Privacy Policy

Last updated: 1st October 2026

Who we are and how to contact us

BQ Watches Ltd (“BQ Watches”, “we”, “us”, “our”) is the controller of your personal data. This means we decide how and why it is used. We are a company registered in England and Wales (company number 07067258) with our registered office at 74-76 Watling Street, Radlett, Hertfordshire, WD7 7NP. Our showroom is at 74-76 Watling Street, Radlett, Hertfordshire, WD7 7NP.
We are registered with the Information Commissioner’s Office (ICO), registration number ZB059818.
Our data protection manager is Simon Evans. If you have a question about this policy, or want to use any of your rights, contact us:
E: simon@bqwatches.com
T: 01923 85 58 58
A: Data Protection Manager, BQ Watches Ltd, 74-76 Watling Street, Radlett, Hertfordshire, WD7 7NP
This policy explains how we use personal data when you visit our website, contact us in any way (phone, email, WhatsApp, live chat, social media or in person), buy, sell, part-exchange, consign, repair or value a watch with us, have an account with us, or receive marketing from us. It does not cover our staff or job applicants, who receive a separate notice.
We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

At a glance

We use your information to answer your enquiries, buy, sell, repair and value watches, arrange delivery and payment, keep proper records and meet our legal obligations.
We record and transcribe phone calls, and we use AI tools to help our team: to summarise conversations, suggest replies and keep notes of your preferences. A member of our team reviews anything we send you. We do not make decisions about you that have legal or similarly significant effects by automated means alone.
We only send you marketing if you have agreed to it, or if you are an existing customer and have not opted out. You can stop it at any time.
We only use analytics and advertising cookies if you agree to them.
We use trusted service providers, some of them outside the UK (mainly in the USA). Where we do, we protect your data with approved safeguards.
We never sell your personal data.
You have rights over your data, including to access it, correct it, delete it and object to how we use it. See “Your rights” below.

The information we collect

Depending on how you deal with us, we may collect:
- Identity data: name, title, company name, and date of birth or signature where we need them for a transaction or a legal check.
- Contact data: email address, phone numbers, WhatsApp number, and postal, billing and delivery addresses.
- Watch and transaction data: the watches you buy, sell, part-exchange, consign, have repaired or valued; serial and reference numbers; photos and documents you send us (for example box, papers and receipts); prices, offers, repair and valuation details; orders, contracts, invoices and delivery records.
- Financial data: your bank account details when we pay you for a watch; payment references and status; finance application status. We do not store your full card details — card payments are handled by our payment providers.
- Verification and compliance data: identity documents, proof of address and the results of sanctions and other legally required checks, where we need to carry them out.
- Communications: emails, letters, WhatsApp and SMS messages, live chat conversations and attachments, notes of conversations, and recordings and transcripts of phone calls and summaries of them.
- Preferences and profile data: watches and brands you are interested in, your wishlist, budget range, collecting interests, how and when you like to be contacted, and details you choose to share with us (for example an anniversary you are shopping for). Some of this is recorded with the help of AI from our conversations with you — see “How we use AI”.
- Marketing data: your marketing choices, records of your consent, and whether you open or click our emails.
- Technical and usage data: IP address, device and browser information, pages you visit, how you reached our website (including campaign tags and advertising click identifiers), and call-tracking information that links a phone call to the web pages that led to it. Most of this is collected using cookies and similar technologies, subject to your choices — see “Cookies”.
- Account data: the login details for your website account. Passwords are stored in a secure, hashed form.
If you tell us about other people — for example a family member you are buying a gift for — please make sure they are happy for you to share their details.
Sensitive information. We do not ask for information about health, religion, ethnicity, sexual orientation, political opinions or similar “special category” data. If you choose to share it with us, we will only record it where we need it to help you. We exclude it from our automated preference notes and delete it when it is no longer needed.
If you don’t give us information. We need some information to do what you ask, for example your contact details to complete an order, or your bank details to pay you for a watch. Where the law requires us to check your identity, we cannot complete the transaction without that check.

Where we get your information

From you: when you fill in a form, contact us, visit our showroom, open an account, place an order, or send us photos and documents.
Automatically: from your device when you use our website, subject to your cookie choices.
From third parties:
- payment and finance providers (for example Stripe, TrueLayer and Affirm), about your payment or finance application;
- our call-tracking provider (Mediahawk): the number you called from, and the web pages or advertising that led to your call;
- our call-answering service (AllDayPA), when they take a message for us;
- marketplaces and platforms where you contact us or deal with us (for example Chrono24 and eBay);
- delivery companies, about the delivery of your parcel;
- review websites (for example Trustpilot and Google) when you review us, and social media platforms when you interact with our pages;
- someone who refers you to us, or who buys from us on your behalf;
- publicly available sources such as Companies House, if you deal with us on behalf of a business.

