Privacy Policy

1. Who this policy covers

This policy explains how Bolya Pty Ltd (ACN 696 393 343), trading as BOLYA ("Bolya", "we", "us"), collects, uses, stores and protects personal information for anyone who signs up, browses, lists a home, expresses interest, or joins our waitlist, wherever in the world you are based, including Ireland and the wider EU. Bolya Pty Ltd is the entity responsible for the personal information described in this policy, and is the data controller for the purposes of the GDPR.

Bolya may currently fall within the small business exemption in the Privacy Act 1988 (Cth). We have chosen to handle personal information in line with the Australian Privacy Principles in any event, and this policy is written on that basis.

2. Information we collect

Account and profile: name, email address, phone number, referral code if used, your home suburb and postcode, and an optional profile photo.

Listing information: property description, area information, availability, and your weekly community rate, if you choose to list a home.

If you start adding a home and do not finish, we save what you have entered so far as a draft, including any photos you have uploaded. This is so you can come back and finish it later, including on another device. A draft is only ever visible to you and to us, never to other members or to the public. You can delete a draft at any time from your profile, and any drafts you still have are deleted when you close your account.

Location information: approximate location coordinates for a home you list, so the listing can be shown on a map. We deliberately reduce the precision of these coordinates at the point we save them, to no finer than around one kilometre, so a listing shows the general area and never an exact address. We do not hold the street address of your home. Once a match is confirmed, members exchange exact address details directly with each other, as described in section 5.

Expression of interest details: trip dates or date flexibility, and any notes you choose to share with a host.

Waitlist information: name, email and market, if you join our global waitlist rather than signing up fully, for people outside Ireland and Australia.

Technical information: standard device and browsing information collected automatically through our website analytics, which is cookieless and does not create a persistent identifier for you. We do not currently use advertising identifiers, advertising cookies or social media advertising pixels. If that changes, we will update this policy first.

Identity check information: before we introduce you to another member, we ask you to show a government issued photo identity document during a short video call. We do not ask you to send us a copy of the document, and we do not record the call, screenshot, download or store the document, its number or its images. We record only the outcome of the check, being the date, the type of document sighted, and who conducted the check.

We do not intentionally collect sensitive personal information, such as details about health, disability, religion or sexual orientation. If you choose to include this kind of information in a free text field, such as an accessibility note in a listing description, please only share what is genuinely useful for another member to know. An identity document you show us during a video call may display more information than we need. We look only at your name, photograph and date of birth for the purpose of confirming you are the person who holds the account, and we do not record any of it.

3. How we use it

• To create and manage your account and profile
• To let you browse listings and express interest
• To personally review and manually match expressions of interest, currently done by our founder or another authorised member of our team
• To send you emails about your account, an expression of interest, or Platform updates
• To improve Bolya and understand how the community uses it
• To run advertising and marketing, including through social platforms, where you have not opted out
• To verify your identity before we introduce you to another member, and to help prevent fraud, impersonation and misuse of the Platform

We do not sell your personal information.

You can opt out of marketing communications at any time using the unsubscribe link in our emails, or by contacting us directly. This does not affect emails we send about your account or an expression of interest.

Matching on Bolya is currently done personally by our founder or another authorised member of our team, not by an automated algorithm. We do not use automated decision making or profiling to decide who you are matched with. We do not use computer programs to make, or to do a thing that is substantially and directly related to making, a decision that could reasonably be expected to significantly affect your rights or interests. If that changes, we will update this policy before it does.

4. Our legal basis for processing

Where the GDPR applies to you, we rely on the following legal bases to process your personal information:

• performance of a contract, to provide the Platform and its features to you, including your account, any listing and your expressions of interest;
• legitimate interests, including improving Bolya, keeping the Platform and its members safe, manually reviewing matches, verifying identity before an introduction, and preventing fraud, impersonation and misuse;
• consent, for marketing communications and non essential cookies, where you have given it; and
• legal obligation, where we need to comply with a legal or regulatory requirement.

Where we rely on your consent, you can withdraw it at any time by contacting us, without affecting the lawfulness of processing before you withdrew it.

5. Who we share it with

We use third party service providers to run the Platform and communicate with you, including hosting and database providers, and a transactional email provider. These providers may only use your information to provide their service to us, not for their own purposes.

When you express interest in a listing, relevant details are shared with our team for manual matching. Once a match is confirmed, appropriate contact details are shared directly between the matched members so they can arrange the swap or stay themselves. We do not publish your street address, email address or phone number on your listing or anywhere else on the Platform.

We do not currently share information with payment providers or automated identity verification providers, as these features are not yet built into the Platform. Identity checks are currently carried out by our own team during a video call, using the video conferencing provider we use to host that call.

6. Where your information is stored

Bolya uses cloud infrastructure providers to store and process information, which may store or process data outside Australia or Ireland, including in the United States. Where this happens, we take reasonable steps to ensure your information continues to receive an appropriate level of protection.

Where we transfer personal information outside Australia, Ireland or the EU, including to the United States, we rely on appropriate safeguards recognised under GDPR, such as Standard Contractual Clauses, to protect that information.

Where we disclose personal information to an overseas recipient, we take the steps reasonably required by Australian Privacy Principle 8 to ensure the recipient handles it consistently with the Australian Privacy Principles. A list of the countries in which our current service providers store information is available on request.

7. How long we keep it, and deleting your account

We only keep personal information for as long as we actually need it. While your account is open, we keep the information described in section 2 so we can provide the Platform to you. When you close your account, or ask us to delete your information, we delete it in line with the timeframes below.

