Privacy Policy

Who we are

BH Commerce Ltd (company number 16310021), Bartle House, Oxford Court, Manchester, M2 3WQ, United Kingdom, is the data controller for personal data collected through bluetooth-tracker.co.uk. You can reach us about anything on this page at hello@bluetooth-tracker.co.uk.

What we collect and why

Order details

Your name, delivery address, email address and the contents and value of your order. We need these to form and perform our contract with you (UK GDPR Article 6(1)(b)), without them we cannot send you anything.

Payment information

Payments are taken by Stripe Payments UK Ltd. Your card number, expiry date and security code are entered directly into Stripe’s own hosted checkout. We never see, receive or store your card details. We only receive confirmation of whether the payment succeeded, the amount, the last four digits and the billing name.

Usage and analytics data

Pages viewed, approximate location derived from your IP address, device and browser type, and how you arrived at the site. This is processed on the basis of your consent where cookies are involved, and otherwise our legitimate interest in understanding how the site is used.

Correspondence

Anything you send us by email, kept so we can answer you and handle any return or warranty claim.

Where your data is stored

Order records are stored in our Supabase database hosted in the EU-West (Ireland) region. Our site is hosted by Vercel. Payment records are held by Stripe, and analytics data by Google. Where any of these providers transfer data outside the UK or EEA, that transfer is covered by the UK International Data Transfer Addendum or Standard Contractual Clauses.

Cookies and analytics

Only strictly necessary cookies are set when you arrive. Those are Stripe’s, which make the checkout work and help prevent fraud, and our own referral cookie, which remembers a discount code when you have followed a link carrying one. Neither needs your consent under the Privacy and Electronic Communications Regulations, because without them the service you asked for does not work.

Analytics and advertising cookies are set only after you choose “Accept everything” in the cookie banner. Until then, and permanently if you refuse, Google Analytics and Google Ads run with storage denied: nothing is written to your device, no advertising identifier is collected, and no profile is built for advertising. Our host, Vercel, also counts page views, but it does so without setting any cookie and without identifying you.

A referral from another site, an advertisement or a tagged campaign link is recorded in this browser tab for the length of the visit: the referring domain (not the full URL), any campaign parameters, the category of advertisement (not its click identifier), the landing page and the elapsed time to checkout. The record is held in this tab's session storage only, is erased when the tab closes and is transmitted with an order only if one is placed, so that we can measure which channels produce sales. No record is made while Do Not Track or Global Privacy Control is enabled, or after the cookie banner is declined. After purchase we may also ask how you heard of us; that question is optional.

The guides on this blog count their own readers without singling anyone out. Opening a guide records the guide, the point its "Show the full write-up" button appeared at, and a one-way hash of your network's IP address rather than the address; using that button is recorded in the same form. We use the totals to see which guides get read to the end and which break position suits them. Nothing is written to your device and no cookie is involved.

Selecting a link or button that leads to the checkout records one click against the page on which it appears, so that we can measure which pages assist a purchase. The record comprises the page, the button and a one-way hash of the network address (not the address itself), held solely to prevent duplicate counting; it is not associated with any individual or order. The browser tab also retains that page and transmits it with an order only if one is placed. No record is made while Do Not Track or Global Privacy Control is enabled, or after the cookie banner is declined.

You can change your answer whenever you like, withdrawing consent is as easy as giving it, and you can block or delete cookies in your browser settings at any time, although the checkout may not work correctly if you block Stripe’s. You can also opt out of Google Analytics using Google’s browser add-on.

Marketing

We do not send marketing emails unless you have specifically opted in. Ordering from us does not sign you up to anything. If you do opt in, every email carries a one-click unsubscribe link and we act on it immediately.

Sharing your data

We share personal data only with the providers needed to run the shop, and never sell it. Those providers are:

• Stripe, payment processing and fraud prevention.
• Supabase, order record storage (EU-West, Ireland).
• Vercel, website hosting and server logs.
• Google, analytics and advertising measurement.
• Royal Mail and our fulfilment partner, your name and delivery address, so the parcel arrives.

We may also disclose data where we are legally required to, for example to HMRC or in response to a valid court order.

How long we keep it

• Order and transaction records: 6 years after the end of the relevant financial year. We are required to keep these for HMRC under the Companies Act and VAT record-keeping rules, so we cannot delete them on request before then.
• Email correspondence: 2 years from your last message to us.
• Analytics data: retained by Google under the retention period configured in our account, currently 14 months.

Your rights

Under the UK GDPR you have the right to:

• be told what personal data we hold about you, and receive a copy of it (access);
• have inaccurate data corrected (rectification);
• have your data deleted (erasure), where we are not legally obliged to keep it;
• restrict or object to our processing, including profiling for advertising;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where our processing is based on consent.

Email hello@bluetooth-tracker.co.uk to exercise any of these. We will respond within one month and will not charge you. If you are unhappy with our response you can complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113.

Security

The site is served over HTTPS. Order records are held in a database with row-level security enabled and are written only by our payment webhook using a server-side key that is never exposed to your browser. Access to that data is limited to the people who need it to fulfil orders.

Children

Our site is not directed at children and we do not knowingly collect data from anyone under 16.

Changes to this policy

If we change how we handle personal data we will update this page and change the “last updated” date above. See also our terms & conditions and contact page.