Privacy Policy

1. Who we are (data controller)

Ian Baird, trading as Blue Meets White
Office 1, Izabella House, 24–26 Regent Place, Birmingham B1 3NJ, United Kingdom
Email: ian@bluemeetswhite.com

We are not currently registered with the UK Information Commissioner's Office. If registration becomes required as our processing changes, we will update this page with the registration number.

2. What personal data we collect

When you submit a repair or when our staff update your order, we collect:

• Contact details: your name, email address, and phone number (including international dialling code) for primary, shipping, and billing contacts.
• Addresses: shipping and billing address and country. Addresses can be entered manually or selected via Google Places autocomplete — see section 5.
• Order details: number of ICOM units, MAC addresses, purchase order numbers, and any comments or notes you provide.
• Uploaded files: parcel condition photos and any files or photos you or our staff attach against a MAC address.
• Financial data: estimated and final invoice line values, and a flag/date when payment is marked as received. We do not process card payments through this site and never see or store your card details.
• Correspondence: confirmation, shipping, accounts, and legal emails sent to you, and consignment/tracking numbers created by our couriers.
• Staff account data: for internal users only — email address and authentication data used to sign in to the admin area.

3. Legal bases for processing

• Contract (Art. 6(1)(b) UK GDPR): to fulfil the repair you have asked us to carry out and to communicate about your order.
• Legal obligation (Art. 6(1)(c)): to keep the accounting and tax records UK law requires us to keep.
• Legitimate interests (Art. 6(1)(f)): to run the service safely, prevent fraud, and improve our workshop operations. You can object at any time (see section 9).

4. How we use your data

• Receive, track, and complete your repair order.
• Send transactional emails (order received, shipping instructions, accounts / pro-forma invoice, terms, shipment updates, and final invoice).
• Generate shipping labels and paperwork, and arrange courier collection and return.
• Produce invoices and keep the accounting records required by UK law.

5. Sharing and sub-processors

We share data only with the service providers we need to run the service:

• Lovable Cloud — hosting, database, file storage, and transactional email infrastructure for this site. Underlying infrastructure includes Supabase and Cloudflare.
• Google Maps Platform (Places API) — powers address autocomplete on the submission form. What you type into the address field is sent to Google to return suggestions. See Google's Privacy Policy.
• Google Workspace (Docs & Drive) — we generate your Shipping, Accounts (pro-forma invoice), and Legal documents by merging your order data into Google Doc templates and storing the resulting PDFs in our Google Drive.
• Couriers — when we book a return shipment, the recipient name, shipping address, phone number, and consignment/tracking number are shared with the chosen courier so they can deliver the parcel.

We do not sell your data, and we do not share it with advertising networks or data brokers.

6. Cookies and similar technologies

This site uses only strictly necessary storage:

• Authentication: when a staff member signs in, an authentication token is stored in their browser's local storage so they stay signed in. Customers who only submit and track orders are not asked to sign in and no login cookie is set for them.
• No analytics or advertising: we do not use Google Analytics, Meta Pixel, or any other analytics, marketing, or tracking cookies.
• Third-party scripts: when the address autocomplete field loads, Google may set its own cookies on your device. This is controlled by Google under their own privacy policy.

7. International transfers

Some of our providers (notably Google and Cloudflare) are US-based or operate a global edge network. Where personal data is transferred outside the UK, we rely on the UK ICO-approved transfer mechanisms these providers publish — the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum.

8. How long we keep your data

We keep order records, correspondence, invoices, uploaded photos, and generated documents for as long as we are required to keep them to comply with UK financial and accounting law (which for most business records is at least six years from the end of the relevant accounting period). After that period, records are deleted or anonymised.

You can ask us to delete your data sooner, and we will do so unless we are legally required to keep it (see section 9).

9. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Ask us to correct data that is inaccurate or incomplete.
• Ask us to erase your data ("right to be forgotten"), subject to legal retention requirements.
• Ask us to restrict how we process your data.
• Receive a copy of your data in a portable format.
• Object to processing carried out under legitimate interests.
• Withdraw any consent you previously gave, at any time.

To exercise any of these rights, email ian@bluemeetswhite.com. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.

10. Security

The site is served over HTTPS. Access to the admin area requires authentication, and database row-level security policies restrict who can read or change each order. Uploaded files are served via short-lived signed URLs. No system can be guaranteed 100% secure, but we take reasonable steps to protect the data we hold.

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page. Material changes affecting how we use your data will be highlighted on the site.