Privacy policy

1. Who is responsible for your data

B-MO is part of Epione Trading Ltd, company number 17173162. Contact us at sales@bmopass.com for privacy questions or requests.

We decide how website enquiries and our business-account, support and billing records are used. If you hold a card issued by a business using B-MO, that business normally decides how your customer information is used. We process its customer records on its instructions. Its own privacy notice explains its purposes and choices.

2. Information we handle

• Enquiries and support: your name, email, business details and messages. Our contact form opens your own email app; completing it alone does not send the information to B-MO.
• Website access: hosting providers may process IP addresses, browser and device information, requested pages, request times and security logs to deliver and protect the site.
• Business accounts and payments: where you subscribe, account contacts, selected plan, subscription status, invoices and payment references. Stripe handles payment-card entry. Full card numbers and security codes are not collected through our website.
• Customer programmes: depending on the setup, contact details, card identifiers, balances, recorded spend or activity, visits, rewards, optional date of birth for birthday features, membership dates, preferences, consent records and wallet-device registration information.
• Appointments: where Recall Pass is configured, appointment dates, times, practice or provider details, booking references and reminder information supplied by the connected business. Appointment information can be sensitive; do not send clinical notes through the website enquiry form.

Information comes from you, your business or authorised staff, connected services you choose to use, and technical requests to the site. Demo cards use sample names and details. Trying a demonstration does not enrol you in a live customer programme.

3. Why we use information

We use enquiries to answer questions and discuss the service; account information to supply support and administer subscriptions; transaction records for accounting and legal obligations; and technical information to maintain security and reliability.

For our own records, our legal bases are taking steps towards or performing a contract with you, complying with legal obligations, and our legitimate interests in responding to business contacts and operating a secure service. Where consent is required, including for relevant marketing, we ask for it separately. You can withdraw consent or object to direct marketing.

Enquiry details are voluntary, but we need a way to contact you to reply. Account and billing details are necessary to administer a subscription. The marketing website does not make decisions with legal or similarly significant effects solely by automated means. Businesses may use configured visit patterns or reward activity to choose relevant messages; their privacy notice should explain that use.

4. Service providers and sharing

The website is hosted by Vercel. Stripe processes payments when checkout is enabled. Our business platform uses services such as Supabase for database and account functions, Resend for email, and Apple or Google for supported wallet features. Where AI-assisted drafting or insights are enabled, Anthropic may receive business details, campaign text and the information supplied for that task. Booking providers supply appointment data for configured Recall Pass connections. The providers involved depend on the services your business activates.

We share information needed to operate the relevant service, respond to authorised instructions or meet legal requirements. Customer information is not offered for sale. A payment or wallet provider may also act under its own privacy terms for its services.

See Vercel’s privacy notice and Stripe’s privacy policy. Business-specific processing instructions, supplier arrangements and additional integrations are addressed in the data-processing agreement for that service. The service schedule must identify the actual suppliers and data involved.

5. Where information is processed

Vercel uses a global delivery network, including European locations. A page loading from London or an EU location does not mean all related processing takes place only in the UK or EU. Hosting, payments, email and wallet providers may process information in other countries, including the United States.

Restricted transfers require an applicable legal mechanism, such as adequacy arrangements or approved contractual safeguards. The applicable provider terms and service configuration determine the arrangements. Contact us for information about safeguards relevant to your data; any additional customer-data integration must have its processing and transfer arrangements agreed before activation.

6. Retention and security

We keep enquiries for as long as needed to answer them and manage the resulting business relationship. Account and transaction records are retained for the service, applicable accounting and legal requirements, and the resolution of disputes. Security records are retained according to the need to investigate incidents and protect the service. Records should be deleted or anonymised when those purposes no longer apply.

The business issuing your card determines customer-record retention under its agreement with B-MO. Export, deletion and backup handling follow those instructions and any legal retention requirement. Removing a record can affect its card and rewards. We do not promise that deletion instantly removes every backup or independent copy held by a wallet provider.

Access controls and secure connections protect information. No online service can guarantee absolute security. Contact us promptly if you suspect unauthorised access.

7. Cookies and marketing

B-MO has not added advertising trackers or analytics scripts to this marketing website. The card demonstrations and pricing choices run in your browser. The demo lets you enter sample branding and names: these appear in any demo link you create and share. Use sample information, because anyone with that link can view it. Shared details are encoded after # in the URL, which is not sent in the website request to our host. A website address you enter is used locally to create a QR; opening it takes you to that website. The NFC walkthrough is an animation and does not scan tags, request location or send messages. Hosting access protection, or a separate checkout you open, may use necessary cookies or similar technology under that provider’s notice.

Sending an enquiry does not automatically subscribe you to marketing. Marketing permissions are separate from messages needed to provide a service. Visiting this website does not send an SMS or request your location. An SMS provider must be configured for a business before it can send texts. Apple Wallet uses locations included in a saved pass to decide whether to surface it nearby; that matching happens on the customer’s device. Our cookie policy explains the current website behaviour.

8. Your rights and complaints

Depending on the circumstances, you can request access, correction, erasure, restriction or a portable copy of your information, object to processing and withdraw consent. These rights are subject to applicable conditions. We may need to verify your identity and will explain any lawful reason we cannot meet a request. Requests are normally answered within one month; we will tell you if a lawful extension applies.

For a business-issued card, contact that business first. You may also contact us and we will help direct the request to the responsible business. For B-MO’s own records, email sales@bmopass.com.

You can complain to the Information Commissioner’s Office, the UK data protection regulator, or your applicable local supervisory authority. You do not have to complain to us first.

9. Updates

We will update this policy when our services or data practices change and provide further notice where required. Our terms and conditions describe the business subscription arrangements.