Privacy Policy

Blue Flag Transport Consulting Ltd, trading as BFT Consulting · Version 2.7

Data enquiries: info@bftconsulting.co.uk · 0330 179 7379

Contents: 1. Who We Are · 2. What Personal Data We Collect · 3. How We Use Your Data · 4. Our Lawful Basis · 5. BFT Vault with BFTi · 6. Marketing · 7. Cookies and Similar Technologies · 8. Who We Share Data With · 9. International Transfers · 10. How Long We Keep Your Data · 11. Your Rights and Complaints · 12. Data Security · 13. BFTi and Automated Decisions · 14. Changes to This Policy

1. Who We Are

Blue Flag Transport Consulting Ltd, trading as BFT Consulting ("BFT", "we", "us"), is a UK transport compliance consultancy. We are registered in England and Wales, Company Number 14943001, at 18 Chivers Way, Northstowe, Cambridge CB24 1AH.

We are the data controller for the personal data described in this policy, except where we process data inside BFT Vault with BFTi on behalf of our clients (see section 5).

If you have any questions about this policy or how we handle your data, please contact us at info@bftconsulting.co.uk or on 0330 179 7379.

2. What Personal Data We Collect

2.1 Contact and enquiry form

When you contact us through our website, we collect your name, email address, telephone number and postcode (if provided), the type of enquiry, and the content of your message, including any company or operator licence details you give us.

2.2 Online bookings

When you book a consultation or call online, we collect your name, email address and any information you add to the booking notes.

2.3 Newsletter and email updates

If you sign up for our newsletter or email updates, we collect your name and email address and a record of your sign-up.

2.4 Clients and BFT Vault with BFTi users

When you become a client, we collect the contact, billing and contract details we need to provide our Services. When you use BFT Vault with BFTi, we collect your user account details (name, email, role, sign-in and security records, and the audit log of changes you make). Copies of the compliance documents and images you upload, which may include information about your drivers and staff, are covered in section 5.

2.5 Online Compliance Healthcheck

If you take part in an Online Compliance Healthcheck, we collect your contact details and the documents you choose to upload for the healthcheck.

2.6 Information from public and third-party sources

To identify transport operators who may benefit from our Services, we collect business contact information from publicly available registers and official publications. We may add business contact details (such as a work email address or telephone number) from business-contact data providers. This may include the names of directors, partners and Transport Managers. We will tell you the source of your information on request. You can object to this use at any time (see section 11).

2.7 Website use

When you visit our website, we and our advertising and analytics partners may collect information about your device and how you use the site, through cookies and similar technologies (see section 7).

3. How We Use Your Data

• To respond to your enquiry or request and arrange appointments;
• To provide our Services, including BFT Vault with BFTi, and to manage our contract with you, including billing;
• To send you service messages and compliance alerts that are part of your Services;
• To send you news, compliance updates and information about our services (see section 6);
• To identify and contact transport operators who may benefit from our Services (see section 2.6);
• To measure and improve our website and advertising, where you have agreed to cookies (see section 7);
• To comply with our legal and regulatory obligations and to establish or defend legal claims.

4. Our Lawful Basis

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we rely on the following lawful bases:

5. BFT Vault with BFTi

BFT Vault with BFTi is not a document storage or record-keeping system. BFT holds only electronic copies of the documents and images a client uploads, so that they can be processed, analysed and reported on. The documents, including information about the client's drivers, staff and Transport Manager, belong to the client.

For that information, the client (the operator) is the data controller and BFT is its data processor. We process it only to provide BFT Vault with BFTi, on the client's instructions, under our Terms and Conditions.

If you are a driver or member of staff of one of our clients, your employer's own privacy notice explains how it uses your information. Please contact your employer first about your rights.

BFTi, the intelligence and reporting feature within BFT Vault, reviews uploaded records and produces flags, reports and suggested actions, and compliance scores where the subscription tier includes them (see section 13).

Copies after a subscription ends. When a BFT Vault subscription concludes, for any reason and at every subscription tier, we hold the copies for no longer than 15 months from that date, in a closed, read-only archive, only so that a Regulatory Authority can access them. At the end of that period, the copies are securely deleted, unless the client has re-subscribed.

