Privacy Policy
Who We Are
Blue Flag Transport Consulting Ltd, trading as BFT Consulting ("BFT", "we", "us"), is a UK transport compliance consultancy. We are registered in England and Wales, Company Number 14943001, at 18 Chivers Way, Northstowe, Cambridge CB24 1AH.
We are the data controller for the personal data described in this policy, except where we process data inside BFT Vault with BFTi on behalf of our clients (see section 5).
If you have any questions about this policy or how we handle your data, please contact us at info@bftconsulting.co.uk or on 0330 179 7379.
What Personal Data We Collect
2.1 Contact and enquiry form
When you contact us through our website, we collect your name, email address, telephone number and postcode (if provided), the type of enquiry, and the content of your message, including any company or operator licence details you give us.
2.2 Online bookings
When you book a consultation or call online, we collect your name, email address and any information you add to the booking notes.
2.3 Newsletter and email updates
If you sign up for our newsletter or email updates, we collect your name and email address and a record of your sign-up.
2.4 Clients and BFT Vault with BFTi users
When you become a client, we collect the contact, billing and contract details we need to provide our Services. When you use BFT Vault with BFTi, we collect your user account details (name, email, role, sign-in and security records, and the audit log of changes you make). Copies of the compliance documents and images you upload, which may include information about your drivers and staff, are covered in section 5.
2.5 Online Compliance Healthcheck
If you take part in an Online Compliance Healthcheck, we collect your contact details and the documents you choose to upload for the healthcheck.
2.6 Information from public and third-party sources
To identify transport operators who may benefit from our Services, we collect business contact information from publicly available registers and official publications. We may add business contact details (such as a work email address or telephone number) from business-contact data providers. This may include the names of directors, partners and Transport Managers. We will tell you the source of your information on request. You can object to this use at any time (see section 11).
2.7 Website use
When you visit our website, we and our advertising and analytics partners may collect information about your device and how you use the site, through cookies and similar technologies (see section 7).
How We Use Your Data
- To respond to your enquiry or request and arrange appointments;
- To provide our Services, including BFT Vault with BFTi, and to manage our contract with you, including billing;
- To send you service messages and compliance alerts that are part of your Services;
- To send you news, compliance updates and information about our services (see section 6);
- To identify and contact transport operators who may benefit from our Services (see section 2.6);
- To measure and improve our website and advertising, where you have agreed to cookies (see section 7);
- To comply with our legal and regulatory obligations and to establish or defend legal claims.
Our Lawful Basis
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we rely on the following lawful bases:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and bookings | Legitimate interests (responding to people who contact us); contract, where you are asking about our Services |
| Providing our Services and managing the contract | Contract |
| Service messages and compliance alerts | Contract |
| Marketing emails to individuals, sole traders and partnerships (other than LLPs) | Consent, or the existing-customer exception in PECR regulation 22(3) |
| Marketing emails to companies and LLPs, and contacting prospective clients identified from public sources | Legitimate interests (promoting our services to businesses in our sector), with a right to object at any time |
| Analytics and advertising cookies and pixels | Consent |
| Legal and regulatory obligations; legal claims | Legal obligation; legitimate interests |
BFT Vault with BFTi
BFT Vault with BFTi is not a document storage or record-keeping system. BFT holds only electronic copies of the documents and images a client uploads, so that they can be processed, analysed and reported on. The documents, including information about the client's drivers, staff and Transport Manager, belong to the client.
For that information, the client (the operator) is the data controller and BFT is its data processor. We process it only to provide BFT Vault with BFTi, on the client's instructions, under our Terms and Conditions.
If you are a driver or member of staff of one of our clients, your employer's own privacy notice explains how it uses your information. Please contact your employer first about your rights.
BFTi, the intelligence and reporting feature within BFT Vault, reviews uploaded records and produces flags, reports and suggested actions, and compliance scores where the subscription tier includes them (see section 13).
Copies after a subscription ends. When a BFT Vault subscription concludes, for any reason and at every subscription tier, we hold the copies for no longer than 15 months from that date, in a closed, read-only archive, only so that a Regulatory Authority can access them. At the end of that period, the copies are securely deleted, unless the client has re-subscribed.
Access by regulators. During that period, the Traffic Commissioner, DVSA or another Regulatory Authority with a lawful request is given access to the copies as they stand at the date and time of the request. Any cost of that access is charged to the client, as set out in our Terms and Conditions. No fee applies when we help a client answer a request from an individual about their own data.
Clients must keep their original records for as long as the law requires, as some must be kept for longer than 15 months.
Marketing
We send marketing by email only. We do not send marketing from inside BFT Vault with BFTi.
