Privacy Policy
Last updated: 7 August 2026
This policy explains what personal data The Boost Box collects, why we collect it, and what you can ask us to do with it. It covers this website and the marketing services we provide to our clients.
01 Who we are
The Boost Box is a B2B outreach and email marketing agency registered with the Serbian Business Registers Agency (SBRA). Our full registered name is MILOŠ TOMIĆ PREDUZETNIK THE BOOST BOX, company registration number 64482076, registered at Ivanjica, Serbia.
For anything in this policy, write to milos@theboostbox.com.
We are the data controller for personal data collected through this website and for our own business communications. When we run outreach campaigns for a client, we usually act as a data processor on that client's instructions — see section 06.
02 The short version
- This website sets no cookies and runs no analytics. We do not track you across sites.
- The only personal data you actively give us is what you type into the contact form.
- The contact form does not send anything to a server of ours. It opens your own email application with a pre-filled message, which you then choose to send. Nothing leaves your device unless you press send in your email client.
- We do not sell personal data, and we do not share it for anyone else's advertising.
- You can ask us what we hold about you, and ask us to correct or delete it.
03 Information you give us
Contact form
The form on our site asks for your name, work email address, company, the service you are interested in, and an optional description of your goals. When you press Send message, your browser opens your own email application with that information already written into a message addressed to us. We receive it only if and when you send that email.
This means two things worth being clear about. First, we do not operate a server that stores form submissions. Second, the message travels through whatever email provider you use, under their terms and their privacy policy, not ours.
Email and other direct contact
If you email us, connect with us on LinkedIn, or speak to us on a call, we keep a record of that correspondence and anything you tell us during it, so that we can respond and keep track of the conversation.
Client engagements
If you become a client, we hold the contact and billing details we need to deliver the work and meet our accounting and tax obligations.
04 Information collected automatically
Like any website, this site is served by a hosting provider that keeps standard server logs. These typically record IP addresses, the pages requested, timestamps, and browser type. We use these only to keep the site running and secure. Our hosting provider is Plus.rs and their retention period for logs is 30 days.
We do not build profiles from this data and we do not combine it with anything else we hold about you.
06 Data we handle for our clients
Our core service involves contacting people at businesses on behalf of our clients. That work necessarily involves personal data — usually a name, a work email address, a job title, a company, and publicly available professional information.
In that work we normally act as a processor. The client decides who is contacted and why; we carry it out under a written agreement and on their documented instructions. The client is the controller and their own privacy policy governs that data.
If you were contacted by us on behalf of a client
Every campaign email we send identifies the sender and gives you a way to opt out. If you tell us to stop, we add you to a suppression list so you are not contacted again through that campaign. You can also ask us who the client is, and we will tell you or pass your request directly to them.
To exercise your rights over that data, you can contact us and we will forward your request to the relevant client without undue delay, or you can contact the client directly.
07 Why we use your data, and our legal basis
- To reply to your enquiry
- Basis: steps taken at your request before entering a contract, or our legitimate interest in responding to people who contact us.
- To deliver services to clients
- Basis: performance of our contract with the client.
- To run outreach campaigns on a client's behalf
- Basis: the client's chosen basis, normally their legitimate interest in reaching potential business customers, balanced against the recipient's rights and with a clear opt-out in every message.
- To meet accounting, tax and other legal duties
- Basis: compliance with a legal obligation.
- To keep our site and systems secure
- Basis: our legitimate interest in preventing abuse and protecting our infrastructure.
09 International transfers
We are based in Serbia and some of the tools we use are operated by companies outside Serbia and outside the European Economic Area. Where personal data is transferred internationally, we rely on the safeguards recognised under the applicable data protection law — typically standard contractual clauses or a finding of adequacy. You can ask us for details of the safeguards that apply to a specific transfer.
10 How long we keep data
We keep personal data only as long as we have a reason to. In practice:
- Enquiries that do not become work: 12 months from our last exchange.
- Client records: for the length of the engagement and then for as long as our accounting and tax obligations require, which in Serbia is generally 24 months.
- Campaign and suppression lists: handled per our agreement with the client. Opt-out records are kept indefinitely, because that is the only way to make sure we do not contact you again.
- Server logs: per our hosting provider's retention period.
11 Your rights
Subject to the conditions in the applicable law, you can ask us to:
- confirm what personal data we hold about you, and give you a copy;
- correct anything inaccurate or incomplete;
- delete data we no longer have a good reason to keep;
- restrict how we use it while a question about it is resolved;
- provide it in a portable, machine-readable format;
- stop using it where we rely on legitimate interest, including for direct marketing — if you object to direct marketing, we will stop, with no balancing exercise;
- withdraw consent, where consent was the basis, without affecting anything done before you withdrew it.
Write to milos@theboostbox.com and we will respond within the period the law allows, normally 30 days. We do not charge for this.
If you are not satisfied with our response, you can complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection, or to the supervisory authority in the country where you live or work.
12 Security
We use access controls, encrypted connections, and reputable providers, and we limit access to personal data to the people who need it. No system is completely secure, and we cannot guarantee that data sent over the internet will never be intercepted. If a breach occurs that is likely to affect your rights, we will notify you and the relevant authority as the law requires.
13 Children
Our services are sold to businesses and this website is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
14 Changes to this policy
If we change how we handle personal data, we will update this page and change the date at the top. If a change materially affects you, we will tell you directly where we reasonably can.
15 How to contact us
Questions, requests, or complaints about privacy go to milos@theboostbox.com. Please tell us what you are asking for and enough detail for us to find your data.