3.1 Who is responsible
3.1.1 Matthew Barton, trading as Barton’s Bespoke, is the controller for personal information used for Barton’s Bespoke’s own business purposes. Contact: support@bartonsbespoke.com; address: 39 Ormonde Crescent, Hexthorpe, Doncaster DN4 0GP.
3.1.2 Barton’s Bespoke is registered with the Information Commissioner’s Office under registration ZC258612, which you can look up on the ICO’s public register at ico.org.uk/register.
3.1.3 For personal information a dealer or workshop puts into the Barton’s Bespoke back office about its own customers, staff, suppliers and transactions, that dealer or workshop is normally the controller and Barton’s Bespoke acts as its processor. Section 3.8 and the Data processing agreement explain that relationship.
3.2 Information we collect for our own business
3.2.1 Sign-up and account information: business name, contact name, forecourt or garage location or postcode, stock size, email, telephone number, current website or system, selected package, workshop choice and anything else entered in the sign-up or brief, with a record of which version of our documents you accepted, in what words and when.
3.2.2 Walkthrough and enquiry information: contact name, business name, telephone number, email, preferred contact time, website, stock size, requirements and message content.
3.2.3 Where you came to us from one of our adverts and then send a form: which advert it was, from the campaign details and Google’s click reference in the web address the advert opened, kept with what you sent so we know which adverts bring enquiries and customers. Both are read from the address of the page, and nothing is stored in your browser for them. Google’s click reference is recorded only with a form you send: our count of visits, described under Cookies and advertising, is sent the campaign details and whether there was a click reference, never the reference itself.
3.2.4 Billing and transaction records: package, invoices, payment status and Stripe customer and payment references. Card or Apple Pay details are entered on Stripe’s own page and are not received by Barton’s Bespoke.
3.2.5 Technical and security information: server request logs, IP addresses, security events and account audit information. Your cookie choice is kept in your own browser and is not sent to us.
3.2.6 Business correspondence and support information you send to us.
3.3 Why we use it and our lawful bases
3.3.1 Contract, or steps at your request before a contract: where the individual is the person entering the contract, we use the information needed to answer a requested quote or sign-up, reserve an area, set up and provide the service, administer the account and take payment.
3.3.2 Legitimate interests: where the contract is with a company or other organisation and we deal with its staff or representatives, and for proportionate business administration, service security, fraud prevention, support, service improvement and the establishment or defence of legal claims. We consider necessity, reasonable expectations and privacy impact before relying on this basis.
3.3.3 Legal obligation: to keep information required for tax, accounting, data protection and other legal obligations.
3.3.4 Consent: where the law requires consent, including non-essential advertising cookies. You may withdraw consent for future use at any time.
3.3.5 We do not operate a marketing email list. If that changes, marketing will be handled under the applicable UK GDPR and PECR rules.
3.4 Who receives our website and account information
3.4.1 We use service providers to operate the business. These are Vercel for hosting, Resend for email delivery, Supabase for database, storage and backups, Stripe for payments, Anthropic for AI features where used, Vehicle Data Global for vehicle history, specification and valuation lookups where those features are used, Google and Meta for advertising cookies where you have accepted them, postcodes.io to find where a postcode is when you check whether your area is available (it is sent the postcode alone), and our accountant for financial records.
3.4.2 Providers receive only the information reasonably needed for their function and are used under the contractual arrangements required for their role. We do not sell personal information.
3.4.3 The provider, hosting region and transfer mechanism can change. The current list of providers that handle back-office data is in the Data processing agreement, and we will update this notice where a change materially affects how personal information is handled.
3.5 International transfers
3.5.1 Some suppliers are international businesses and personal information may be stored in, accessed from or transferred to countries outside the UK. A supplier’s US headquarters alone does not necessarily mean a restricted transfer occurs; the actual processing arrangement matters.
3.5.2 Where a restricted transfer occurs, we use a lawful transfer route appropriate to the destination and recipient, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for an eligible, actively certified US recipient), or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum, together with any required transfer risk assessment.
3.5.3 You can ask us for information about the safeguard used for a particular transfer, at support@bartonsbespoke.com.
3.6 How long we keep it
3.6.1 Enquiries, walkthrough requests and sign-ups that do not become customers: normally up to twelve months, unless needed longer for a live dispute, legal obligation or request.
3.6.2 Customer contract, invoice and accounting records: for the period reasonably required for tax, accounting, contractual and legal purposes. We currently use a six-year business retention period after the relevant relationship or record ends where appropriate, but this is a business retention policy rather than a statement that every record is legally required for exactly six years.
3.6.3 Routine server logs: normally thirty days, unless a security incident or investigation requires a relevant extract to be kept longer.
3.6.4 Processor data in the back office is kept according to the dealer’s or workshop’s instructions and the Data processing agreement, including the backup cycle described there.
3.8 Dealer and workshop customer data in the back office
3.8.1 The dealer or workshop decides why its own customer, supplier, staff, stock and transaction information is used. Barton’s Bespoke processes that information to provide the platform on the customer’s documented instructions.
3.8.2 AI-assisted features send only the information needed for the task, and only when somebody uses them, with one exception: when a question arrives from a dealer’s website, a first-reply draft is written automatically, so it is ready for the dealer to check before anything is sent. For an advert, the vehicle details; for a first-reply draft, the customer’s name, the vehicle and the enquiry text; for the questions on a dealer’s website, the visitor’s question and the relevant stock and business details; for the price check, vehicle and price data without registrations; and for workshop invoice reading, the supplier invoice images or the supplier invoices received by email.
3.8.3 The platform takes a nightly backup of the database and of the photographs, videos, photographed invoices and emailed invoices kept in the back office, and keeps each for five weeks in private storage. Deleting an item from the live system does not immediately remove it from an existing backup; it expires through the backup cycle unless a legal or security reason requires otherwise.
3.8.4 Our administration interface shows customer businesses and the account information needed to set up, reset or remove sign-ins, plans and web addresses. It does not show a dealer’s customers, stock or invoices. Access to a dealer’s customer information is restricted to what is necessary for support, security, restoration or other documented processing instructions.
3.9 Your rights
3.9.1 Depending on the circumstances, you may have rights to access personal information, correct it, erase it, restrict or object to its use, and receive certain information in a portable format. Some rights have legal exceptions.
3.9.2 Where Barton’s Bespoke is only the processor for a dealer or workshop, requests about that dealer’s records should normally be made to the dealer or workshop as controller. We assist controllers as the Data processing agreement requires.
3.9.3 We normally respond to valid rights requests within the period required by law. We may ask for the information needed to verify identity before disclosing personal information.
3.10 Data protection complaints
3.10.1 You can make a data protection complaint to support@bartonsbespoke.com or in writing to our address. Please explain what happened, the personal information involved and what you would like us to investigate.
3.10.2 We will acknowledge a data protection complaint within thirty days of receiving it, take appropriate steps to investigate it without undue delay, keep the complainant informed where appropriate, and communicate the outcome.
3.10.3 You can also complain to the Information Commissioner’s Office at ico.org.uk. You do not have to complain to us first, although giving us the opportunity to investigate may allow the issue to be resolved more quickly.
3.11 Security and changes
3.11.1 We use proportionate technical and organisational measures designed to protect personal information, including access controls, authentication, backups and security maintenance. No online system can promise absolute security.
3.11.2 We may update this notice when suppliers, features, law or processing change. The effective date at the top identifies the current version.