This privacy notice provides general information on what personal data the bp group (or any of its brands) may process about you as a consumer of our products or services. It also explains how we use that data, who we might share it with and how we keep it safe.
We want to make sure that you are informed about how bp uses your data and that you understand your data privacy rights.
We may collect your data when you use our products and services, including when you participate in any loyalty plans. We also collect your data when you contact us or visit any of our websites or apps - which we’ll call our ‘Digital Assets’ in this notice.
Your data will be collected and processed by a member of the bp group. For simplicity in this notice, we’ve referred to the bp group as ‘bp’, ‘we’, ‘us’ and ‘our’.
We don’t usually target or collect personal data from minors. If you’re a minor but would like to get in touch with us, please ask a parent or guardian to do so for you.
The bp group has different businesses that engage directly with our consumers through brands such as bp pulse, bpme, earnify, and Wild Bean Café. Click here to find out more about our products and services.
Some of our services may have dedicated privacy notices, which you can access directly from that service.
In some countries, we’re required to list the legal entity responsible for processing your data, you can find this information here.
When you use one of our Digital Assets, or participate in one of our plans or programmes, we may collect the kinds of data listed in Table 1.
There are many different ways we may collect your personal data. For example, we collect personal data from:
In most cases, an asterisk (*) will indicate where sharing your personal data with us is required for you to use our products and services, such as when you register for one of our loyalty plans or program, or to use our Digital Assets. However, we might ask you to share extra details about yourself, so that you can get the most out of our products or services.
Sometimes, we’ll create data which counts as your personal data, like if we were to set you up with a unique user ID.
For more information about the way we use cookies and similar technology, visit our dedicated cookie notice here.
In general, we collect your data to provide you with the products or services you requested, including to access any related Digital Assets, to understand your preferences, to communicate with you, to operate our business, for security, compliance and enforcement purposes, and to give you the best possible customer experience.
Table 2 details how we use your data (and may have used during the 12-month period prior to the Updated date of this notice) and the legal bases we may rely on. We may also use your data for the following reasons:
You may see our ads on other websites because we use third-party ad services on our Digital Assets. These ads may be customised based on your demographic data, inferred interests and browsing context.
Ad services track information about your online activities over time and across third-party websites and apps by collecting information as you use those sites. The data collected could include information about your visits (such as the pages or ads you view) and your clicks on participating websites or apps. Data may be collected both on the Digital Assets and on third-party websites and apps, to show you ads that may be tailored to your individual interests and to track how effective our marketing campaigns are.
If you opt out of ads directly on your browser or mobile device, you may need to renew your choices regularly on these mechanisms. Visit Data Protection Rights for more information on how to opt out of the sale of your personal data or processing of your personal data for purposes of targeted advertising.
Our Digital Assets are not designed to respond to “do not track” signals from browsers. These sharing activities may be considered a “sale” and processing of personal data for targeted advertising under applicable law.
We may use automated data processing to tailor your experience based on your preferences or provide promotional offers relevant to your interests.
We may also use automated data processing to help with security threat detection and prevention efforts.
Any profiles we may apply to your personal data are not used to take decisions that produce legal - or similarly significant - effects concerning you.
We may use AI systems to support productivity and efficiency within our operations.
Where third-party AI systems are used as part of our services to you, appropriate safeguards will be in place to protect your data and maintain compliance with applicable data protection laws.
If an AI system is likely to have a material impact on how your personal data is processed, we will provide a dedicated notice explaining its use and potential implications.
Some countries require us to give a lawful reason for collecting and using some types of personal data. When we collect your data, and your jurisdiction requires us to have a reason for collecting the data, the purpose of us collecting that data will be for one of the below reasons:
As an international company, we may transfer your personal data to other bp-group companies around the world. For instance, our entities in the UK, USA or India, among other countries, may access information for IT or other operational support purposes.
Table 3 gives you more information about the data we might share (and may have shared during the 12-month period prior to the last updated date of this notice) with service providers and other third parties.
We maintain administrative, technical and physical safeguards designed to make sure that your information is only accessed by those allowed and that it is not mishandled.
There are also steps we recommend you take to keep your personal data safe. For instance, it’s advisable to make sure that your password, and any secret questions and answers, remain confidential. You should make sure these are updated regularly, in addition to any other authentication information you use to access our services.
If we transfer your personal data to another country, appropriate safeguards are in place to protect your data, in accordance with applicable data protection laws. This may include: relying on adequacy decisions issued by relevant authorities, implementing standard contractual clauses, or applying our global compliance framework designed to keep your data secure.
We rely on our intragroup agreement to share information with other bp companies like the EU Commission-approved standard contractual clauses and the UK-approved transfer agreement.
You can contact us using our forms here if you have questions about our international transfers and the contractual safeguards we implement.
The length of time we keep your personal data for varies depending on why we’re using it and our internal policies.
We calculate how long we’ll retain your personal data according to how much time is needed to: (a) fulfil the purposes applicable, as described in this Privacy Notice, (b) meet the timelines required or recommended by regulatory authorities, professional bodies, or associations, (c) comply with applicable laws, legal holds, and other legal obligations (including contractual obligations), and (d) comply with your requests.
For example, if you’re located in the UK and we have a contract with you, we will typically retain your personal data for six years following the termination of that contract. The exception to this would be if we have a dispute with you, in which case we would need to keep it longer. If you’re in Germany, we would typically only retain your personal data for three years.
There may be laws or regulations that mean we must keep your personal data for a minimum period. Where there is a minimum retention period for your data and we do not need that data for any other purpose, we will only hold your data for the defined retention period, before anonymising or deleting it.