Deleting your account. You can ask us to delete your account and your personal information at any time by emailing hello@bolyaworld.com. When you do:

• your profile, any listing, your photos and your expression of interest history are removed from the Platform straight away, so no other member can see them;
• your personal information is permanently deleted from our live systems within 30 days of your request, unless one of the limited exceptions below applies;
• we keep a minimal suppression record, being a one way encrypted version of your email address and the date of your request, so we can show we actioned your request and so we do not contact you again by mistake; and
• we confirm to you by email once the deletion has been completed.

Backups. Our database is backed up daily so we can recover from a failure, and those backups are kept for a short rolling period only. Deleted information may remain in a backup for up to 30 days after deletion, after which it is overwritten in the ordinary backup cycle. Photographs and other uploaded files are not included in these backups at all, so once they are deleted there is no backup copy of them anywhere. We do not use a backup to restore a deleted account, and if we ever restore a backup for another reason, we re-apply any outstanding deletion requests immediately afterwards.

When we keep something for longer. We may keep limited information for longer than 30 days where:

• there is an open dispute, complaint or safety report involving you, in which case we keep only the information relevant to that matter until it is resolved, and for 12 months afterwards;
• we reasonably suspect fraud, impersonation, or a serious breach of our Terms of Use, in which case we keep a limited record so the same person cannot simply re-join, being the outcome of any identity check, the reason for the action we took, and a one way encrypted version of the email address and phone number used;
• we are required to keep it by law, or to comply with a court order, subpoena or regulatory request; or
• we need it to establish, exercise or defend a legal claim.

Where we rely on one of these grounds, we keep only the specific information needed for that purpose, we do not use it for anything else, and we delete it once the purpose has passed.

Identity check records. We do not keep your identity document. We keep the outcome of an identity check, being the date, the type of document sighted and who conducted the check, for 12 months after your account is closed, so that we can respond to a later safety report or dispute about a stay that has already happened.

Technical and analytics information. We keep device, browsing and analytics information for 14 months from collection, after which it is deleted or aggregated so that it can no longer be linked to you.

De-identified information. We may keep aggregated or de-identified information that can no longer be linked to you, such as the number of listings in a region, for as long as it is useful to us. This includes a record that an expression of interest was made and when, with the details identifying you removed, so that we can understand how matching works over time. Where a record of that kind could still realistically be traced back to you, we treat it as your personal information and delete it with the rest.

Waitlist information. If you join our waitlist and never sign up, we keep your name, email and market until you ask us to remove them, or until 24 months after your last interaction with us, whichever comes first.

8. Your rights

If you are in Australia, you have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, including to access and correct your personal information, to ask us to destroy or de-identify personal information we no longer need, and to make a complaint, including to the Office of the Australian Information Commissioner (OAIC), if you are not satisfied with our response.

If you are in Ireland or the EU, you have rights under the General Data Protection Regulation (GDPR), including the right to access, correct, delete or receive a portable copy of your personal information, to ask us to restrict how we use it, to object to processing we carry out on the basis of our legitimate interests or for direct marketing, to withdraw a consent you have given, and to lodge a complaint with the Irish Data Protection Commission or your local supervisory authority.

The right to have your information deleted is not absolute. Where we are permitted to keep limited information under section 7, for example because there is an open dispute or we need it to defend a legal claim, we will tell you what we have kept, why we have kept it, and when it will be deleted.

If you have a concern about how we have handled your personal information, please contact us first at hello@bolyaworld.com so we can try to resolve it directly. If you are not satisfied with our response, you can escalate your complaint to the OAIC if you are in Australia, or the Irish Data Protection Commission or your local supervisory authority if you are in Ireland or the EU.

To exercise any of these rights, contact us at hello@bolyaworld.com.

We respond to requests as quickly as we can, and in any event within 30 days of receiving your request. If a request is complex we may need longer, and we will tell you before the 30 days is up. We do not charge you for making a request.

9. Cookies and analytics

We use a cookieless analytics tool, which measures how the website is used without setting cookies or creating a persistent identifier for you. We do not currently use advertising cookies, tracking pixels or similar technologies. You can control cookies through your browser settings. If we later introduce any non essential cookie or tracking technology, we will ask for your consent before it loads, and we will update this policy first.

Our website may include links to third party sites, such as social media platforms. This policy does not cover those third party sites, and we encourage you to review their own privacy policies before providing them with your information.

10. Children

Bolya is intended for adults 18 years and over. We do not knowingly collect personal information from anyone under 18.

11. Security

We take reasonable technical and organisational steps to protect your information, including access controls on our database, encryption of information in transit and at rest, limiting access to the team members who need it, and multi factor authentication on the accounts we use to administer the Platform. No system is completely secure, and we encourage you to use a strong, unique password for your account.

12. If something goes wrong

If a data breach happens that is likely to result in serious harm to you, we will tell you and notify the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth).

Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach where we are required to do so, and will tell you directly where the breach is likely to result in a high risk to your rights and freedoms.

13. Changes to this policy

As Bolya builds new features, including future payments, automated identity verification and in-platform messaging, this policy will be updated to reflect what we actually collect and how we use it. We will not describe a feature as live before it genuinely is.

If we make a material change to this policy, we will let you know by email or a notice on the Platform, and update the date at the top of this policy.

14. Contact us

If you have any questions about this policy, or want to exercise any of your privacy rights, contact us at hello@bolyaworld.com.

Bolya Pty Ltd (ACN 696 393 343) is a company registered in New South Wales, Australia. For anything about this policy or your personal information, contact us at hello@bolyaworld.com, marked to the attention of Privacy. If you need a postal address, ask us by email and we will provide one.