How we use your information, and our lawful bases

The law allows us to use personal data only where we have a “lawful basis”. The ones we rely on are:
- Contract — to do what you have asked, or to take steps before entering into a contract with you;
- Legal obligation — where the law requires it (for example tax records, anti-money-laundering and sanctions rules);
- Legitimate interests — where it is necessary for our reasonable business interests, and those interests are not overridden by your rights and interests. You can object at any time (see “Your rights”);
- Consent — where you have agreed. You can withdraw it at any time.

What we do	Information used	Lawful basis
Respond to your enquiry (buying, selling, part-exchange, valuation, repair, insurance quote or a general question), including by phone, email, WhatsApp or live chat	Identity, contact, watch details, photos, communications	Steps before a contract; legitimate interests (answering people who contact us)
Sell you a watch: process your order and payment, arrange delivery, handle returns, finance applications and after-sales service	Identity, contact, transaction, financial, communications	Contract; legal obligation (accounting and tax records)
Buy, part-exchange or consign your watch: agree terms, prepare and sign contracts, check ownership and authenticity, and pay you	Identity, contact, watch and transaction data, bank details, signature, compliance checks	Contract; legal obligation (accounting records, anti-money-laundering and sanctions rules); legitimate interests (preventing fraud and the sale of stolen or counterfeit watches)
Repair, service or value your watch, and keep you updated	Identity, contact, watch details, photos, repair and valuation records, communications	Contract
Provide and secure your website account	Account, contact, technical	Contract; legitimate interests (security)
Keep a record of our dealings with you, so any member of our team can help you (our customer database, notes and history)	All of the above	Legitimate interests (providing consistent, informed customer service)
Record and transcribe phone calls, and summarise them	Call recordings, transcripts, contact and communications data	Legitimate interests (accurate records of what was agreed, quality, training, resolving disputes and following up properly)
Use AI tools to draft replies for our team to review, and keep notes of your preferences (see “How we use AI”)	Communications, transaction and preference data	Legitimate interests (personal, relevant service). You can object at any time.
Send you marketing about watches and events by email, SMS or WhatsApp	Identity, contact, preference and marketing data	Consent; or, if you are an existing customer, legitimate interests under the “soft opt-in” (see “Marketing”)
Measure and personalise our advertising, including sharing hashed contact details with advertising platforms	Technical and usage data, hashed email address and phone number, transaction values	Consent (cookies and similar technologies); consent or legitimate interests for sharing hashed contact details, as described under “Marketing”
Understand how our website is used, and improve it	Technical and usage data	Consent (analytics cookies); legitimate interests for strictly necessary security and performance data
Invite you to review us after a purchase, sale or repair	Name, email, order or job reference	Legitimate interests (feedback). You can opt out at any time.
Pass your details to Zing Cover for an insurance quote, if you ask for one	Email address, watch details	Your request (contract); Zing Cover then uses your data as a separate controller
Carry out anti-money-laundering, identity and sanctions checks, and prevent fraud	Identity, contact, verification and compliance data, transaction data	Legal obligation; legitimate interests (preventing fraud and financial crime)
Keep accounting, tax and legal records; deal with legal claims; respond to authorities	Identity, contact, transaction, financial	Legal obligation; legitimate interests (establishing and defending legal claims)
Run and protect our systems and business, including if we sell or restructure the business	Any of the above, as needed	Legitimate interests

We will only use your information for a new purpose if it is compatible with the reason we collected it, or if we have told you about it and have a lawful basis.

Phone calls, live chat and messaging

Call recording. We record calls to and from our business phone numbers. We do this to keep an accurate record of what was discussed and agreed, for quality and training, to resolve disputes, and to follow up properly. We tell you that calls are recorded. If you would rather not be recorded, tell us and we will offer another way to deal with your query.
Transcription and summaries. Call recordings are turned into text by our speech-to-text providers. AI tools then help us summarise the call, note important details (for example the watch you are interested in), update your record and prepare a follow-up email. A member of our team reviews any email before it is sent. See “How we use AI”.
Card details. Please do not read out your card details on a recorded call. If we need to take a card payment by phone, we will make sure the card details are not recorded.
Call tracking. Our website shows phone numbers provided by our call-tracking provider (Mediahawk), so we can see which web page or advert led to your call. This depends on your cookie choices.
Call answering. When we can’t answer, a call-answering service (AllDayPA) may take a message and pass it to us.
Live chat. Live chat on our website may first be answered by an automated AI assistant, and you can ask to speak to a member of our team. If you leave an email address so we can get back to you, we use it only to reply to that conversation. Chat conversations and attachments are stored by our chat provider and in our customer records.
WhatsApp and SMS. We only use WhatsApp or SMS if you contact us that way or agree to it. WhatsApp is provided by Meta, and our messages are sent through Twilio. You can ask us to stop at any time, including by replying STOP.

