Privacy policy

This policy explains what we do with personal information when you visit airfluxstore.co.uk, buy from us, or get in touch.

Who we are

AirFlux is a trading brand of BEXTRA LIMITED, a company registered in England and Wales, company number 14912846, VAT number GB446408684, registered office Unit 23 Blackhill Road, Holton Heath Trading Park, Poole, England, BH16 6NL.

BEXTRA LIMITED is the data controller for the personal information described in this policy, for the purposes of the UK GDPR and the Data Protection Act 2018. We are not required to have a data protection officer, so questions come to us directly, at support@airfluxstore.co.uk.

What we collect, why, and for how long

Buying from us

What: your name, delivery and billing address, email address, phone number where you give one, what you ordered, and the record of the payment. We never see or store your full card number — that goes directly to the payment provider.

Why and on what basis: to perform our contract with you. We cannot take an order without it.

How long: 6 years from the end of the accounting year the order falls in. HMRC requires us to keep VAT records for 6 years, and the same period covers a claim under the contract.

Your account

What: your email address, and the orders and addresses linked to it. Accounts on this store are hosted by Shopify and sign-in uses a one-time code sent to your email — there is no password for us to hold.

Why and on what basis: to perform our contract with you and to let you see your own orders.

How long: until you ask us to close the account. Order records are kept for the 6 years described above even after an account is closed, because we are required to keep them.

Finding parts for your vehicle

What: the vehicle registration number you type into the registration box, or the make, model and year you pick by hand.

Why and on what basis: our legitimate interest in selling you a part that actually fits. Our interest is in getting fitment right; yours is in not receiving the wrong part; and neither requires us to know who you are.

How long: a registration number is not stored anywhere at all. It goes straight to the government service described below and is discarded — see Looking up your vehicle by registration.

Keeping your chosen vehicle between pages

What: the car you chose, the products you have looked at, and which products you have already seen — all held in your own browser, never on our servers.

Why and on what basis: for the current visit this is a record of a selection you made on the site, which the Privacy and Electronic Communications Regulations treat as strictly necessary, so no consent is needed. Keeping it between visits does need your consent, which is what the Preferences switch on the cookie banner asks for.

How long: without consent, until you close the tab. With consent, until you clear your browser storage or withdraw consent — turning Preferences off deletes the stored copy on your next page view, and your current visit carries on uninterrupted.

The full list of what is kept, key by key, is in Cookies and browser storage below.

Back-in-stock and "we don't cover my car" sign-ups

What: your email address, what you asked about, and anything you typed to describe your vehicle.

Why and on what basis: your consent, given by ticking the box on the form. You can withdraw it at any time by using the unsubscribe link in any email we send, or by emailing us.

How long: your email address is held as a customer record in Shopify until you unsubscribe or ask us to delete it. Separately, our own system keeps a count of how many people asked about a given product or vehicle. That count is kept alongside a short one-way fingerprint of your email address — a fragment of a cryptographic hash, which cannot be turned back into your address and cannot be used to contact you. It exists only so that one person signing up twice is not counted as two people.

Contacting us

What: whatever you send us — your name, email address or WhatsApp number, and the content of the message.

Why and on what basis: to perform our contract where the message is about an order, and otherwise our legitimate interest in answering people who write to us.

How long: 2 years after the conversation ends, or 6 years where it relates to an order.

Reviews

What: the name you give, your rating and review, any photographs you attach, and the vehicle you name. Reviews are collected and hosted by Judge.me.

Why and on what basis: your consent when you submit a review. Published reviews show a first name and last initial, or "Customer" where you asked to stay anonymous. Your email address is never published.

How long: for as long as the review is published. Ask us and we will remove it.

Keeping the site working and stopping abuse

What: your IP address, used as a counter so that no single connection can flood the registration lookup or the sign-up forms.

Why and on what basis: our legitimate interest in keeping a free service available to everybody and not having it drained by automated traffic.

How long: the counters expire on their own — after one minute for the short-term limit, and after 24 hours for the daily one. Nothing is written to a permanent log.

Understanding how the site is used

What: Shopify's own analytics — pages viewed, referring site, device and browser, and what was added to a basket.

Why and on what basis: your consent, given through the Analytics switch on the cookie banner. Nothing analytics-related is collected until you agree.

