GDPR policy

1. Scope and responsibilities

This policy sets out the data-protection standards for Epione Trading Ltd, operating B-MO. It addresses the UK GDPR and Data Protection Act 2018, as amended, and the EU GDPR where it applies to the relevant processing. Publishing this policy is not a certification that every operational requirement has been met.

B-MO acts as controller for its own business contacts, enquiries and subscription administration. A business using B-MO normally controls the purposes of its customer programme, with B-MO processing records on its documented instructions. The privacy policy explains personal-data handling; the data processing agreement sets out the processor commitments.

2. Our data-protection standards

Processing must have an identified lawful basis and a clear purpose explained to the people affected. Information must be limited to what is necessary, kept accurate where required, protected against inappropriate access or loss, and retained only for a justified period. The responsible team must keep records that demonstrate these decisions.

New services, integrations and changes must be assessed before activation. The assessment must identify the people and information involved, controller and processor roles, access, suppliers, countries, retention, and any need for a data-protection impact assessment. Default settings should avoid unnecessary collection and sharing.

3. Marketing and sensitive information

Service messages and promotional campaigns must be distinguished. Businesses must establish the applicable lawful basis and meet electronic-marketing rules before sending campaigns, keep evidence of relevant permissions, and honour objections and withdrawals. Joining a loyalty programme is not blanket permission for every marketing channel.

Appointment details can reveal health information. Recall Pass activation requires an assessment of the actual data and any applicable special-category condition, together with an agreed processing schedule. Clinical notes and unnecessary sensitive information must not be supplied. Additional checks are needed where a service involves children or other people who may be particularly vulnerable.

SMS sending and Apple Wallet nearby reminders require a business-specific assessment of their data use and appropriate permissions before activation. Planned NFC features must also be assessed before launch. The current NFC website demonstration does not read location or physical tags.

4. Your rights and requests

Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability, object to processing, and withdraw consent where it is used. These rights can have conditions or exemptions. You can object to the use of your personal information for direct marketing.

Contact sales@bmopass.com in ordinary language. We may need proportionate information to verify identity or clarify the request. Requests must be handled without undue delay, normally within one calendar month under the applicable rules; any permitted extension or refusal must be explained.

If a business issued your card, contact that business about its customer records. Where B-MO is its processor, the request must be passed to the controller and supported under the processing agreement. You can complain to the Information Commissioner’s Office, or the competent supervisory authority where applicable, without first buying a service or obtaining our permission.

5. Suppliers, retention and transfers

A supplier must be assessed for its role, safeguards and written terms before receiving personal data. Controller–processor contracts and any sub-processor authorisations must be completed as required. International transfers need an applicable lawful mechanism and any required assessment or additional safeguards.

Retention and deletion arrangements must be documented for each service, including backups, exports and legal record-keeping requirements. Hosting in Europe does not by itself establish that every supplier, support team or backup processes data only in the EU.

6. Security, incidents and review

The security policy sets out the safeguards and reporting process. Incidents must be assessed promptly, recorded and escalated so that any required notifications to controllers, regulators or affected people can be made within the applicable deadlines.

Before live paid onboarding, the operational review must confirm the responsible contacts, registration or fee position where required, supplier arrangements, risk assessments, retention schedules and evidence of controls. The policy must be reviewed when the service or applicable requirements change.

Further guidance: ICO data-protection principles and European Commission GDPR principles.