How we use AI and automated processing

We use AI tools to help our team work efficiently and give you a better service. In particular, they:
- transcribe and summarise phone calls;
- suggest and draft replies to your emails, messages and enquiries — a member of our team reviews them before anything is sent to you;
- keep a structured note of your preferences, built from our dealings with you and updated regularly. This includes the watches and brands you like, your wishlist, budget range, key dates you have mentioned and how you like to be contacted;
- help us decide who to follow up with, and when.
Keeping notes of your preferences in this way is “profiling”. We do it so we can offer you a personal and relevant service, and we rely on our legitimate interests to do so.
Our safeguards:
- we do not make any decision that has a legal or similarly significant effect on you based solely on automated processing — a person is always involved;
- our team can see, correct and delete these notes, and you can ask us to;
- we do not include sensitive (“special category”) information in them;
- our AI providers act only on our instructions and are not allowed to use your data to train their own models.
Your right to object. You can object to profiling at any time. If you object to profiling for marketing, we will stop. For other profiling, we will stop unless we have compelling reasons to continue.
Our main AI and transcription providers are OpenAI (USA), Deepgram (USA) and pyannoteAI (France). We may also use Google’s AI services to help draft replies to public reviews.

Marketing

We send marketing by email, SMS or WhatsApp only if:
- you have given us your consent (for example by ticking a box on one of our forms); or
- you are an existing customer — you have bought from us, sold to us or negotiated to do so — the marketing is about similar watches and services, and you were given a chance to opt out when we collected your details and in every message since (the “soft opt-in”).
You can opt out at any time: use the unsubscribe link in any email, reply STOP to an SMS or WhatsApp message, or contact us. We keep a minimal record of your opt-out so that we don’t contact you again by mistake.
Our emails use standard technology that tells us whether an email was opened and which links were clicked. This helps us understand what our customers find useful. You can stop this by turning off images in your email program.
Personalised advertising. If you accept advertising cookies, advertising partners such as Google, Meta (Facebook and Instagram), Microsoft and LinkedIn may use cookies and similar technologies. They use them to measure how well our adverts work and to show you relevant adverts.
We may also share a “hashed” version of your email address and phone number with Google and Meta, together with the value of a purchase or sale. Hashing is a one-way scramble. The platform can only match the hashed details to an account it already holds; it cannot read them otherwise. We do this to measure our adverts, and to show you — or avoid showing you — our adverts. We only do this where you have agreed to marketing or advertising cookies, and we stop if you object.
You can also control adverts in your Google, Meta and other account settings.
Reviews. After a purchase, sale or repair, we may ask you to review us on Trustpilot, Feefo or Google. You can ask us not to.
Insurance. If you ask for an insurance quote when you buy a watch, we send your email address and the watch details to Zing Cover (a trading name of Covertech Limited). Zing Cover will contact you about the quote. It uses your data as a separate controller under its own privacy policy.
We never sell your personal data.

Cookies and similar technologies

We use cookies and similar technologies, such as pixels and local storage. We set cookies that are strictly necessary for the website to work (for example your basket, sign-in and security) without asking. We only use analytics, advertising, call-tracking, social and other non-essential cookies if you agree. You can accept or reject them, and change your mind at any time using the “Cookie Settings” link.
The types of non-essential technology we use are: analytics (for example Google Analytics, and Microsoft Clarity, which records how visitors use our pages), advertising (Google Ads, Meta, Microsoft Advertising, LinkedIn), call tracking (Mediahawk), and features such as live chat, reviews, social media feeds and embedded videos.
Full details, including each cookie’s name, provider, purpose and lifetime, are in our Cookie Policy.