How long: as set by Shopify's own retention for store analytics.

We should say plainly what we do not do: this store runs no advertising or tracking pixels of any kind. There is no Google Analytics tag, no Meta pixel and no third-party advertising network on this site, and we do not build advertising profiles or sell personal information to anyone.

Fraud, disputes and the law

What: order and payment records, and anything relevant to a dispute or a chargeback.

Why and on what basis: compliance with our legal obligations, and our legitimate interest in defending claims and preventing fraud.

How long: 6 years, alongside the order record.

Looking up your vehicle by registration

This is worth setting out in full, because it is the one part of the site that involves a government database.

When you type a registration number into the finder, your browser sends it to our own service, which passes it to the DVSA MOT History API — an official service run by the Driver and Vehicle Standards Agency. The DVSA answers with the make, model and year of the vehicle, and we use that to show you the parts that fit it. The Department for Transport is the controller for the DVSA's own processing, and its lawful basis is public task; you can read its notice at gov.uk.

We do not store the registration number. Not in a log, not in a cache, not in a database. It exists in the outbound request and nowhere else. What we keep afterwards is the make, model and year — in your own browser, under the rules described above — and, separately, an anonymous count of how many people looked up a vehicle we do not yet stock parts for. That count contains no registration and nothing about a person.

Using the registration finder is entirely optional. The manual make, model and year picker does the same job and involves no lookup at all.

Who we share personal information with

We do not sell personal information. We share it only with the organisations we need in order to run the shop, and only with what they need:

• Shopify — hosts the shop, the checkout, customer accounts and our customer records, and provides store analytics. Shopify processes personal information on our behalf, and for some of its own platform features acts as a controller in its own right; its consumer privacy policy is at shopify.com.
• Payment providers — Shopify Payments, and Klarna, Shop Pay, Apple Pay or Google Pay where you choose one. They receive what they need to take the payment. Klarna is a credit provider and becomes a controller of your information under its own agreement with you.
• Cloudflare — runs the small service behind the registration finder and the sign-up forms, and provides the network the site is served over.
• DVSA — receives a registration number when you use the finder, as described above.
• Evri — receives the name, delivery address and contact details needed to deliver your parcel, and the same for carrying a return back to us.
• Judge.me — collects and hosts reviews.
• Our accountants, and HMRC — order and payment records, as required for tax.
• Law enforcement, regulators or a court — where we are legally required to, or where we need to establish or defend a legal claim.

Sending information outside the UK

Some of the organisations above are based outside the United Kingdom, or use servers outside it — Shopify and Cloudflare in particular. Where personal information is transferred out of the UK we rely on either an adequacy decision made by the UK government for the country concerned, or the UK International Data Transfer Agreement or Addendum to the European Commission's Standard Contractual Clauses. You can ask us for details of the safeguard used for any particular transfer.

Cookies and browser storage

Cookies, localStorage and sessionStorage are all covered by the Privacy and Electronic Communications Regulations, and we treat them the same way. This section lists everything airfluxstore.co.uk stores in your browser, what each item is for and how long it lasts.

You can change what you have agreed to at any time, using the "Cookie settings" link at the foot of this page — it is in the footer of every page on the site. Turning Preferences off deletes the stored copies on your next page view; your current visit carries on as normal. You can also clear or block storage in your browser's own settings — if you do, the site keeps working, it simply stops remembering your vehicle between visits.

Strictly necessary — no consent needed

These make the shop function. They cannot be switched off, because without them there is no basket and no checkout.

• _shopify_essential — Shopify's essential cookie. Holds your session and checkout information and guards against tampering. Set by Shopify. Expires after 1 year.
• _tracking_consent — the record of the answer you gave the cookie banner. It is the copy Shopify itself reads, and the reason you are not asked again on every page. Set by Shopify. Expires after 1 year.
• cart_currency — remembers that you are shopping in pounds sterling. Set by Shopify. Expires after 2 weeks.
• localization — remembers that you are shopping in the United Kingdom. Set by Shopify. Expires after 1 year.
• airflux:consent — a copy of your banner answer, so the site knows what you agreed to before Shopify's own privacy service has finished loading. Stored in localStorage, and only ever written for permissions you actually granted — refuse everything and this store holds nothing at all. Remembering a consent choice is itself covered by the strictly necessary exception.
• airflux:pending-resolve — holds an anonymous "this vehicle came up" note for the few moments between the page loading and your consent answer arriving. Stored in sessionStorage only, never written to disk, and discarded when the tab closes.