Access by regulators. During that period, the Traffic Commissioner, DVSA or another Regulatory Authority with a lawful request is given access to the copies as they stand at the date and time of the request. Any cost of that access is charged to the client, as set out in our Terms and Conditions. No fee applies when we help a client answer a request from an individual about their own data.

Clients must keep their original records for as long as the law requires, as some must be kept for longer than 15 months.

6. Marketing

We send marketing by email only. We do not send marketing from inside BFT Vault with BFTi.

• If you are an individual, a sole trader or a partnership (other than an LLP), we only send you marketing emails if you have agreed, or if you are an existing client, the email is about services similar to those you have bought, and we gave you a simple way to say no when we collected your details.
• If you work for a limited company or LLP, we may send marketing emails to your work address about services relevant to your role, based on our legitimate interests.
• Every marketing email tells you who it is from and includes an unsubscribe link. Opting out is free and takes effect promptly.
• BFT Vault users can turn marketing emails on or off at any time in Settings. We keep a record of each choice and when it was made.
• Turning marketing off does not stop service messages and compliance alerts that are part of your Services.

7. Cookies and Similar Technologies

Our website uses cookies and similar technologies, such as tags and pixels.

Strictly necessary. These make the website work and keep it secure. They do not need your consent.

Analytics and advertising. With your consent, we may use analytics and advertising tools from third-party providers, including tags and pixels. These help us understand how visitors use our website, measure our advertising, and show our adverts to people who have visited our website or who are similar to them. These providers may collect information such as your device, browser, IP address and the pages you visit, and may use it in line with their own privacy policies. We will tell you who these providers are on request.

These analytics and advertising technologies are only used if you agree to them in our cookie banner. You can change your choice at any time by clicking "Cookie Settings" at the bottom of any page.

8. Who We Share Data With

We do not sell, rent or trade your personal data. We share it only as follows:

Service providers who process data on our behalf, under contract and on our instructions:

• Cloud hosting, including hosting of BFT Vault with BFTi and of document copies;
• The AI service used by BFTi;
• Email and office systems, and email marketing;
• Payments;
• Appointment booking;
• Workflow automation;
• Website analytics and advertising (only with your consent, see section 7).

We will tell you who these providers are on request.

Others:

• Our associate solicitors and barristers, accountants and other professional advisers, where needed to provide our Services or run our business;
• The Traffic Commissioner, DVSA or other Regulatory Authorities, where the law requires it or where a client instructs us;
• Courts, the police or others where required by law or to establish or defend legal claims.

9. International Transfers

Some of our service providers, and some members of our team, may access personal data from outside the UK. Where this happens, we make sure the data is protected, either because the UK Government has recognised the country's data protection laws as adequate, or by using the UK's approved contract terms (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).

10. How Long We Keep Your Data

When data is no longer needed, it is securely deleted or anonymised.

11. Your Rights and Complaints

Under UK GDPR, you have the right to:

• Access: ask for a copy of the personal data we hold about you;
• Rectification: ask us to correct inaccurate data;
• Erasure: ask us to delete your data, subject to legal requirements;
• Restriction: ask us to limit how we use your data;
• Portability: receive your data in a structured, machine-readable format;
• Object: object to our use of your data based on legitimate interests, and to direct marketing at any time;
• Withdraw consent: at any time, where we rely on consent.

To exercise any of these rights, contact us at info@bftconsulting.co.uk or on 0330 179 7379. We will respond within one month. If your request is about data held in BFT Vault with BFTi on behalf of your employer, we will pass it to them and help them respond.

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. We will respond to your complaint within 28 days. You also have the right to complain to the Information Commissioner's Office (ICO): www.ico.org.uk, telephone 0303 123 1113.

12. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure. Data submitted through our website is sent over encrypted (HTTPS) connections. BFT Vault with BFTi data is encrypted in transit and at rest, and each user signs in with their own account.

13. BFTi and Automated Decisions

BFTi helps our clients and our team review compliance records. It produces flags, reports and suggested actions, and compliance scores where the subscription tier includes them, which are checked and acted on by people. BFTi does not make decisions about you that have legal or similarly significant effects.

14. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or the law. The current version will always be published on our website, and the version number at the top shows which version is current. Where a change materially affects our clients, we will tell them in line with our Terms and Conditions.