Privacy Policy

BSAPH Holding Company (“BSAPH”, “we”, “us”, or “our”) is the data controller for the personal information we process across all of our platforms, including MotorFile, Crave, Forecourt, ProWrench, QiblaFlow, BSA Axiom, and BSA Forge. This Privacy Policy explains what data we collect, why we collect it, and how we protect it — in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: BSAPH Holding Company, Stoke-on-Trent, Staffordshire, UK.
Contact: [email protected]

1. What We Collect

• Identity data: Name, username, date of birth (where applicable).
• Contact data: Email address, phone number, postal address.
• Vehicle data: VRNs, VINs, MOT history, mileage, service history — sourced from DVLA, DVSA, and mechanic records.
• Order data: Items ordered, totals, delivery addresses, payment status (we do not store full card details — handled by Stripe).
• Account data: Password hashes, linked social accounts (Google, Apple), 2FA settings, the BSAPH platforms your account is used on.
• Technical data: IP address, browser type, device identifiers, cookies, usage data.
• Marketing data: Communication preferences and consent records.

2. How We Use Your Data

• Providing and maintaining the BSAPH platforms and services you use.
• Processing orders, payments, and booking confirmations.
• Sending transactional communications (order updates, MOT reminders, service alerts).
• Creating and managing your BSAPH Account across all our platforms.
• Preventing fraud, maintaining security, and enforcing our terms.
• Complying with legal obligations (e.g., HMRC, consumer protection law).
• Improving our services through anonymised analytics.

3. Legal Basis for Processing

• Contract performance: To provide services you've requested.
• Legitimate interests: To improve our platforms, prevent fraud, and maintain security.
• Legal obligation: To comply with applicable UK laws.
• Consent: For marketing communications and optional analytics.

4. Third-Party Processors

5. Your Rights Under UK GDPR

• Right of access: Request a copy of all personal data we hold about you.
• Right to rectification: Correct inaccurate or incomplete data.
• Right to erasure: Request deletion of your data where no legal retention obligation applies.
• Right to portability: Receive your data in a structured, machine-readable format.
• Right to restriction: Ask us to restrict processing while a dispute is resolved.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent at any time without affecting prior lawful processing.

To exercise any right, contact [email protected]. We will respond within 30 days. You may also lodge a complaint with the Information Commissioner's Office (ICO).

6. Cookies

• Authentication: JWT session tokens stored in localStorage.
• Preferences: Cart contents and UI preferences in sessionStorage.
• Analytics: Google Tag Manager (where consented). Opt out via browser settings.
• Cloudflare: Security cookies (e.g., __cf_bm) for bot protection.

7. Security

We implement TLS encryption in transit, bcrypt password hashing, database-level encryption at rest, rate limiting on auth endpoints, CSP headers, and role-based access controls. All infrastructure runs on our own bare-metal hardware in the UK with Cloudflare DDoS protection at the edge.

8. Multi-Tenant Platforms

Some BSAPH platforms (Crave restaurants, ProWrench garages, Forecourt dealers) power our business clients' customer-facing services. In these cases, BSAPH acts as a data processor; the tenant is the data controller for their customers. Customer data is logically segregated per tenant.

9. Contact Us