Who we are
Fender BCS is the business system shared by Fender Steel Ltd and BCS Products Ltd. Each company is responsible for the information it holds about its own staff, customers and suppliers. It isn't a public service: only the companies' staff and contractors with a login can use it.
- Fender Steel Ltd, registered in England and Wales (company number 01539662), registered office 20 Midland Road, Scunthorpe, North Lincolnshire DN16 1DQ.
- BCS Products Ltd, registered in England and Wales (company number 04246694), registered office 20 Midland Road, Scunthorpe, North Lincolnshire DN16 1DQ.
For anything about the information held about you, email tyler@fendersteel.co.uk or write to us at the address above.
What it holds
- Our staff and contractors: name, work email, job title and role; sign-in details (passwords are stored scrambled, so nobody can read them); holidays and timesheets; vehicle and machine checks, including mileage and any photos taken; fuel logged; the production, checks and deliveries you've recorded; training completed; and health and safety records, which can include details of an injury. For drivers, also a phone number, driving licence number and Driver CPC expiry date.
- Customers' and suppliers' contacts: names, phone numbers, email and postal addresses, and the orders, deliveries, invoices, payments and credit that go with the account.
- People who buy through the Fast Rebar website: name, phone number, email, company, the site address for a pallet delivery, what was ordered and confirmation of payment. Card details are taken by Stripe and never reach this system.
- Anyone named in a health and safety record, such as a visitor involved in an incident.
- A record of changes: who did what in the system, and when.
Why, and on what basis
- To employ and pay people: holidays, timesheets and training (to carry out the contract of employment).
- To meet health and safety and road transport law: vehicle and machine checks, incident and injury records, and drivers' licences and CPC (legal obligation). Injury details are health information, held under the conditions the law sets for employment and health and safety.
- To supply customers and pay suppliers (to carry out the contract), and to keep accounts and tax records (legal obligation).
- To run the business: tracing steel back to its certificates as our CARES approval requires, credit control, keeping the system secure, and knowing who did what so mistakes can be put right (our legitimate interests, weighed against yours).
Nothing is sold, nothing is used for marketing, and no decisions about anyone are made by computer alone.
Who it goes to
The companies' staff see what their job needs. Beyond them, the system relies on these services, each used only for its own job:
- Vercel hosts the system and stores uploaded files; Neon runs its database.
- Resend sends its emails, such as password resets and alerts to managers.
- Telegram carries alerts to managers, which can include a customer's name and phone number.
- Anthropic runs the help assistant and reads bending schedules sent in, so it sees what's typed into the assistant and the schedules uploaded. It doesn't use them to train its AI.
- Stripe takes card payments on the Fast Rebar website.
- Google Drive, if an administrator connects it, holds backup copies of uploaded files in a private folder. The system only adds files to that folder; it doesn't read anything else in the Google account. Copies of the database are also kept in Apple iCloud.
Information also goes where the law or the job needs it to: delivery details to drivers and pallet carriers, and records to our accountants, HMRC, the Health and Safety Executive, CARES auditors, insurers or the police when they're entitled to them.
Several of these services keep data outside the UK, including in the United States. Where they do, it's protected the way UK data protection law requires, by the UK–US data bridge or the standard contract clauses approved for international transfers.
How long it's kept
- Staff records: for as long as you work for us and six years after.
- Orders, deliveries and steel traceability records (casts, certificates, production and checks): 15 years, as our CARES approval requires.
- Invoices, accounts and pay records: six years after the end of the financial year they belong to.
- Accident and injury records: at least three years, and longer while an injury claim could still be made.
- Lorry and vehicle checks: at least 15 months, as DVSA requires.
- The record of changes: as long as the record it's about.
Keeping it safe
Everyone has their own login, and sees only what their role needs. Connections are encrypted, passwords are stored scrambled, every change is recorded, and the system is backed up regularly.
Cookies
The system uses only two cookies: one to keep you signed in, and one to remember which company you're working in. There's no tracking or advertising.
Your rights
You can ask for a copy of the information held about you, and to have it corrected, deleted, limited or objected to, or sent to you or someone else in a usable form. Some of these depend on why it's held: records the law says must be kept can't be deleted early, for example. Email tyler@fendersteel.co.uk and you'll have an answer within a month.
If you're unhappy with how your information has been handled, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes
This policy is updated when what the system holds or who it goes to changes; the date at the top shows when.