- If you are an individual, a sole trader or a partnership (other than an LLP), we only send you marketing emails if you have agreed, or if you are an existing client, the email is about services similar to those you have bought, and we gave you a simple way to say no when we collected your details.
- If you work for a limited company or LLP, we may send marketing emails to your work address about services relevant to your role, based on our legitimate interests.
- Every marketing email tells you who it is from and includes an unsubscribe link. Opting out is free and takes effect promptly.
- BFT Vault users can turn marketing emails on or off at any time in Settings. We keep a record of each choice and when it was made.
- Turning marketing off does not stop service messages and compliance alerts that are part of your Services.
Cookies and Similar Technologies
Our website uses cookies and similar technologies, such as tags and pixels.
Strictly necessary. These make the website work and keep it secure. They do not need your consent.
Analytics and advertising. With your consent, we may use analytics and advertising tools from third-party providers, including tags and pixels. These help us understand how visitors use our website, measure our advertising, and show our adverts to people who have visited our website or who are similar to them. These providers may collect information such as your device, browser, IP address and the pages you visit, and may use it in line with their own privacy policies. We will tell you who these providers are on request.
These analytics and advertising technologies are only used if you agree to them in our cookie banner. You can change your choice at any time by clicking "Cookie Settings" at the bottom of any page.
Who We Share Data With
We do not sell, rent or trade your personal data. We share it only as follows:
Service providers who process data on our behalf, under contract and on our instructions:
- Cloud hosting, including hosting of BFT Vault with BFTi and of document copies;
- The AI service used by BFTi;
- Email and office systems, and email marketing;
- Payments;
- Appointment booking;
- Workflow automation;
- Website analytics and advertising (only with your consent, see section 7).
We will tell you who these providers are on request.
Others:
- Our associate solicitors and barristers, accountants and other professional advisers, where needed to provide our Services or run our business;
- The Traffic Commissioner, DVSA or other Regulatory Authorities, where the law requires it or where a client instructs us;
- Courts, the police or others where required by law or to establish or defend legal claims.
International Transfers
Some of our service providers, and some members of our team, may access personal data from outside the UK. Where this happens, we make sure the data is protected, either because the UK Government has recognised the country's data protection laws as adequate, or by using the UK's approved contract terms (the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses).
How Long We Keep Your Data
| Data | How long |
|---|---|
| Enquiry and contact form data | Up to 2 years from the enquiry, unless you become a client |
| Client contract, billing and accounting records | The engagement plus 6 years, in line with statutory limitation periods |
| BFT Vault with BFTi document copies | While the subscription is active, then no longer than 15 months in a read-only archive, for regulator access only (section 5) |
| BFT Vault user account and audit records | While the subscription is active, then 15 months with the archive |
| Online Compliance Healthcheck documents | Deleted at your request once the healthcheck has been presented or emailed to you |
| Newsletter subscription data | Until you unsubscribe |
| Prospective-client data from public sources | Up to 2 years from our last contact with you, unless you become a client or object sooner |
| Records of marketing choices and opt-outs | For as long as we hold your contact details, plus 2 years, so we can prove your choice and respect an opt-out |
| Cookies | As shown in Cookie Settings |
When data is no longer needed, it is securely deleted or anonymised.
Your Rights and Complaints
Under UK GDPR, you have the right to:
- Access: ask for a copy of the personal data we hold about you;
- Rectification: ask us to correct inaccurate data;
- Erasure: ask us to delete your data, subject to legal requirements;
- Restriction: ask us to limit how we use your data;
- Portability: receive your data in a structured, machine-readable format;
- Object: object to our use of your data based on legitimate interests, and to direct marketing at any time;
- Withdraw consent: at any time, where we rely on consent.
To exercise any of these rights, contact us at info@bftconsulting.co.uk or on 0330 179 7379. We will respond within one month. If your request is about data held in BFT Vault with BFTi on behalf of your employer, we will pass it to them and help them respond.
If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. We will respond to your complaint within 28 days. You also have the right to complain to the Information Commissioner's Office (ICO): www.ico.org.uk, telephone 0303 123 1113.
Data Security
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure. Data submitted through our website is sent over encrypted (HTTPS) connections. BFT Vault with BFTi data is encrypted in transit and at rest, and each user signs in with their own account.
BFTi and Automated Decisions
BFTi helps our clients and our team review compliance records. It produces flags, reports and suggested actions, and compliance scores where the subscription tier includes them, which are checked and acted on by people. BFTi does not make decisions about you that have legal or similarly significant effects.
Changes to This Policy
We may update this policy from time to time to reflect changes in our practices or the law. The current version will always be published on our website, and the version number at the top shows which version is current. Where a change materially affects our clients, we will tell them in line with our Terms and Conditions.