This notice explains how Four10 Group Ltd ("Four10", "we", "us", "our") collects and uses personal data in connection with our website and our marketing of BayAssist, our AI front-office product for UK independent MOT garages. It covers visitors to bayassist.co.uk; businesses we contact about BayAssist by email or SMS (our cold business-to-business outreach programme); and people who enquire about BayAssist or book a walkthrough or demonstration.

It does not cover the personal data that BayAssist processes on behalf of garages once they are our customers (for example, data about a garage's own callers and customers). That processing is governed by each garage's own privacy notice and by our customer Data Processing Agreement, under which Four10 acts as a processor rather than a controller.

1. Who we are

Four10 Group Ltd is the data controller for the processing described in this notice.

• Company: Four10 Group Ltd
• Company number: 16607858
• Registered office: Swinford House, Albion Street, Brierley Hill, DY5 3EE
• ICO registration number: ZC169445
• Contact for privacy matters: dave@four10.agency

You can contact us using the details above about anything in this notice, including to exercise your rights or to opt out of marketing.

2. What personal data we process and how we obtained it

2.1 Businesses we contact about BayAssist (cold B2B outreach)

If we have contacted you about BayAssist by email or SMS and you did not give us your details directly, we process the following business contact information: business name; the owner's or main contact's first name, where it is published; business email address; business phone or mobile number; town and postcode area; business website address; and incorporation status (whether the business is a limited company, LLP or similar) together with a related internal marketing segmentation tag.

How we obtained it. We collected this information from publicly available sources. These include your garage's own website, public business directories, the DVSA public list of MOT testing stations, and Companies House (used to confirm incorporation status). We then enrich and verify the data, for example checking that an email address is deliverable, before using it. We do not buy marketing lists from data brokers, and we do not engage in list broking ourselves. We contacted you because your business is a UK MOT garage and BayAssist is built specifically for MOT garages.

2.2 Website visitors and enquirers

If you submit an enquiry or booking form on bayassist.co.uk, or book or attend a walkthrough or demonstration, we collect the details you provide. These typically include your name, business name, business email address, phone number and any message you send us, together with a record of our correspondence with you.

2.3 What we do not do

We do not collect special-category data (such as health, ethnicity or political opinions) through our website or our marketing. We do not carry out profiling or automated decision-making that produces legal or similarly significant effects about you. We will never sell your personal data.

3. Lawful basis for processing

3.1 Cold B2B outreach — legitimate interests

Our lawful basis for sending marketing about BayAssist to MOT garages is our legitimate interests under Article 6(1)(f) of the UK GDPR. The legitimate interest is making relevant garage businesses aware of an AI front-office product built specifically for MOT garages, a product directly relevant to your trade. The use of legitimate interests for direct marketing is recognised by Recital 47 of the UK GDPR.

We have carried out a Legitimate Interest Assessment (including a purpose test, a necessity test and a balancing test) to satisfy ourselves that this interest is not overridden by your interests, rights and freedoms. We contact businesses on the business contact details they have published as their commercial point of contact, we keep the data we use to a minimum, and we make it easy to opt out at any time (see section 7).

You have the right to object to this processing at any time. If you object, we will stop processing your data for marketing and add you to our suppression list (see sections 6 and 7).

3.2 PECR (electronic marketing by email and SMS)

The Privacy and Electronic Communications Regulations 2003 (PECR), in particular Regulation 22, apply to our marketing by email and SMS. Under PECR:

• Corporate subscribers (for example, limited companies, PLCs and LLPs) may be sent business-to-business electronic marketing on the basis of our legitimate interests, with a clear opt-out. We contact corporate subscribers on this basis.
• Individual subscribers, which for these purposes include sole traders and (outside Scotland) ordinary partnerships, normally require consent for electronic marketing. We tag each record with its subscriber type so that this distinction is recorded and respected.

