Privacy policy
Last updated: 13 September 2026
This Privacy Policy explains how BAC Trading Limited collects, uses and protects your personal information when you visit, use or make a purchase from the Aerospace Bristol Online Shop at shop.aerospacebristol.org.
This policy applies specifically to the Aerospace Bristol Online Shop. For information about how Aerospace Bristol uses personal information in connection with museum visits, ticketing, memberships, donations, events, volunteering and other activities, please see the main Aerospace Bristol Privacy Policy at:
https://aerospacebristol.org/privacy
1. Who we are
The Aerospace Bristol Online Shop is operated by:
BAC Trading Limited
Company number: 05078738
Aerospace Bristol
Hayes Way
Patchway
Bristol
BS34 5BZ
United Kingdom
Email: retail@aerospacebristol.org
For the personal information processed in connection with the Aerospace Bristol Online Shop, BAC Trading Limited is the data controller, unless we tell you otherwise.
Our online shop is hosted by Shopify, which provides the ecommerce platform we use to operate the store.
2. Personal information we collect
The information we collect depends on how you use the Online Shop.
We may collect:
- your name;
- billing and delivery addresses;
- email address;
- telephone number;
- details of products you order, return or enquire about;
- your order and transaction history;
- account details and preferences if you create a customer account;
- communications you send to us, including customer service enquiries;
- marketing preferences;
- information about how you use the Online Shop;
- your IP address, browser, device and approximate location information;
- cookie identifiers and information collected through similar technologies; and
- limited payment and transaction information.
Payment information is processed through Shopify and/or our payment service providers. Depending on the payment method you choose, the payment provider may collect payment card or other financial information directly from you. We do not need access to your full payment card details in order to fulfil your order.
We do not normally need to collect special category personal data through the Online Shop and ask that you do not provide this unless it is genuinely necessary.
3. How we collect your information
We collect personal information:
Directly from you, for example when you:
- place an order;
- create an account;
- contact us;
- request a refund or return;
- subscribe to marketing communications; or
- otherwise provide information to us.
Automatically, when you use the Online Shop, including through cookies and similar technologies.
From service providers, including Shopify, payment providers, delivery providers and other organisations that help us operate the Online Shop.
4. How and why we use your personal information
Under UK data protection law, we must have a lawful basis for using your personal information.
Processing and fulfilling your order
We use your information to:
- process your order and payment;
- provide order confirmations and updates;
- arrange delivery;
- process refunds, returns and cancellations;
- respond to queries about your purchase; and
- manage your customer account.
Lawful basis: This processing is necessary to enter into or perform our contract with you.
Customer service and communications
We use your information to:
- answer questions and enquiries;
- resolve complaints;
- provide after-sales support; and
- maintain appropriate records of our communications with you.
Lawful basis: Performance of our contract with you and, where appropriate, our legitimate interests in providing effective customer service and managing our relationship with customers.
Security and fraud prevention
We may use information to:
- protect the security of the Online Shop;
- verify transactions;
- identify suspicious or fraudulent activity;
- prevent misuse of our systems; and
- protect our customers, organisation and systems.
Lawful basis: Our legitimate interests in protecting our business, customers and systems, and compliance with legal obligations where applicable.
Improving the Online Shop
We may use information about how customers use the Online Shop to:
- understand how the website is being used;
- identify technical problems;
- improve navigation, content and functionality;
- understand product performance; and
- improve our customers' shopping experience.
Lawful basis: Our legitimate interests in operating and improving our ecommerce service.
Where this activity relies on non-essential cookies or similar tracking technologies, we will obtain your consent where required.
Marketing
Where you have chosen to receive marketing from us, or where we are otherwise permitted by law to contact you, we may send information about Aerospace Bristol products, offers and other relevant news.
For electronic marketing communications, we rely on your consent where consent is required. In some circumstances, the law may allow us to contact existing customers about similar products or services without obtaining separate consent. Where we do this, we rely on our legitimate interests and the applicable electronic marketing rules.
