Privacy policy

1. About this Policy

1.1 This Policy explains how Calfab Limited trading as Vanbitious collects, uses, shares and protects personal information.

1.2 It applies when you:

  • use our website or online store;

  • request a quotation;

  • place an order;

  • book workshop services;

  • deliver a vehicle to us;

  • create a customer account;

  • contact us;

  • subscribe to marketing;

  • make a warranty claim; or

  • otherwise interact with Vanbitious.

1.3 We process personal information in accordance with applicable UK data protection law, including the UK GDPR, the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

2. Data controller

The data controller is:

Calfab Limited trading as Vanbitious
Company number: SC702491
Unit 8
109 Urquhart Road
Aberdeen
AB24 5NH
United Kingdom

Email: hello@vanbitious.co.uk
Telephone: 0330 1225192

3. Personal information we collect

We may collect:

Identity and contact information

  • name;

  • billing and delivery address;

  • email address;

  • telephone number;

  • customer or account identifier.

Vehicle and project information

  • vehicle registration;

  • make, model, age and specification;

  • VIN or chassis information where required;

  • photographs and videos;

  • conversion plans and technical requirements;

  • details of vehicle faults and previous modifications;

  • insurance, ownership or finance information where relevant.

Order and financial information

  • products and services purchased;

  • quotations, invoices and payment status;

  • transaction references;

  • delivery details;

  • refunds and warranty claims.

We do not normally receive or store complete payment-card details. These are processed by payment providers.

Communications

  • emails, telephone notes and messages;

  • enquiries and complaints;

  • customer-support records;

  • reviews and feedback;

  • warranty evidence and technical photographs.

Website and technical information

  • IP address;

  • browser and device information;

  • account and login activity;

  • pages viewed;

  • referring website;

  • shopping-basket activity;

  • cookie preferences;

  • website interaction and diagnostic information.

Marketing information

  • newsletter subscriptions;

  • marketing preferences;

  • campaign interaction;

  • objections and unsubscribe records.

4. How we obtain information

4.1 We normally obtain information directly from you.

4.2 We may also receive information from:

  • someone authorised to act for you;

  • payment providers;

  • Shopify and connected ecommerce services;

  • couriers and delivery companies;

  • manufacturers and distributors;

  • warranty administrators;

  • finance, leasing or insurance providers where authorised;

  • fraud-prevention and identity-verification providers;

  • publicly available sources;

  • social-media platforms when you contact us through them.

5. Why we use personal information

We use personal information for the following purposes and lawful bases.

Contract

We use information where necessary to:

  • prepare quotations;

  • process orders and payments;

  • arrange delivery or collection;

  • book and perform workshop services;

  • design and document installations;

  • communicate about a project;

  • provide customer support;

  • handle returns and warranty claims;

  • maintain customer accounts.

Legal obligation

We use information where necessary to:

  • maintain tax and accounting records;

  • comply with company, consumer, product-safety and regulatory requirements;

  • respond to lawful requests;

  • report or investigate safety issues;

  • meet data-protection obligations.

Legitimate interests

Where our interests are not overridden by your rights, we may use information to:

  • operate and improve our business;

  • secure our website, systems and premises;

  • prevent fraud and misuse;

  • manage suppliers and deliveries;

  • maintain technical, quality-control and warranty records;

  • establish, exercise or defend legal claims;

  • understand product and service performance;

  • obtain professional advice;

  • communicate with business contacts;

  • use appropriately anonymised or non-identifying project photographs for our portfolio and marketing.

You may object to processing based on legitimate interests. We will assess your objection in accordance with the law.

Consent

We rely on consent where required for:

  • marketing emails or messages;

  • non-essential cookies and similar technologies;

  • publication of identifiable customer images or testimonials; and

  • any other purpose for which consent is specifically requested.

Consent may be withdrawn at any time without affecting processing carried out before withdrawal.

