Version 2takes effect on 19 November 2026
Privacy policy
How Bayloop handles personal data: for workshops that use it, for the people on their team, and for visitors to this site.
1. Introduction and Scope
1.1 This Privacy Policy explains how IF PROJEKTI SIA, registration number 50103560201, registered address Riga, Latvia, Liepajas street 2-k1 ("Bayloop", "we"), processes personal data in connection with the Bayloop platform for car service, detailing, wrapping and tuning workshops and with the website bayloop.app.
1.2 This Privacy Policy is addressed to all persons whose personal data is processed in connection with Bayloop, in particular: (a) the businesses that use Bayloop ("Workshops") and their owners, managers and other representatives; (b) the employees and other persons who work with Bayloop on behalf of a Workshop ("Staff Members"); (c) the customers of Workshops and other persons with whom Workshops deal, such as vehicle owners, drivers, contact persons of business customers, insurers and partners ("Workshop Customers"); and (d) visitors to bayloop.app and persons who contact Bayloop, register for or enquire about Bayloop ("Visitors").
1.3 Section 8 contains a summary for each of these groups. The terms used in this Privacy Policy that are defined in Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR"), such as "personal data", "processing", "controller" and "processor", have the meaning given to them in the GDPR.
2. Bayloop's Two Roles
2.1 Bayloop as controller. Bayloop determines the purposes and means of processing, and is therefore the controller, only for the purposes listed in section 5. These concern Bayloop's own relationship with Workshops, the security of the platform, Bayloop's website and Bayloop's own legal obligations.
2.2 Bayloop as processor. All other personal data that a Workshop, its Staff Members or the Workshop's customers enter into, store in or send through Bayloop is processed by Bayloop on behalf of and on the instructions of that Workshop. For this data the Workshop is the controller and Bayloop is its processor, in accordance with the Data Processing Agreement between them. This includes the personal data of the Workshop's own Staff Members as recorded in the Workshop's account, such as their tasks, working hours, roles and work records.
2.3 When the role changes. The role depends on the purpose, not on the person. For example: (a) the order history of a Workshop Customer is processed by Bayloop as processor for the Workshop, but if the same person writes to Bayloop directly to exercise his or her rights or to report illegal content, Bayloop is the controller of that correspondence; (b) the working hours of a Staff Member are processed by Bayloop as processor for the Workshop, but the records of his or her sign-ins kept to secure the platform are processed by Bayloop as controller; and (c) the contact details of the person who registers a Workshop are processed by Bayloop as controller for the purposes of the Agreement, and by Bayloop as processor when they appear in the Workshop's own records.
2.4 Other controllers. Some third parties process personal data as controllers in their own right, and not on behalf of Bayloop. These include the providers of messaging channels that a Workshop connects (such as WhatsApp, Instagram and Messenger, provided by Meta) and Payment Service Providers. Their own privacy policies apply to their processing. The processing of data received from Meta platforms is described in section 7.
3. Contact Details
3.1 Questions about this Privacy Policy and requests concerning personal data for which Bayloop is the controller may be sent to [email protected] or by post to Liepajas street 2-k1, Riga, Latvia.
3.2 Requests concerning personal data for which a Workshop is the controller should be addressed to that Workshop. If such a request is sent to Bayloop, Bayloop forwards it to the Workshop without undue delay and informs the person who made it.
3.3 Bayloop has not appointed a data protection officer, as it is not required to do so under Article 37 of the GDPR.
4. Sources of Personal Data
4.1 Bayloop obtains personal data: (a) directly from the persons concerned, for example when they register, sign in, contact Bayloop or use bayloop.app; (b) from Workshops and their Staff Members, who enter data into Bayloop; (c) from the Services themselves, for example records of sign-ins, devices and actions; and (d) for the purpose in clause 5.6, from publicly available business sources, such as company registers and the websites of workshops.
4.2 The provision of the personal data requested at registration and for invoicing is necessary to conclude and perform the Agreement, and the records required for invoicing are required by law. Without them, Bayloop cannot provide the Services. The provision of personal data when contacting Bayloop or using bayloop.app is voluntary, but Bayloop may be unable to respond to an enquiry without the contact details needed to do so. Whether a Workshop Customer must provide personal data to a Workshop is determined by that Workshop.