You can unsubscribe at any time by using the unsubscribe link in our marketing emails or by contacting us.
Unsubscribing from marketing will not prevent us from sending essential communications about an order you have placed.
Analytics, advertising and personalisation
Subject to your cookie choices, we and our technology partners may use information about how you interact with the Online Shop to measure performance, understand customer behaviour, personalise your experience and measure or improve advertising.
Lawful basis: Consent where required for the use of non-essential cookies or similar tracking technologies and, where applicable, our legitimate interests in understanding and improving our business.
Legal and regulatory requirements
We may use and retain personal information where necessary to:
- comply with tax and accounting requirements;
- comply with applicable laws and regulations;
- respond to lawful requests from courts, regulators or law enforcement agencies;
- establish, exercise or defend legal claims; and
- enforce our terms and policies.
Lawful basis: Compliance with our legal obligations and, where appropriate, our legitimate interests in protecting our legal rights.
5. Shopify and your information
Our Online Shop is hosted by Shopify.
Shopify processes personal information to provide the ecommerce platform and services that enable us to operate the Online Shop.
Information about your use of the Online Shop may therefore be transmitted to and processed by Shopify and its service providers.
We currently use Shopify services that may use information about your interactions with our Online Shop, Shopify and other Shopify merchants to provide enhanced ecommerce services. These may include helping to:
- personalise your shopping experience;
- improve the performance of the Online Shop;
- understand how customers interact with stores and advertising; and
- provide more relevant advertising.
For some of these activities, Shopify may act as a data controller in its own right and is responsible for explaining how it uses your information and for responding to certain privacy rights.
You can find out more in the Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/consumers
You can also manage certain privacy choices relating directly to Shopify through the Shopify Privacy Portal:
Where applicable, choices you make through our cookie consent tools may also be communicated to Shopify.
6. Cookies and similar technologies
The Online Shop uses cookies and similar technologies.
Some cookies are necessary for the website to work correctly. These may be used for functions such as:
- remembering items in your basket;
- enabling checkout;
- maintaining security;
- remembering privacy choices; and
- providing essential website functionality.
We may also use optional cookies for purposes such as:
- analytics;
- measuring website performance;
- understanding how customers use the Online Shop;
- advertising; and
- personalisation.
Where required by law, optional cookies will only be used after you have given your consent.
You can accept, reject or manage optional cookies through the cookie consent controls available on the Online Shop. You can change your preferences at any time.
You can also control cookies through your browser settings, although disabling essential cookies may affect how the Online Shop works.
7. Who we share personal information with
We only share personal information where there is an appropriate reason to do so.
We may share information with:
- Shopify, which hosts and supports our Online Shop;
- payment service providers that securely process payments;
- delivery companies and couriers that fulfil and deliver orders;
- IT, website hosting, security and cloud service providers;
- analytics, advertising and marketing providers where appropriate and subject to your privacy choices;
- professional advisers such as accountants, auditors, insurers and legal advisers;
- Bristol Aero Collection Trust and other parts of Aerospace Bristol where this is necessary for administration, customer service, finance, governance or legal purposes;
- law enforcement agencies, regulators, courts or other public bodies where we are legally required or permitted to do so; and
- another organisation in connection with a restructuring, sale or transfer of all or part of our organisation or assets.
We require organisations processing information on our behalf to handle personal information appropriately and securely.
We do not sell your personal information for money.
Some privacy laws outside the UK use terms such as "sale", "sharing" or "targeted advertising" more broadly. Where those laws apply, additional privacy controls may be available through Shopify or through our Online Shop.
8. International transfers
Some of our service providers, including Shopify and organisations supporting its services, may process personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we take steps to ensure that an appropriate level of protection is in place.
Depending on the destination and service provider, these measures may include:
- transferring information to a country recognised by the UK as providing an adequate level of data protection;
- using approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses; or
- relying on another lawful transfer mechanism permitted under UK data protection law.