Who we share your information with

We share personal data with service providers who help us run our business. They act on our instructions under contracts that require them to keep it secure and use it only for the services they provide to us. The main ones are:

Service	Providers	Where
Hosting, IT, email and documents	Microsoft (Azure, Microsoft 365), Cloudflare	UK / EU; Cloudflare global
Phone system and call recording	ClarifyGo; Mediahawk (call tracking); AllDayPA (call answering)	UK
Transcription and AI	OpenAI; Deepgram; pyannoteAI; Google	USA; USA; France; USA
Email, SMS and WhatsApp	Brevo; Twilio; Meta (WhatsApp)	France; USA; USA / Ireland
Live chat	Tidio (USA / Poland) and/or Reppy.ai (UK)	USA / Poland / UK
Accounting and contracts	Xero; SignNow	New Zealand / USA; USA
Delivery	Royal Mail; UPS (via ParcelPro)	UK; USA
Reviews	Trustpilot; Feefo; Google	Denmark; UK; USA
Analytics and advertising	Google; Meta; Microsoft; LinkedIn; Ahrefs	USA / Ireland; Ahrefs Singapore

Some organisations receive your data as independent controllers, using it under their own privacy policies: payment and finance providers (Stripe, TrueLayer and Affirm), Zing Cover when you ask for an insurance quote, and advertising platforms where they act for their own purposes.
We may also share information with professional advisers (for example lawyers, accountants and insurers); with HM Revenue & Customs, the police, the Office of Financial Sanctions Implementation, the National Crime Agency, courts and other authorities where the law requires or allows it; and with a buyer or successor if we sell or restructure our business.
We do not share your data with anyone else unless you ask us to or agree to it.

International transfers

Some of our providers process personal data outside the UK, mainly in the United States. Where they do, we make sure the transfer is protected in one of these ways: the country has been approved by the UK Government as providing adequate protection (for example the EEA; or, for US organisations certified under it, the UK Extension to the EU–US Data Privacy Framework); or we use the ICO-approved International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, backed by a transfer risk assessment.
You can ask us for more information about these safeguards.

How long we keep your information

We keep personal data only for as long as we need it for the purposes above, including meeting legal, accounting and reporting requirements. After that, we delete it or anonymise it.

Information	How long we keep it
Records of sales, purchases, consignments, invoices and payments	6 years after the end of the financial year of the transaction
Identity and anti-money-laundering records, and sanctions check results	5 years after our business relationship ends, or after the transaction
Repair and valuation records	6 years after the job is completed
Enquiries that don’t lead to a transaction	2 years after our last contact
Your customer record, notes and preference profile	3 years after our last contact or transaction (longer where the records above require it)
Call recordings	12 months
Call transcripts and summaries, emails, messages and chat conversations	3 years after our last contact (6 years where part of a transaction record)
Website account	Until you close it, or 3 years after your last sign-in
Abandoned basket details	90 days
Website tracking and advertising identifiers	Up to 26 months
Marketing opt-outs	Kept, in minimal form, so we can respect your choice

How we keep your information secure

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. We limit access to people who need it, and they are bound by confidentiality. We require our service providers to protect it too.
If a personal data breach is likely to put you at risk, we will tell you and the ICO where the law requires it.

Your rights

Under UK data protection law you have the right to:
- access your personal data and receive a copy of it;
- correct information that is wrong or incomplete;
- delete your information, where there is no good reason for us to keep it;
- restrict how we use your information, for example while we check it is accurate;
- object to our use of your information based on legitimate interests, including profiling. You have an absolute right to object to direct marketing and to profiling for direct marketing;
- data portability — receive information you gave us, in a commonly used electronic format, or have it sent to someone else;
- withdraw consent at any time, where we rely on consent;
- not be subject to decisions with legal or similarly significant effects based solely on automated processing. We don’t make such decisions.
To use any of these rights, contact our data protection manager using the details at the top of this policy. It is free. We will reply within one month. If your request is complex, or you have made several, we may take up to two further months, and we will tell you why. We may need to confirm your identity first.
Some rights have exceptions. For example, we must keep transaction records for HMRC even if you ask us to delete them. In that case we will tell you what we have to keep and why.

Complaints

If you are unhappy with how we have handled your personal data, please contact our data protection manager first. We will acknowledge your complaint within 30 days and respond as quickly as we can.
You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.

Children

Our website and services are not aimed at anyone under 18, and we do not knowingly collect children’s personal data. If you are buying for a child, please give us only the details we need, such as a name for an engraving or a delivery address.

CCTV at our showroom

We use CCTV at our showroom to keep our customers, staff and stock safe and to prevent and detect crime. Signs tell you where it is in use. Recordings are kept for 60 days unless needed to investigate an incident, and may be shared with the police or our insurers. Our lawful basis is our legitimate interests in security and crime prevention.

Changes to this policy

We review this policy regularly and will update it when the way we use personal data changes. The date at the top shows when it was last updated. If we make significant changes, we will tell you before they take effect where appropriate.