5. Purposes for Which Bayloop Is the Controller
5.1 Purpose 1: concluding and performing the Agreement with the Workshop, including registration, the trial, the account, support to the Workshop as a customer of Bayloop, and the management of the Subscription.
- Persons concerned: the owners, administrators and other representatives of Workshops.
- Personal data: name, email address, telephone number, position, the Workshop's details, the language chosen, and communications with Bayloop.
- Legal basis: performance of the contract with the Workshop (Article 6(1)(b) GDPR) and, for its representatives, Bayloop's legitimate interest in concluding and performing that contract (Article 6(1)(f) GDPR).
- Retention: for the duration of the Agreement and 3 years after its termination, corresponding to the limitation period for claims arising from commercial transactions under the laws of the Republic of Latvia.
5.2 Purpose 2: invoicing, accounting and taxation of the Fees and of Credit.
- Persons concerned: the representatives of Workshops named on invoices and payments.
- Personal data: name, billing details, invoices, payment records and the last digits of payment cards (complete card details are processed only by the Payment Service Provider).
- Legal basis: compliance with Bayloop's legal obligations under accounting and tax law (Article 6(1)(c) GDPR).
- Retention: for the period required by the accounting and tax laws of the Republic of Latvia, currently 5 years after the end of the reporting year.
5.3 Purpose 3: the security of the Services and the prevention of fraud and abuse, including authentication, the protection of accounts, the detection of unauthorised access and the investigation of security incidents.
- Persons concerned: Staff Members and all other persons who sign in to Bayloop, and persons who use its public pages and forms.
- Personal data: sign-in identifiers, records of sign-ins and sessions, device identifiers, IP addresses, browser information and security events.
- Legal basis: Bayloop's legitimate interest, and that of Workshops, in keeping the Services and the data in them secure (Article 6(1)(f) GDPR), and Bayloop's obligation to ensure the security of processing (Article 32 GDPR).
- Retention: 12 months, or longer where needed to investigate a specific incident.
5.4 Purpose 4: service communications and legal notices, such as notices of changes to the Services, to the Terms or to this Privacy Policy, and the records showing that such notices were given and seen.
- Persons concerned: the administrators and other Staff Members of Workshops.
- Personal data: name, email address, the notices sent, and when they were sent, seen and acknowledged.
- Legal basis: performance of the contract with the Workshop (Article 6(1)(b) GDPR), Bayloop's legal obligations to inform (Article 6(1)(c) GDPR), and Bayloop's legitimate interest in being able to prove that notices were given (Article 6(1)(f) GDPR).
- Retention: for the duration of the Agreement and 3 years after its termination.
5.5 Purpose 5: the operation of bayloop.app, including showing the pages in the chosen language and appearance and protecting the forms against automated misuse.
- Persons concerned: Visitors.
- Personal data: IP address, browser information, the choices stored in the browser, and the result of the automated check against robots (Cloudflare Turnstile).
- Legal basis: Bayloop's legitimate interest in providing a secure and working website (Article 6(1)(f) GDPR). Only cookies and similar technologies strictly necessary for this purpose are used (section 16).
- Retention: for the duration of the visit or as set out in section 16.
5.6 Purpose 6: enquiries, demonstrations and business communications, including answering enquiries, arranging demonstrations, and contacting workshops that may be interested in Bayloop.
- Persons concerned: Visitors who contact Bayloop or ask for a demonstration, and the contact persons of workshops identified from publicly available business sources.
- Personal data: name, business contact details, the workshop and its website, and the content of communications.
- Legal basis: Bayloop's legitimate interest in answering enquiries and in offering its services to businesses (Article 6(1)(f) GDPR). Every business communication states how to object, and a person who objects is not contacted again.
- Retention: 24 months after the last contact, or until an objection is received, after which only the information needed to respect the objection is kept.
5.7 Purpose 7: handling requests from data subjects and notices of illegal content, including requests to delete data received through Meta platforms.
- Persons concerned: any person who makes such a request or notice.
- Personal data: name, contact details, the content of the request or notice and the actions taken.
- Legal basis: compliance with Bayloop's legal obligations under the GDPR and Regulation (EU) 2022/2065 (Article 6(1)(c) GDPR).
- Retention: 3 years after the request or notice has been dealt with.
