bp Fuel Cards – UK Fleet Privacy Notice

We collect most of the personal information we process from you. In some circumstances, we may generate the information ourselves, for instance when we created your user ID. To use bp Fuel Cards, we must collect required personal data to deliver the services. We may require some information from you such as your name, email address, phone number to establish an account.

 

When you use bp Fuel Cards, we may process the following personal information about you.

We primarily use your information to give deliver services related to the bp Fuel Cards. We keep your information secure by implementing appropriate security measures as required by applicable data protection laws.

 

Lawful basis

 

Where required by applicable law, we ensure that we have a lawful basis to use your personal information for the purposes outlined in this Statement. Under GDPR we will rely on Article 6 lawful basis listed below:

 

We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) based on the following legal grounds:

• Contractual necessity (UK GDPR Art. 6(1)(b)) – when the processing is required to enter or perform a contract with you, such as providing and managing bp Fuel Card services.
• Legitimate interests (UK GDPR Art. 6(1)(f)) – when the processing is necessary for our legitimate business purposes, including pre-sales activities, bidding process, contract negotiations; enabling cashless fuel payments; preventing fraud; improving our services; and conducting statistical analysis and research. These activities are carried out in a way that does not override your fundamental rights and freedoms.
• Consent (UK GDPR Art. 6(1)(a)) – when you have given us explicit permission, for example, to receive marketing communications or to use optional service features. You can withdraw your consent at any time. In some cases, such as when processing the personal data of authorized card users, we rely on the customer or cardholder to obtain the necessary consent from the data subject for the transfer and use of their data.

To make it easy to understand, we have set out in the table below why we collect and how we use your information, and the legal bases we may rely on to do this.

We take precautions to protect data and information under our control from misuse, loss, or alteration. Our security measures include industry-standard physical, technical, and administrative measures to prevent unauthorized access to or disclosure of your information, to maintain data accuracy, to ensure the appropriate use of information, and otherwise safeguard your personal information.

We may share your information with bp entities and third-party recipients, such as external service providers, social media companies (if you have requested or agreed to this) and legal or regulatory bodies. We have contracts in place with these third parties to protect the use of your information, and any service provider we appoint is contractually required to comply with privacy laws and security measures.

 

We set out further details about the information we share with service providers and other third parties in the table below.

As an international company, we may transfer your personal information to other bp group entities around the world. For instance, our entities based in the UK, USA or India may access information for IT support purposes. Where this is the case, we ensure that the importing country offers an adequate level of data protection compliance, or we will rely on our global compliance framework which includes appropriate data transfer measures and safeguards to ensure that we protect your personal information in accordance with applicable data protection laws.

 

Concerning transfers between group entities, we rely on our intragroup agreement which includes the EU Commission approved standard contractual clauses and the UK IDTA, as each may be amended or updated from time to time. Where we transfer personal information to a third-party outside the bp group, we ensure that appropriate measures are in place to offer an adequate level of protection for your personal information. As above, this includes the use of approved relevant standard contractual clauses as required under applicable laws.

How long we will hold your personal information will vary based on the purpose for which we are using it. We will need to keep your information for as long as is necessary for each purpose in line with our business needs, as documented in our internal policies.

 

We calculate the retention period based on the time the personal information is needed to: (a) fulfil the purposes described in this Privacy Statement, (b) meet the timelines required or recommended by regulatory authorities, professional bodies, or associations, (c) comply with applicable laws, legal holds, and other legal obligations (including contractual obligations), and (d) comply with your requests.

 

There may be laws or regulations which set a minimum period for which we have to keep your personal information. We will only hold your information for the defined retention period, before anonymizing the information or deleting it. We anonymise data using a mixture of measures, including aggregating the data (for example, to make a finding about a group of people as opposed to a specific individual) or by removing any personal identifiers (for example, unique IDs or contact information) so that we can still use data to see trends and patterns but cannot link this data back to you. We may retain some data longer as required by legal obligations, such as tax, accounting, and regulatory compliance; for a limited period after the agreement ends, to manage any remaining legal, regulatory, or compliance-related matters.

The rights set out below apply to your usage of bp Fuel Cards. It is important to understand that there are situations in which these rights may not apply, for instance where they are not relevant to your request. For this reason, applicable rights will depend on your specific circumstances.

 

9.1. Data Protection Rights

 

• Access to your personal information. Where applicable, you are entitled to receive a copy of personal information we hold about you.
• Correction of the personal information that we hold about you. You may request that we correct any incomplete or inaccurate data we hold about you, though we may need to verify the accuracy of the new data you provide to us. It is important that the personal information we hold about you is accurate and current. Please contact us using the contact details below to update us in the event of any changes to your personal information.
• Erasure of your personal information. You may request that we delete or remove personal information where there is no overriding reason for us to continue to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we have processed your information unlawfully or where we are required to erase your personal information to comply our legal obligations.
• Right to Object - Where we process your personal information based on legitimate interests, you have the right to object to such processing, including profiling on grounds relating to your particular situation, at any time. If you exercise your right to object, we will stop processing your personal information in that context. In some cases, however, we may demonstrate that we have compelling legitimate grounds to continue to process your personal information and if this is the case, we will inform you.
• Restriction of processing of your personal information. You may ask to suspend the processing of your personal information in the following scenarios:
  - If you want us to establish the data's accuracy;
  - Where our use of the data is unlawful but you do not want us to erase it;
  - Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  - You have objected to our use of your information, but we need to verify whether we have overriding legitimate grounds to continue to process it.
• Transfer of certain of your personal information to you or a third party. Where this right applies, we will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Please note that this right only applies to information you provided to us and which we process on the basis of consent or where it is necessary to perform a contract with you.
• Withdraw consent where we are relying on consent to process your personal information. Withdrawal will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. Where we seek consent, it can be withdrawn through contacting our customer service by email at bpcardsadmin@bp.com.

 

9.2. Right to complain to your supervisory authority

 

• We are committed to working with you to resolve any complaint you may have about how we use your information. If you have any concerns or wish to make a complaint, please contact our customer service at bpcardsadmin@bp.com.
  You may have the right to complain to the Information Commissioner’s Office.

For privacy-related queries or to exercise your rights:

bp Fuel Cards Customer Services

P.O. Box 352, Sunbury-on-Thames, TW16 9AT

Email: bpcardsadmin@bp.com

This Statement was last updated in Janurary 2026. We will update it again when necessary to reflect changes in the law and our practices. If we make a material change to this Statement, you will be provided with appropriate e-mail notice in accordance with legal requirements.

 

We encourage you to periodically review this Statement to stay informed about our collection, processing and sharing of your personal information.