3.3 Website enquiries and walkthroughs

Where you contact us or book a walkthrough, our lawful basis is our legitimate interest in managing genuine sales enquiries, and (where relevant) taking steps at your request before entering into a contract.

4. Who we share your data with (processors and recipients)

We use trusted third-party service providers ("processors") to run our website and our marketing. They act only on our documented instructions and only for the purposes described in this notice. We put data processing agreements in place with our processors. We will never sell your personal data.

Processor	What they do for us	Location
Instantly	Email delivery for our marketing and follow-up	United States
Twilio	SMS delivery	United States / EU
MillionVerifier	Email verification for the personal-data subset of addresses, under an SCC-backed data processing agreement	United States
Cloudflare	Hosting of our website and per-garage demonstration pages, and event logging	Global
Firecrawl	Collection and enrichment of publicly available business data for marketing research	United States
GoHighLevel (GHL)	CRM and management of enquiries and walkthrough/demo bookings	United States
Retell	Voice AI for our demonstration phone line. If you ring the demo number (01952 767 010), your call audio is processed by Retell	United States
OpenAI / Anthropic	Large-language-model processing used to help generate personalised outreach content, under standard contractual transfer terms	United States
Reoon	Email verification, restricted to non-personal generic role mailboxes (for example info@, service@) at incorporated businesses only. This provider is being discontinued for our use; an erasure request has been made for personal data previously submitted to it (see section 5.2)	Bangladesh / United States

5. International transfers

Several of our processors are located outside the UK. Where we transfer personal data outside the UK, we rely on an appropriate safeguard under Chapter V of the UK GDPR, namely the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses (SCCs), or an adequacy decision where one applies.

United States (Instantly, Twilio, MillionVerifier, Cloudflare, Firecrawl, GoHighLevel, Retell, OpenAI/Anthropic): UK to US transfers of personal data are made under the UK IDTA or Standard Contractual Clauses as incorporated in each provider's data processing terms. MillionVerifier, which handles the personal-data subset of email verification, operates under an SCC-backed data processing agreement.

Bangladesh / United States (Reoon): Reoon is being discontinued for our use and is restricted to non-personal data only. An erasure request has been made for the personal data previously submitted to it.

5.2 Erasure of data held by a discontinued processor

As part of phasing out our use of Reoon for personal data, we have issued an Article 17 erasure request for the personal-data addresses previously submitted to that provider. This is being tracked to completion.

6. How long we keep your data

• Marketing prospect data: kept only while a campaign is active, and reviewed at the end of the campaign.
• Enquiry and walkthrough/demo records: kept for as long as we are in active contact with you, plus 12 months.
• Suppression / opt-out records: kept indefinitely, so that we can continue to honour your opt-out and avoid contacting you again.

7. Suppression list and opt-out

You can opt out of our marketing at any time:

• By email: reply to any of our messages with "no thanks" (or any clear opt-out), or email us at dave@four10.agency.
• By SMS: reply STOP.

When you opt out, we add you to a permanent suppression list so that we do not contact you again across any of our sending addresses or numbers. We honour opt-out requests promptly (within 48 hours in the ordinary course). The suppression list is the one record we keep indefinitely, precisely so that your opt-out continues to be respected. Every marketing message we send identifies us and includes a clear way to opt out.

8. Your rights

Under the UK GDPR you have the right to: be informed about how we use your data (this notice); access the personal data we hold about you; rectification of data that is inaccurate or incomplete; erasure ("right to be forgotten") under Article 17; restriction of our processing in certain circumstances; to object to our processing, including an absolute right to object to direct marketing, which we will always honour; data portability; and to complain to the Information Commissioner's Office (see section 9).

How to exercise your rights. Contact us at dave@four10.agency. We will respond to your request within one month of receiving it. In limited cases (for example, particularly complex requests) we may extend this period and will tell you if so.

9. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at dave@four10.agency so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): website ico.org.uk; helpline 0303 123 1113.

10. Changes to this notice

We may update this notice from time to time. The version and date at the top show when it was last updated.