5.8 Purpose 8: establishing, exercising and defending legal claims, including the records of the version of the Terms accepted by each Workshop.
- Persons concerned: the representatives of Workshops and any other person involved in a claim.
- Personal data: the data relevant to the claim, including records of acceptance (name, email address, IP address, time and the digest of the accepted text).
- Legal basis: Bayloop's legitimate interest in establishing, exercising and defending legal claims (Article 6(1)(f) GDPR).
- Retention: until the end of the applicable limitation period and, where a claim has been brought, until it has been finally resolved.
5.9 Purpose 9: statistics and the improvement of the Services. Bayloop compiles statistics on the use of the Services, such as the use of features, performance and errors, and uses them to operate, improve and develop the Services.
- Persons concerned: all users of the Services.
- Personal data: records of use of the Services. Personal data is used only to produce the statistics, which are anonymised or aggregated so that they do not identify any Workshop, Staff Member, Workshop Customer or other person.
- Legal basis: Bayloop's legitimate interest in improving its Services (Article 6(1)(f) GDPR). Where the statistics are derived from personal data processed on behalf of Workshops, this processing is compatible with the original purpose within the meaning of Article 6(4) GDPR and is authorised by the Workshop in the Data Processing Agreement.
- Retention: the personal data is deleted or anonymised once the statistics have been compiled. Anonymised statistics are not personal data and may be kept without limitation.
5.10 Purpose 10: maintenance, troubleshooting and testing of the Services, including the investigation and correction of faults and the testing of backups.
- Persons concerned: all persons whose personal data is processed in the Services.
- Personal data: the data relevant to the fault or test concerned.
- Legal basis: for personal data for which Bayloop is the controller, Bayloop's legitimate interest in keeping the Services working and secure (Article 6(1)(f) GDPR). For personal data processed on behalf of Workshops, Bayloop acts as processor, as authorised by the Workshop in the Data Processing Agreement.
- Safeguards: faults are investigated in the production environment where possible. Personal data is copied to a test environment only where strictly necessary to investigate a specific fault, pseudonymised where possible, protected by the same security measures as the production environment, and deleted as soon as the fault has been resolved. Backups are restored for testing only within Bayloop's secured infrastructure.
- Retention: only for as long as needed to resolve the fault or complete the test.
6. Processing on Behalf of Workshops
6.1 For all personal data that a Workshop keeps in or sends through Bayloop, other than for the purposes in section 5, the Workshop is the controller and Bayloop is its processor. The Workshop determines the purposes of the processing and is responsible for its lawfulness, including the legal basis and the information it gives to the persons concerned.
6.2 Workshops typically use Bayloop for the following purposes, as each Workshop determines for itself: (a) managing customers, vehicles, enquiries, bookings, quotes, orders and insurance claims; (b) invoicing and accounting for their own services; (c) communicating with their customers, partners and suppliers by email, SMS, WhatsApp, Instagram, Messenger and the customer pages; (d) operating the booking form, gallery and chat on their own websites; (e) photographing vehicles before, during and after work, and, with their customers' consent, using such photographs in marketing and advertising; (f) planning work, recording working hours and managing their Staff Members and their roles; and (g) using the AI Functionality for these purposes.
6.3 As processor, Bayloop processes such personal data only on the documented instructions of the Workshop and in accordance with the Data Processing Agreement. Bayloop does not use such data for its own purposes, except for the anonymised statistics in clause 5.9 and the maintenance and troubleshooting in clause 5.10, both as authorised by the Workshop. Bayloop staff access a Workshop's data only through support access that is visible to the Workshop and recorded.
6.4 The AI Service Providers used by Bayloop process Inputs and Outputs only to provide the AI Functionality and may not use them to train or improve their models.
7. Data Received from Meta Platforms
7.1 Where a Workshop connects its Facebook Page or Instagram professional account to Bayloop, Bayloop receives from Meta Platforms Ireland Limited ("Meta"), on the Workshop's behalf: (a) the messages sent to and from that Page or account through Messenger and Instagram, with their attachments; (b) the name, username and platform-specific identifier of each person who writes to the Workshop; and (c) the access tokens of the Page and the identifier and username of the Instagram account, which allow Bayloop to receive and send messages for the Workshop (together, "Meta Platform Data").
