BIS – Bunasta Integration System: Privacy Policy (United Kingdom)

Effective date: 3 November 2026 (the date of publication)

Who we are

BIS – Bunasta Integration System is software operated by Bunasta UAB, a company registered in Lithuania (company code 302926843, registered address Savanorių pr. 28, LT-03116 Vilnius, Lithuania). Bunasta UAB is the controller of the personal data described in this policy under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. In Great Britain, AP Financial Limited, trading as BUNASTA UK (company number 11360383), acts for Bunasta. Our UK representative under Article 27 UK GDPR: AP Financial Limited, trading as BUNASTA UK, Unit 17 Arrowhead Road, Waterbrook Park, Ashford TN24 0FL, United Kingdom (company number 11360383). You and the Information Commissioner's Office (ICO) can contact our representative about any matter relating to our processing of personal data. AP Financial Limited is registered with the ICO, registration reference ZC071756 (registered 24 December 2025, expires 23 December 2026). Contact for privacy questions: info@bunasta.eu.

What BIS does

BIS sends GB Safety and Security (ENS) declarations to HMRC through HMRC's Safety and Security GB APIs, on behalf of our transport and customs clients. Our role for this data: Bunasta UAB is the controller.

What data we process

• Consignment and declaration data: consignor, consignee, carrier, goods descriptions, EORI numbers.
• Vehicle and transport data.
• Names and e-mail addresses of client staff who use BIS.
• HMRC OAuth access tokens, so BIS can submit declarations to HMRC for the client.

We do not store our clients' HMRC sign-in details (Government Gateway user ID or password). BIS uses HMRC's OAuth 2.0 authorisation instead.

Why we process it and our lawful basis

We process this data only to prepare and submit declarations to HMRC and to report their status back to our clients. Our lawful bases under Article 6(1) UK GDPR are:

• performance of our contract with the client (Article 6(1)(b)) and our legitimate interest in providing the declaration service to our business clients (Article 6(1)(f)), for consignment, transport and user data;
• compliance with a legal obligation (Article 6(1)(c)), where customs law requires a declaration or requires us to keep records.

We do not use the data for automated decision-making that has legal or similarly significant effects on individuals.

Who receives the data

• HMRC, as the recipient of the declarations.
• Microsoft, as our hosting provider (processor).

We do not sell personal data.

Where the data is stored and international transfers

BIS is hosted on Microsoft Azure in the Sweden Central region (European Economic Area). Personal data sent from the UK to the EEA is covered by UK adequacy regulations, which recognise the EEA as giving an adequate level of protection. If personal data is transferred to any other country without UK adequacy regulations, we use the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as approved under the Data Protection Act 2018.

Security

Access to BIS is protected with OAuth2 through Microsoft Entra ID. HMRC OAuth tokens are used only to submit declarations for the client who authorised them. If a personal data breach is likely to result in a risk to individuals, we report it to the ICO within 72 hours of becoming aware of it, and we report security issues affecting HMRC data to HMRC as its terms of use require.

How long we keep data

• Declaration and transport data: 10 years from the declaration date, then deleted.
• HMRC OAuth tokens: only while valid, at most 18 months, then deleted.

Your rights

Under the UK GDPR you can ask to access, correct or delete your personal data, to restrict or object to its processing, and to receive it in a portable form. Contact us at info@bunasta.eu. We answer within one month of receiving your request. If a request is complex or you send several requests, we may extend this by up to two more months and will tell you why within the first month. If we need more information to identify you or to understand your request, the time limit starts when we receive it.

Complaints

If you are unhappy with how we use your personal data, please complain to us first at info@bunasta.eu. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Changes

Bunasta's general privacy and cookie policy is at https://www.bunasta.eu/duomenu-apsauga/. We may update this policy. The current version is always published at this address.