Direct marketing and soft opt-in

Where legally permitted, we may contact an existing customer about our own similar goods or services under the customer “soft opt-in”. This applies only where we gave the customer a clear opportunity to opt out when their details were collected and in each subsequent message.

6. Vehicle and project photographs

6.1 We may retain photographs and video for technical records, project management, quality assurance, insurance, training, warranty and legal purposes.

6.2 We may use non-identifying photographs of work for our website, portfolio and social media based on our legitimate interests.

6.3 We will take reasonable steps to remove or obscure:

  • vehicle registrations;

  • customer names and addresses;

  • personal documents;

  • recognisable individuals;

  • other information likely to identify a customer.

6.4 We will obtain an appropriate lawful basis, including consent where required, before intentionally publishing identifiable customer content.

6.5 You may object to promotional use by emailing hello@vanbitious.co.uk.

7. Payment processing

7.1 Online payments may be processed by providers such as Shopify Payments, Stripe or other payment services made available through Shopify.

7.2 Payment providers process information under their own privacy terms and security arrangements.

7.3 We normally receive confirmation, transaction references and limited payment information rather than full card details.

7.4 Payment and ecommerce providers may carry out fraud-prevention checks.

8. Sharing personal information

We may share information where necessary with:

Ecommerce and technical providers

  • Shopify;

  • website-hosting and IT providers;

  • customer-account providers;

  • security, analytics and fraud-prevention services;

  • website applications and support providers.

Payment providers

  • Shopify Payments;

  • Stripe;

  • banks and payment-card services.

Delivery providers

  • DPD;

  • Royal Mail;

  • specialist dangerous-goods carriers;

  • other couriers selected for an order.

Product and service providers

  • manufacturers;

  • distributors;

  • warranty administrators;

  • specialist subcontractors;

  • technical-support providers.

Professional and public bodies

  • accountants;

  • insurers;

  • solicitors and debt-recovery providers;

  • courts and dispute-resolution bodies;

  • regulators, police or public authorities where legally required.

8.2 We do not sell personal information.

8.3 Service providers may use information only for the agreed purpose, except where they independently determine their own lawful purposes.

9. International transfers

9.1 Some providers, including Shopify and connected technology services, may process information outside the United Kingdom.

9.2 Where personal information is transferred internationally, we use or require an appropriate legal safeguard, which may include:

  • UK adequacy regulations;

  • the UK International Data Transfer Agreement;

  • the UK Addendum to approved contractual clauses; or

  • another safeguard permitted by UK data protection law.

9.3 You may contact us for further information about safeguards relevant to your information.

10. Retention

10.1 We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, safety and warranty requirements.

10.2 Typical periods include:

  • quotations not resulting in work: normally up to two years;

  • order, invoice and accounting records: normally at least six years;

  • contracts and project records: normally six years after completion;

  • technical and installation records: normally six years after completion or longer where reasonably required for safety;

  • warranty records: for the relevant warranty period and a reasonable period afterwards;

  • records relating to products with longer manufacturer warranties: for the warranty period and a reasonable period afterwards;

  • unresolved disputes or legal claims: until the matter and relevant limitation period have ended;

  • marketing records: until consent is withdrawn or an objection is made;

  • suppression records: as long as reasonably necessary to ensure we respect an opt-out;

  • website and cookie information: according to the duration identified in our cookie-preference tool.

10.3 We may retain information for longer where required by law, a regulator, litigation hold, safety concern or ongoing dispute.

10.4 When information is no longer required, we will delete, anonymise or securely destroy it.

11. Security

11.1 We use reasonable technical and organisational measures to protect personal information.

11.2 These may include:

  • restricted access;

  • password and account controls;

  • secure hosting;

  • encryption used by payment and technology providers;

  • backups;

  • staff access controls;

  • system monitoring;

  • secure disposal.

11.3 No internet or storage system is completely secure. You should avoid sending unnecessary sensitive information through ordinary email.