7.2 Bayloop uses Meta Platform Data solely to enable the Workshop to receive, read and answer the messages addressed to it in Bayloop and to keep them together with the related customer and order, including, where the Workshop permits it, the preparation of draft replies by the AI Functionality.
7.3 The Workshop is the controller of Meta Platform Data and Bayloop processes it as the Workshop's processor. Meta is the controller of the personal data processed on its platforms, in accordance with its own privacy policy.
7.4 Bayloop does not sell, license or otherwise make Meta Platform Data available to third parties, does not use it to build profiles of persons for advertising, does not use it to make decisions about the eligibility of any person for credit, employment, housing, insurance, education or similar purposes, and does not use it for surveillance. Bayloop discloses Meta Platform Data only to the subprocessors needed to provide the Services, including the AI Service Providers where the Workshop uses the AI Functionality, each bound by confidentiality and by obligations no less protective than this Privacy Policy, and where required by law.
7.5 When a Workshop disconnects its Page or Instagram account, or removes Bayloop in its Meta settings, Bayloop deletes the access tokens without undue delay and stops receiving messages. Messages already received form part of the Workshop's correspondence with its customers and remain in its records until the Workshop deletes them, and in any event are deleted in accordance with clause 11.2 after the termination of the Workshop's Agreement.
7.6 A person who has written to a Workshop through Messenger or Instagram may request the deletion of his or her messages from that Workshop, or by writing to Bayloop at [email protected], stating the name or account used and the Workshop concerned, in which case Bayloop forwards the request to the Workshop and follows it up. A person who has used Facebook Login to connect a Page to Bayloop may also remove Bayloop in the Facebook or Instagram settings (Apps and Websites), upon which Meta informs Bayloop and Bayloop issues a confirmation code with which the status of the request can be checked. The instructions are set out on the Data deletion page.
8. Summary for Each Group of Persons
8.1 Workshops and their representatives. Bayloop is the controller of your personal data for the Agreement, invoicing, security, notices and legal claims (purposes 1 to 4 and 8). For all data that your Workshop keeps in Bayloop, your Workshop is the controller and Bayloop processes it on your instructions under the Data Processing Agreement.
8.2 Staff Members. Your employer or principal, the Workshop, is the controller of your personal data as recorded in its Bayloop account, such as your tasks, working hours, roles, messages and work records, and Bayloop processes it on the Workshop's behalf. Bayloop is the controller only of the records of your sign-ins and the security of your account (purpose 3) and of the service and legal notices it sends you (purpose 4). Questions about your work records should be addressed to the Workshop.
8.3 Workshop Customers and others dealing with a Workshop. The Workshop with which you deal is the controller of your personal data, including your contact details, vehicle, orders, invoices, photographs and messages, and Bayloop processes it on the Workshop's behalf. Please address requests about your data to that Workshop. Bayloop becomes the controller only if you contact Bayloop directly (purpose 7). When the Workshop's assistant answers you, for example in the chat on the Workshop's website, you are informed that you are communicating with an AI system.
8.4 Visitors and prospective customers. Bayloop is the controller of your personal data when you use bayloop.app, contact Bayloop or ask for a demonstration, and when Bayloop contacts your workshop as a prospective customer (purposes 5 and 6). You may object to business communications at any time.
9. Recipients
9.1 Bayloop discloses personal data only to the extent necessary for the purposes described, to the following categories of recipients: (a) the subprocessors that provide hosting, communications, AI and other services to Bayloop, listed on the Subprocessors page; (b) Payment Service Providers; (c) professional advisers, auditors and insurers, under a duty of confidentiality; (d) public authorities, courts and law enforcement bodies, where required by law; and (e) a successor in the event of a merger, acquisition or transfer of Bayloop's business, subject to this Privacy Policy.
9.2 Personal data processed on behalf of a Workshop is disclosed to the persons that the Workshop determines, such as the recipients of the messages it sends, and to Bayloop's subprocessors.
10. Transfers Outside the European Economic Area
10.1 Bayloop stores personal data in the European Union. Where a recipient processes personal data outside the European Economic Area, the transfer is based on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework, or on the standard contractual clauses adopted by the European Commission, together with any supplementary measures required. A copy of the relevant safeguards may be requested at [email protected].
