto one of our programmes (including a free programme). Where this happens:

• The parent or guardian must provide their consent and enter into our programme agreement on the young person's behalf.
• The account is held in the parent or guardian's name, and the parent or guardian acts as our main point of contact.
• We will collect and process only the personal data about the young person that is necessary to deliver the programme, which may include their name, age, session notes, progress information, and work they submit.
• The parent or guardian may exercise the young person's data protection rights (such as access or deletion) on their behalf, as set out in Section 7.

We will not knowingly enrol or collect personal data relating to any individual under the age of 16. If you believe we have inadvertently collected data from someone under 16, please contact us immediately at hello@athenaveritas.ai and we will delete it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will update the date at the top of this document when we do so. For significant changes, we will notify you by email if you are subscribed to our communications, or by a prominent notice on our website.

We encourage you to review this policy periodically.

Contact Us

For any questions, requests, or concerns relating to this Privacy Policy or your personal data:

• Email: hello@athenaveritas.ai
• Post: Athena Veritas Ltd (trading as The Bolt Practice), 10-12 Barnes High Street, London, SW13 9LW

We aim to respond to all data-related requests within five working days and will resolve them within one calendar month.