We anonymise data using a range of measures, for example, by:
If you choose to unsubscribe from a service or opt out of certain types of processing (such as from the sale or sharing of your personal data for marketing purposes), we will keep your details on a ‘suppression list’ to make sure that we know that you’ve unsubscribed.
The rights set out below may apply to you depending on where you are located.
There are some situations in which these rights may not apply - for instance, where they are not relevant to your request. For this reason, applicable rights will depend on your specific circumstances.
To exercise any of your rights listed below, please contact us here.
The ‘Legitimate Interest’ purpose for handling personal data is not available everywhere in the world. However, where we process your personal data based on a legitimate interest in one of these jurisdictions, you have the right to object to the processing, including to object to profiling on grounds relating to your particular situation. You can object to our processing of your personal data for marketing purposes at any time.
If you exercise your right to object, we will stop processing your personal data in that context. In some cases, we may demonstrate that we have compelling reasons to continue to process your personal data. We will keep you informed if this is the case.
Depending on where you reside, you may designate an authorised agent to submit an access, correction, deletion or opt-out request on your behalf.
To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal data or complying with your deletion or correction request.
If you have any complaints, please contact us first and we will take all steps we can to resolve it.
If we cannot resolve it, you may have the right to complain to the competent supervisory authority. You can find the contacts for your local supervisory authority here.
Depending on where you reside, you may appeal our decision with respect to a request you have submitted to us.
If you choose to exercise any of your data protection rights, you have the right to not receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.
Our Digital Assets are not designed to be directed to minors. We don’t knowingly solicit or collect personal information from minors. If you would like to contact us about a child’s personal data, use the contact us section of our Privacy Centre.
We might update this Privacy Notice from time to time. The last update was in May 2026. If we make any significant changes that could affect how we process your data, we’ll notify you via email.
| Type of data | What could this include? | Where could the data come from? |
|---|---|---|
| Biographical and contact data | Your telephone number, an email or postal address. | You may provide us with the data, for example, through an interface such as a web page. |
| Account credentials | Your account username(s) or password(s). | You may provide us with account credentials, for example, a preferred username – or we may generate them for you. |
| Transaction data | Details of:
| Transaction data may be provided by you or generated by us. |
| Professional data | Data such as your job title, company name, company email address, business phone number, business address. | This data may be provided by you or a third party. |
| Preference data | Marketing or usage preferences that you’ve provided us with, or that we may infer from other data provided to us. | Preference data may be generated by us or come from a third party. |
| Correspondence | We usually keep a record of our correspondence with you, including telephone calls. | This data may come from you. It may also come from transcripts generated by us, for example from customer care calls. |
| Digital Asset usage data | This may include your time zone, location and your IP address, as well as information about your browsing – for example, the type of browser you’re using, and the version. It may also include details of the technology on a device you’re using to access one of our Digital Assets – like your operating system – depending on any cookies or trackers in place. For more information, see our cookie notice. | This data may be generated by us or a third party. |
| Recordings | Video or voice recordings of you, through CCTV when you attend our sites or when you call our customer care or other support services. | This data may be generated by us. |
| Why we may use your data? | What data might we use? | Lawful basis for processing |
|---|---|---|
As part of our customer management activities, to operate and improve our business, including the services and products we provide to you. This includes:
|
| Legitimate interests to effectively manage and provide services to you and to improve our services.
Where legitimate interest is not available in your local law, we may rely on consent, notice, or contract. |
| To verify and execute transactions you make using a Digital Asset. |
| Performance of a contract. |
To manage and maintain our Digital Assets. This includes:
|
| Legitimate interests to maintain and manage information technology services, network and data security, and prevent fraud.
Where legitimate interest is not available in your local law, we may rely on consent or contract. |
| To operate cookies and other trackers, as described in the Cookies Preferences notice, found in the footer of our Digital Assets. |
| Legitimate interest to provide necessary functionality for our Digital Assets, or consent where required under your local law. |
To conduct analytics, statistics, and derive insight. This includes:
We may also anonymize your personal data for this purpose. Where this is the case, some privacy laws will not apply. |
| Legitimate interest to improve and enhance our business model and services, and better understand our customers
Where legitimate interest is not available in your local law, we may rely on consent or contract. |
To advertise and create promotional material, this includes:
|
| Legitimate interest to inform our customers about our Digital Assets, products and services, or consent where required or available under your local law.
You can withdraw this consent/unsubscribe at any time by clicking on the unsubscribe link in each of our communication. |
For legal and regulatory purposes, this includes:
|
| Legal obligations, where the processing activity is required by law or regulation.
In all other cases, legitimate interests (to comply with our obligations and exercise our legal rights). |
| To receive business support (such as consultancy, banking, legal, insurance and accounting services) or to restructure our business, including in the context of sales, transfers, mergers and acquisitions (and the negotiations of the foregoing). |
| Legitimate interest to restructure our business.
Where legitimate interest is not available in your local law, we may rely on consent or contract. |
| Who might we share your data with? | What’s the purpose for sharing? | What might we share? |
|---|---|---|
| bp entities or companies that we acquire in the future, after they are made part of the bp group; or entities that may acquire parts of bp as part of a divestment. |
|
|
| We may share your personal data with third-party service providers, agents and contractors to provide services to us. |
|
|
| We may share your personal data with third-party partners. |
|
|
| Advertising partners and social media platforms. |
|
|
| Professional advisors like lawyers and accountants. |
|
|
Courts, regulatory authorities and other public authorities. These bodies may be situated outside your country. Where this is the case, the legal or regulatory authority will be considered to be a data controller (not acting on our instructions) and will be primarily responsible for deciding how your information is held and used once shared by us. |
|
|