GDPR Overview

01Our Commitment

Bluto's approach to data protection and our registration with the ICO.

1.1 Bluto AI Limited is committed to processing personal data responsibly, transparently, and in compliance with the UK General Data Protection Regulation and the Data Protection Act 2018 (together, "UK data protection law"). We treat data protection not as a compliance exercise but as a foundation of the trust our Subscribers place in us.

1.2 We are registered with the Information Commissioner's Office as a data controller under registration number ZC040466. Our registered office is at 20 Red Lion Street, London, England, WC1R 4PS.

1.3 We appoint a data protection contact who is responsible for overseeing our compliance with UK data protection law and serving as the point of contact for data subject rights requests and regulatory enquiries. Our data protection contact can be reached at [email protected].

1.4 We review our data protection practices on an ongoing basis and update our policies when our processing activities change, when the law or regulatory guidance changes, or when we identify improvements to our approach.

02Our Role Under UK GDPR

The distinction between Bluto's role as data controller and data processor.

2.1 Under UK data protection law, a data controller determines the purposes and means of processing personal data. A data processor processes personal data on behalf of, and under the instructions of, a controller. Bluto acts in both capacities depending on the category of data being processed.

2.2 Bluto as controller. Bluto is the data controller for personal data it collects and processes in connection with the operation of the Service and the management of Subscriber accounts. This includes:

2.2.1 account data -- the name, email address, and company details of the Subscriber and any Authorised Users;

2.2.2 usage and technical data -- information about how the Service is accessed and used, including session data, feature interaction data, and AI interaction metadata; and

2.2.3 billing and communications data -- payment confirmations and correspondence between Bluto and the Subscriber.

2.3 For personal data in respect of which Bluto is the controller, the Subscriber's rights are exercisable directly against Bluto. See clause 04 below and our Privacy Policy at bluto.ai/legal/privacy.

2.4 Bluto as processor. When a Subscriber uploads or inputs Customer Content that contains personal data about third parties -- such as the names and details of investors, employees, or co-founders included in a financial model, cap table, or business plan -- Bluto processes that personal data as a processor acting on the Subscriber's instructions. In such cases, the Subscriber is the data controller and is responsible for ensuring that its use of the Service in relation to that personal data complies with applicable data protection law.

2.5 For personal data in respect of which Bluto acts as processor, data subject rights requests should be directed to the Subscriber as the relevant controller. Where Bluto receives a rights request that relates to data for which it is a processor, it will forward that request to the relevant Subscriber without undue delay.

2.6 The terms governing Bluto's processing of personal data on behalf of Subscribers as processor are set out in the Data Processing Agreement available at bluto.ai/legal/dpa. Subscribers who process personal data of third parties using the Service should ensure they have reviewed and accepted the Data Processing Agreement.

03Lawful Bases for Processing

The legal grounds under UK GDPR on which Bluto processes personal data.

3.1 UK data protection law requires a controller to identify a lawful basis for each processing activity. Where Bluto acts as controller, we rely on the following lawful bases:

• performance of contract -- processing necessary to provide the Service under our Terms of Service, including account creation and management, payment processing, and the provision of AI-powered features
• legitimate interests -- processing for purposes such as improving the Service through Usage Data analysis, preventing fraud and abuse, and maintaining the security of the platform, where those interests are not overridden by the rights of individuals
• legal obligation -- processing required to comply with applicable law, including financial record-keeping obligations and our obligations under UK data protection law itself
• consent -- processing based on your explicit agreement, including certain marketing communications and non-essential cookies, which you may withdraw at any time

3.2 A full description of our processing activities, the data categories involved, and the lawful basis relied upon for each is set out in Section 04 of our Privacy Policy at bluto.ai/legal/privacy.

04Data Subject Rights

The rights available to individuals under UK GDPR and how to exercise them.

4.1 Under UK data protection law, individuals whose personal data we process have the following rights:

• the right of access -- to obtain confirmation of whether we process personal data about them and, if so, a copy of that data
• the right to rectification -- to have inaccurate or incomplete personal data corrected
• the right to erasure -- to have personal data deleted in certain circumstances, including where it is no longer necessary for the purpose for which it was collected
• the right to restriction of processing -- to limit how we use personal data in certain defined circumstances
• the right to data portability -- to receive personal data in a structured, machine-readable format where processing is based on contract or consent
• the right to object -- to object to processing based on legitimate interests, and to object absolutely to processing for direct marketing
• the right to withdraw consent -- to withdraw consent at any time where processing is consent-based, without affecting prior processing
• rights in relation to automated decision-making -- we do not make decisions producing legal or similarly significant effects based solely on automated processing

Rights requests should be submitted to [email protected]. We will acknowledge all requests within five working days and respond fully within one calendar month. In certain circumstances we may ask you to verify your identity before processing your request. Where we are unable to fulfil a request, we will explain why. A full description of each right and the circumstances in which it applies is set out in Section 09 of our Privacy Policy at bluto.ai/legal/privacy.

05International Transfers

How we protect personal data when it is transferred outside the UK.

5.1 We host Customer Content and Subscriber account data on AWS infrastructure located in the United Kingdom (London region). A secondary hosting location in the European Union (Ireland region) is maintained for resilience purposes.

5.2 Some of our service providers -- including AI model providers and analytics providers -- are located outside the United Kingdom. Where personal data is transferred to a country that does not provide an equivalent level of protection to the UK, we ensure appropriate safeguards are in place.

5.2.1 For transfers to countries without a UK adequacy decision, we rely on Standard Contractual Clauses approved by the relevant supervisory authority, incorporating the UK Addendum issued by the Information Commissioner's Office where required for UK data transfers.

5.2.2 For transfers to countries in respect of which the UK has issued an adequacy decision, we rely on that decision as the transfer mechanism.

5.3 All third-party providers who process personal data on our behalf are bound by data processing agreements that impose equivalent data protection obligations to those applicable to Bluto under UK data protection law.

5.4 A current list of sub-processors, including the location of processing for each, is published at bluto.ai/legal/subprocessors. Information about the specific safeguards relied upon for any transfer is available on request at [email protected].

06Contact and Complaints

How to contact us about data protection matters and how to escalate a concern.

6.1 For all data protection queries, rights requests, and concerns, please contact our data protection contact at:

6.1.1 Email: [email protected]

6.1.2 Post: Bluto AI Limited, Data Protection Enquiries, 20 Red Lion Street, London, England, WC1R 4PS.

6.2 We will always seek to resolve data protection concerns directly and promptly. We encourage Subscribers and data subjects to contact us in the first instance before escalating to a supervisory authority.

6.3 If you are not satisfied with our response, or if you consider that our processing of your personal data infringes UK data protection law, you have the right to lodge a complaint with the Information Commissioner's Office, the supervisory authority for data protection in the United Kingdom:

6.3.1 Website: ico.org.uk

6.3.2 Telephone: 0303 123 1113

6.3.3 Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

6.4 Where personal data processed by Bluto as processor is the subject of a complaint, we will assist the relevant Subscriber in responding to that complaint in accordance with our obligations under the Data Processing Agreement at bluto.ai/legal/dpa.