12. Cookies and similar technologies

12.1 Our website uses cookies, pixels, local storage and similar technologies.

12.2 These technologies may be used for:

Strictly necessary purposes

  • shopping-basket and checkout operation;

  • customer login;

  • security and fraud prevention;

  • remembering privacy choices;

  • network and website operation.

These technologies may operate without consent where legally permitted.

Functional purposes

  • remembering preferences;

  • providing enhanced website functions;

  • supporting customer-service tools.

Analytics purposes

  • measuring visitor numbers;

  • understanding website use;

  • diagnosing errors;

  • improving website performance.

Advertising and marketing purposes

  • measuring campaigns;

  • limiting repeated advertisements;

  • understanding marketing interaction;

  • personalising advertising where enabled.

12.3 We request consent before using non-essential technologies unless a specific legal exemption applies.

12.4 You can accept, reject or manage non-essential technologies through our cookie banner or Cookie Preferences tool.

12.5 Withdrawing consent is as easy as giving it and does not affect processing that occurred before withdrawal.

12.6 Current information about individual technologies, providers, purposes and lifetimes is displayed through the website’s Cookie Preferences tool and forms part of this Policy.

12.7 Browser settings can also block or delete cookies, although this may affect website functionality.

13. Marketing

13.1 We may send marketing where:

a. you have consented;
b. the customer soft opt-in lawfully applies; or
c. another lawful rule permits the communication.

13.2 Every electronic marketing message will provide a simple way to unsubscribe.

13.3 You can opt out at any time by:

13.4 Service, safety, order and warranty communications are not marketing and may still be sent where necessary.

14. Automated decisions

14.1 Payment, ecommerce and fraud-prevention providers may use automated tools to assess transactions.

14.2 We do not normally make decisions producing legal or similarly significant effects based solely on automated processing.

14.3 If an order is blocked or referred for fraud concerns, you may contact us to request review and provide further information.

15. Your rights

Depending on the circumstances, you may have the right to:

  • access your personal information;

  • receive supplementary information about its use;

  • correct inaccurate or incomplete information;

  • request deletion;

  • request restriction of processing;

  • object to processing based on legitimate interests;

  • object absolutely to direct marketing;

  • receive qualifying information in a portable format;

  • withdraw consent;

  • request human review of a qualifying automated decision; and

  • complain about our handling of personal information.

These rights may be subject to legal conditions and exemptions.

Requests should be sent to hello@vanbitious.co.uk. We may request reasonable proof of identity or authority.

16. Data-protection complaints

16.1 You may make a data-protection complaint by emailing hello@vanbitious.co.uk with the subject “Data Protection Complaint”.

16.2 Please explain:

  • the information or processing concerned;

  • what you believe went wrong; and

  • what outcome you are seeking.

16.3 We will:

a. provide a clear way to complain;
b. acknowledge the complaint within 30 days;
c. take appropriate steps to investigate;
d. keep you informed where necessary; and
e. communicate the outcome without undue delay.

16.4 If you remain dissatisfied, you may complain to:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk
Telephone: 0303 123 1113

17. Children

17.1 Our goods and services are not directed at children.

17.2 We do not knowingly collect children’s information for marketing.

17.3 A parent or guardian who believes a child has provided personal information should contact us.

18. Third-party links and platforms

18.1 Our website may link to manufacturers, social-media services and third-party websites.

18.2 Those organisations control their own privacy practices. You should review their privacy information before providing personal information.

19. Changes to this Policy

19.1 We may update this Policy to reflect legal, technical or operational changes.

19.2 The current version and effective date will be published on our website.

19.3 Where a change materially affects how we use existing personal information, we will provide additional notice where required.

20. Contact

Questions, rights requests and data-protection complaints should be sent to:

Calfab Limited trading as Vanbitious
Unit 8
109 Urquhart Road
Aberdeen
AB24 5NH

Email: hello@vanbitious.co.uk
Telephone: 0330 1225192