Two more items are held in sessionStorage for the length of your visit and contain nothing about you: a copy of the fitment index the site uses to work out which parts suit which vehicle, and a copy of the review counts. Both are there so the same file is not downloaded twice, and both die with the tab.

Preferences — only with your consent

These remember what you were shopping for. During your visit they are strictly necessary — they are a record of a selection you made on the site, which is what makes the shop able to answer you at all — so they work whatever you choose. Keeping them between visits is what needs your consent, and that is what the Preferences switch controls.

• airflux:car — the vehicle you chose or looked up, so that prices, fitment and the parts we show you stay matched to it. Held in sessionStorage for the visit; copied to localStorage only with your consent.
• airflux:recent — the products you have recently viewed, labelled by vehicle, for the "recently viewed" row. Same rule.
• airflux:seen:… — a marker per product, so the site does not repeat something you have already been shown. Same rule.

With consent, these stay until you clear your browser storage or withdraw consent. Without it, they last only until you close the tab.

Analytics — only with your consent

Nothing here is collected until you agree.

• Shopify store analytics — pages viewed, where you arrived from, device and browser, and what was added to a basket. Collected by Shopify and reported to us as aggregate figures. Shopify's analytics cookies appear only after you have agreed: _shopify_y, which expires after 1 year, and _shopify_s, which expires 30 minutes after it was last used.
• af_resolved_seen — records which vehicles have already been counted today, so that one person browsing does not register as many. It feeds an anonymous count of which vehicles people are looking for, which is how we decide what to stock next. It contains no registration number and nothing identifying, and unlike the Preferences items it is written nowhere at all until you agree.

Marketing

This store runs no advertising or tracking pixels, so agreeing to the Marketing category currently causes nothing to be set. The switch is there because it governs what Shopify would be permitted to do if an advertising tool were ever added, and because your answer should be on record either way.

Third-party content

Some pages load content from other companies, which may set storage of their own under their own policies: Shopify (the shop platform, the checkout and Shop Pay) and Judge.me (reviews). Links to Facebook, Instagram and TikTok in our footer are ordinary links — nothing from those sites is loaded until you follow one.

If you use the registration finder, the registration number is not stored in a cookie or in browser storage — see the section on looking up your vehicle above.

Your rights

Under the UK GDPR you have the right to:

• be told what we do with your personal information — which is what this policy is for;
• get a copy of the personal information we hold about you;
• have it corrected if it is wrong or incomplete;
• have it deleted, where we no longer need it and are not required to keep it;
• restrict what we do with it while a question about it is resolved;
• object to processing we carry out on the basis of legitimate interests, and to direct marketing at any time, which we will always honour;
• portability — receive the information you gave us in a machine-readable form, or have it sent to someone else, where we hold it on the basis of consent or a contract;
• withdraw consent at any time, where consent is the basis we rely on. Withdrawing it does not affect anything done beforehand.

We do not make any decision about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects.

To exercise any of these rights, email support@airfluxstore.co.uk. We will respond within 1 month. We may need to check who you are first, and we will never charge you for a request unless it is manifestly unfounded or excessive.

Complaints

If you are unhappy with how we have handled your personal information, please tell us first and we will try to put it right. You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

Keeping information secure

The site is served over HTTPS, payment details go directly to the payment provider and never through our systems, and access to customer records is limited to the people who need it. The credentials used for the registration lookup are held as encrypted secrets and are never present in the website's code. No system is perfectly secure, so please do not send us card numbers or passwords by email or WhatsApp — we will never ask for them.

Children

This shop is not aimed at children and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us their information, email us and we will delete it.

Changes to this policy

We update this policy when what we do changes. The date at the bottom always shows when it last changed, and where a change materially affects you we will say so on the site.

Contact

BEXTRA LIMITED (trading as AirFlux)
Unit 23 Blackhill Road, Holton Heath Trading Park, Poole, England, BH16 6NL
Email: support@airfluxstore.co.uk
WhatsApp: +44 7927 800235
Monday to Friday, 9am to 5pm UK time

Last updated: 6 September 2026.