Back to buffcrm.co.uk

Buff CRM — Privacy Policy

DASE Systems Limited45 Main Street, Leeds, West Yorkshire, LS25 1DS Company Number: 17333059 VAT Registration: GB 525137996 ICO Registration: Pending registration with the Information Commissioner's Office

Version 1.4Effective date: 23 October 2026Last updated: 23 October 2026

IMPORTANT NOTICE

This Privacy Policy explains how DASE Systems Limited collects, uses, stores, and shares your personal data when you use the Buff CRM Platform and associated services. Please read it carefully.

PART 1 — WHO WE ARE

DASE Systems Limited ("DASE", "we", "us", "our") is the controller of personal data collected through the Buff CRM marketing website (buffcrm.co.uk) and is a processor of personal data that our subscribers input into the Buff CRM Platform (app.buffcrm.co.uk).

Contact details:DASE Systems Limited, 45 Main Street, Leeds, West Yorkshire, LS25 1DS Email: [email protected]

PART 2 — WHAT DATA WE COLLECT

2.1 Data you provide directly

When you sign up for Buff CRM, we collect: your name, email address, phone number, business name, and billing information. When you use the Platform, you may input customer personal data, vehicle records, job records, booking information, and payment records.

2.2 Data we collect automatically

When you visit our website or use the Platform, we automatically collect: IP address, browser type and version, pages visited, time spent on pages, referring URLs, and device information. We use cookies and similar technologies for this purpose — see our Cookie Policy for full details.

2.3 Data from third parties

We may receive data from Stripe (payment processing), Twilio (SMS delivery), and Cloudflare (security and infrastructure) in connection with providing the Platform.

2.4 Data from accounting platforms you connect

If you connect an accounting platform to your Buff account — for example QuickBooks Online, Xero or FreeAgent — you authorise that platform to share limited data with us, and you authorise us to read from and write to your ledger on your behalf. The data involved is your business data: your chart of accounts, tax rates, your customer records (contacts), invoices and credit notes, and payments. We use it only to keep your ledger and Buff in step with each other. We do not access any accounting platform you have not connected, and we do not use this data for any other purpose.

You can disconnect an integration at any time from the Integrations page in Buff, or by removing Buff's access in the accounting platform's own settings (for example the connected apps page in QuickBooks Online or Xero). Disconnecting stops the exchange of data and deletes the access tokens we hold.

PART 3 — HOW WE USE YOUR DATA

3.1 To provide the Platform

We use your data to: create and manage your account, provide the features and functionality of the Platform, process payments, send transactional communications (booking confirmations, invoices, receipts), and provide customer support.

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR).

3.2 To improve the Platform

We use aggregated and anonymised usage data to understand how the Platform is used, identify issues, and develop new features.

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) — improving our service.

3.3 To communicate with you

We send you service-related communications (account notices, security alerts, policy updates) and, where you have consented or we have a legitimate interest, marketing communications about Buff CRM.

If you start signing up and do not finish, we may email you once to offer help completing it. Nothing is charged and no account is created unless you finish, and every one of those emails carries a one-click link that stops them for good — no sign-in required.

Legal basis: Legitimate interests for service communications and for the single signup reminder (the soft opt-in for a negotiation for a sale, PECR regulation 22); consent for marketing.

3.4 To comply with legal obligations

We retain certain data to comply with financial record-keeping requirements and other legal obligations.

Legal basis: Legal obligation (Article 6(1)(c) UK GDPR).

PART 4 — YOUR DATA AS A SUBSCRIBER

4.1 Your customers' data

When you use Buff CRM to manage your detailing business, you input personal data about your own customers (their names, contact details, vehicle information, and so on). In relation to that data:

Our obligations as your processor are set out in our Data Processing Agreement, which forms part of your subscription agreement.

4.2 Your responsibilities

As the controller of your customers' data, you are responsible for: having a lawful basis to collect and process that data, providing your customers with appropriate privacy information, responding to any data subject rights requests from your customers, and ensuring you comply with UK GDPR and any other applicable data protection laws.

PART 5 — WHO WE SHARE YOUR DATA WITH

We do not sell your personal data. We share it only with:

Infrastructure and hosting: Hetzner Online GmbH (server hosting, EU-based).

Payment processing: Stripe, Inc. (payment processing). Stripe's privacy policy: stripe.com/gb/privacy.

Email delivery: Resend Inc. (transactional email delivery). Resend's privacy policy: resend.com/legal/privacy-policy.

SMS delivery: Twilio Inc. (SMS delivery). Twilio's privacy policy: twilio.com/en-us/legal/privacy.

Security and CDN: Cloudflare, Inc. (DDoS protection, CDN, DNS). Cloudflare's privacy policy: cloudflare.com/privacypolicy.

Error monitoring: Sentry (error tracking, EU servers, no PII collected).

Website analytics: Google Analytics 4 (Google LLC, United States) measures visits to our public marketing website only, and only if you accept it in the consent banner. It is not used inside the Buff CRM application, and no customer or tenant data is sent to it.