11. Retention
11.1 Bayloop keeps personal data for which it is the controller only for the periods stated for each purpose in section 5, and thereafter deletes or anonymises it.
11.2 Personal data processed on behalf of a Workshop is kept as determined by the Workshop and, after the termination of the Workshop's Agreement, deleted in accordance with clause 22.5 of the Terms of Service: within 180 days, and from backups within a further 14 days.
12. Your Rights
12.1 Subject to the conditions of the GDPR, you have the right to: (a) obtain confirmation of whether your personal data is processed and access to it; (b) have inaccurate data rectified; (c) have your data erased; (d) restrict the processing; (e) receive your data in a portable format and have it transmitted to another controller; (f) object to processing based on legitimate interests, including at any time to business communications; and (g) withdraw any consent given, without affecting the lawfulness of processing before its withdrawal.
12.2 To exercise your rights with respect to personal data for which Bayloop is the controller, contact Bayloop as set out in section 3. Bayloop may ask you to confirm your identity and responds within one month, which may be extended by two further months where necessary, in which case you are informed of the reasons.
12.3 Where a Workshop is the controller, please address your request to the Workshop. Bayloop assists the Workshop in responding to it, as provided in the Data Processing Agreement.
12.4 Right to object. Where Bayloop processes your personal data on the basis of its legitimate interests (purposes 1, 3, 4, 5, 6, 8, 9 and 10), you have the right to object at any time, on grounds relating to your particular situation. Bayloop then no longer processes the data for that purpose unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed for legal claims. You may object to business communications (purpose 6) at any time and without giving reasons, after which Bayloop no longer contacts you for that purpose.
13. Complaints
13.1 If you believe that your personal data is processed unlawfully, you may lodge a complaint with the Data State Inspectorate of the Republic of Latvia (Datu valsts inspekcija, Elijas iela 17, Riga, LV-1050, www.dvi.gov.lv) or with the supervisory authority of the EU Member State of your habitual residence or place of work. We encourage you to contact Bayloop first so that we can try to resolve your concern.
14. Automated Decision-Making and Artificial Intelligence
14.1 Bayloop does not take decisions based solely on automated processing that produce legal effects concerning a person or similarly significantly affect a person within the meaning of Article 22 GDPR.
14.2 The AI Functionality of Bayloop prepares answers, drafts and suggestions for Workshops and acts within the permissions set by each Workshop. Actions that may significantly affect a person, such as granting discounts, handling complaints and making payments, always require confirmation by a person. When the AI Functionality communicates with a person directly, that person is informed that he or she is communicating with an AI system.
15. Security
15.1 Bayloop implements appropriate technical and organisational measures to protect personal data, including the separation of each Workshop's data at database level, encryption in transit, secured sign-in, daily backups stored in the European Union, records of access and support access that is visible to the Workshop. The measures are described in Annex 2 to the Data Processing Agreement.
16. Cookies and Similar Technologies
16.1 bayloop.app and the Bayloop applications use only cookies and similar technologies that are strictly necessary to provide the service requested, such as keeping a user signed in, remembering a confirmed device, remembering the language and appearance chosen, and the automated check against robots on forms. Such technologies do not require consent. They are described on the Cookies page.
16.2 Bayloop does not currently use analytics or advertising cookies, tracking pixels or similar technologies.
16.3 Should Bayloop introduce analytics or advertising technologies on bayloop.app, it will use them only with the prior consent of the Visitor, which may be withdrawn at any time, and will update this Privacy Policy and the Cookies page before doing so.
16.4 Where a Workshop uses Bayloop to host its website, booking form, gallery or chat, the Workshop is the controller of the personal data of its website visitors. Should a Workshop enable analytics or advertising technologies for that website, including for advertising campaigns managed through Bayloop, they will be activated only with the visitor's prior consent. The Workshop is then responsible for that processing, together with the provider of the technology where the provider acts as joint controller, and Bayloop acts as the Workshop's processor.
17. Children
17.1 Bayloop is intended for businesses and is not directed at children. Bayloop does not knowingly process the personal data of children for its own purposes.
18. Changes to this Privacy Policy
18.1 Bayloop may amend this Privacy Policy. The version in force, with its date, is available at bayloop.app/privacy, and earlier versions at bayloop.app/legal. Workshops are notified of material changes in the Services and by email before they take effect.