You can contact us if you would like further information about the safeguards used for international transfers.
9. How long we keep your information
We keep personal information only for as long as it is reasonably necessary for the purposes for which it was collected.
The length of time we retain information depends on factors including:
- how long we have an ongoing relationship with you;
- whether you have an active customer account;
- the type of transaction or communication involved;
- legal, tax and accounting record-keeping requirements;
- whether information is required to establish, exercise or defend legal claims;
- fraud prevention and security requirements; and
- whether you have asked us to delete your information.
Order and transaction information may need to be retained for several years after your purchase in order to comply with accounting, tax and legal requirements.
Where information is no longer required, we will securely delete it or anonymise it.
10. Your data protection rights
Depending on the circumstances, UK data protection law gives you a number of rights.
These may include the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to delete your personal information;
- ask us to restrict how we use your information;
- receive certain information in a portable format and ask us to transfer it to another organisation;
- withdraw consent where we rely on your consent; and
- object to certain uses of your personal information.
These rights are not absolute and may not apply in every circumstance.
We may need to verify your identity before responding to a request.
To exercise your rights in relation to information controlled by BAC Trading Limited, contact:
YOUR RIGHT TO OBJECT
You have the right to object at any time to our use of your personal information for direct marketing.
You may also have the right to object where we rely on legitimate interests as our lawful basis. If you object, we will consider your request and stop the processing unless we have compelling legitimate grounds to continue or the processing is required for legal claims.
You can stop receiving marketing emails at any time by using the unsubscribe link contained within them.
Where Shopify acts as a separate data controller, you may need to exercise your rights directly with Shopify using:
11. Providing information to us
Certain information is required in order for us to enter into and perform a contract with you.
For example, we need sufficient contact, delivery and payment information to process and fulfil an order.
If you do not provide information that is necessary to complete your order, we may be unable to process or deliver it.
12. Automated processing and personalisation
We and our service providers may use automated technology to help identify potentially fraudulent transactions, recommend products, personalise elements of the shopping experience or support advertising and analytics.
We do not currently use solely automated decision-making that produces legal effects or similarly significant effects on customers.
If this changes, we will update this Privacy Policy and provide any additional information required by law.
13. Children's information
The Online Shop is not designed specifically for children.
We do not knowingly collect more information about children than is necessary to operate the Online Shop.
If you are under 18, you should involve a parent or guardian when making purchases where appropriate.
If you believe a child has provided personal information to us inappropriately, please contact us and we will consider whether the information should be deleted.
14. Security
We take appropriate organisational and technical measures to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or unauthorised access.
However, no internet-based system can be guaranteed to be completely secure.
Please take reasonable precautions when using the Online Shop, including protecting passwords and account details and avoiding sending sensitive information through unsecured methods of communication.
15. Links to other websites
The Online Shop may contain links to websites operated by other organisations.
Those websites have their own privacy practices and policies. We are not responsible for how third-party websites collect or use your information, and we recommend reviewing their privacy information before providing personal data.
16. Complaints
If you have a concern about how we use your personal information, please contact us first so that we can investigate:
BAC Trading Limited
Aerospace Bristol
Hayes Way
Patchway
Bristol
BS34 5BZ
United Kingdom
Email: retail@aerospacebristol.org
You also have the right to make a complaint to the UK's data protection regulator, the Information Commissioner's Office (ICO).
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Website: https://ico.org.uk/
We would appreciate the opportunity to address your concerns before you approach the ICO, although you are not required to contact us first.
17. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements or how we process personal information.
When we make changes, we will publish the updated policy on the Online Shop and amend the "Last updated" date at the top of this page.
Where a change materially affects how we use personal information, we will provide additional notice where required.
18. Contact us
If you have questions about this Privacy Policy, how we use personal information or your data protection rights, please contact:
BAC Trading Limited
Aerospace Bristol
Hayes Way
Patchway
Bristol
BS34 5BZ
United Kingdom
Email: retail@aerospacebristol.org