AI features: OpenAI (OpenAI OpCo, LLC) provides the language model behind the vehicle-classification and help-search features described in section 5.1. OpenAI processes this data under a data processing agreement, and for UK personal data on the basis of the EU Standard Contractual Clauses as amended by the UK Addendum.

Card payment links: Teya Services Ltd (United Kingdom) — where you connect your own Teya merchant account, the payment link for your customer is created against your account. Card details are entered on Teya's page and never reach us.

Accounting platforms you connect: when you connect QuickBooks Online (Intuit), Xero or FreeAgent, data is exchanged with that platform so that your invoices, credit notes and payments stay in step in both systems. That connection is created by you, is visible in the platform's own settings, and can be removed by you at any time.

All third-party processors are bound by data processing agreements and are required to process your data only on our instructions.

5.1 AI features — what is sent, and what is not

Some features use a third-party AI model. They are limited to the three uses below, and we do not use AI for anything else:

Nothing else is sent. We do not send your customers' names, addresses, phone numbers or email addresses, invoice or payment data, anything from a connected accounting platform (QuickBooks, Xero or FreeAgent), or any password or access token.

What the model returns is a suggestion — a class from the list you defined, or a link to a help article. Prices are never set by AI, and no AI output is used to make a decision about a person. Our own log of AI use records token counts and estimated cost only, not the text sent to or returned by the provider.

You should know two things about this provider. First, the agreement we hold with it includes a data processing agreement, and data submitted through its API is not used to train or improve its models. Second, it retains abuse-monitoring logs for up to 30 days. We keep what is sent to the minimum each feature needs.

PART 6 — INTERNATIONAL TRANSFERS

Some of our third-party processors are based outside the UK. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA) or UK adequacy decisions.

The AI provider described in section 5.1 is in the United States. That transfer is made on the basis of the EU Standard Contractual Clauses as amended by the UK Addendum, which are incorporated into the data processing agreement we hold with it.

PART 7 — HOW LONG WE KEEP YOUR DATA

Account data: Retained for the duration of your subscription and for 90 days after termination, after which it is deleted or anonymised, unless we are required to retain it longer by law.

Invoice and financial records: Retained for 6 years following the end of the relevant tax year, in accordance with HMRC requirements. Invoice records are anonymised after this period.

Marketing data: Until you withdraw consent or object to processing.

Server logs: Typically retained for 30 days.

PART 8 — YOUR RIGHTS

Under UK GDPR, you have the following rights:

Right of access: You can request a copy of the personal data we hold about you.

Right to rectification: You can ask us to correct inaccurate personal data.

Right to erasure: You can ask us to delete your personal data in certain circumstances.

Right to restriction: You can ask us to restrict how we process your data in certain circumstances.

Right to data portability: You can ask us to provide your data in a machine-readable format.

Right to object: You can object to processing based on legitimate interests or for direct marketing.

Rights related to automated decision-making: We do not make solely automated decisions with legal or similarly significant effects.

To exercise any of these rights, contact us at [email protected]. We will respond within one month.

PART 9 — SECURITY

We implement appropriate technical and organisational measures to protect your personal data, including: encryption in transit (TLS), access controls, regular backups, error monitoring, and security reviews. However, no method of transmission over the internet is 100% secure.

PART 10 — COOKIES

We use cookies and similar technologies. For full details, see our Cookie Policy.

PART 11 — CHILDREN

The Platform is not directed at children under 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, please contact us at [email protected].

PART 12 — CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes via the Platform or by email at least 30 days before they take effect. The current version and effective date are shown at the top of this document.

Version history: v1.4 (23 October 2026) adds the single reminder for an unfinished signup to section 3.3, with its legal basis and the one-click opt-out. v1.3 (8 October 2026) adds the website analytics disclosure in Part 5, Google Analytics being used on the marketing site only and opt-in. v1.2 (8 October 2026) replaces the AI provider in Part 5 and section 5.1 and updates Part 6, the provider now being under a data processing agreement with a UK transfer safeguard. v1.1 (23 September 2026) added the AI features disclosure in section 5.1, with the AI and Teya rows in Part 5. v1.0 (22 July 2026) first published.

PART 13 — COMPLAINTS

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's OfficeWycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Website: ico.org.uk Telephone: 0303 123 1113

We would appreciate the opportunity to address your concerns directly before you contact the ICO — please email us at [email protected].

PART 14 — CONTACT US

By email: [email protected]

By post:Data Protection DASE Systems Limited 45 Main Street Leeds West Yorkshire LS25 1DS

This Privacy Policy was last updated on 23 October 2026 and takes effect on that date. Version 1.4 adds the single reminder for an unfinished signup, sent once, with a one-click opt-out. Version 1.3 adds the website analytics disclosure. Version 1.2 replaced the AI provider in Part 5 and section 5.1 and updated Part 6, the provider now being under a data processing agreement with a UK transfer safeguard.