CM PerformancePrivacy policy
Last updated 5 November 2026
CM Performance, United Kingdom, builds custom ECU software for BMWs. This page explains what we collect when you use cmperf.uk, why, how long we keep it and who else processes it. Questions and requests go to [email protected]. CM Performance is the data controller for the information described here.
What we collect, and why
| When | What | Why |
|---|---|---|
| You email us | Your email address, message and any car details or attachments you choose to send. | To answer your enquiry and check what your car supports. |
| You start an order | Email address, which we verify with a one-time code. | To confirm the request is yours and to send your receipt and file. |
| You submit an order | Name, VIN, WhatsApp number, car model and year, engine, launch RPM settings, transmission, notes, and the ECU files you upload. | To build a file for your exact car and software, and to contact you about the request and payment. |
| You pay | Payment is taken by Stripe. We receive the payment status, the amount, your email and a Stripe reference. We never see your full card number. | To confirm payment and start work. |
| You visit the site | Standard server logs at our hosting provider, such as IP address, browser and pages requested. Cloudflare Turnstile checks the order form for automated use. | To run the site, protect the order form and investigate abuse. |
Why we can use this information
We use enquiry and order information to take steps at your request before a contract and to perform the agreed service. Security and abuse prevention support our legitimate interest in protecting customers and our service. We retain accounting information to meet applicable legal obligations.
How long we keep it
- Unpaid orders. If a request is not paid within 24 hours of checkout being offered, the request and its uploaded files are scheduled for deletion.
- Paid orders. The cloud recovery copy of your uploaded originals is scheduled for removal seven days after successful import into our workshop system; cleanup runs daily. We keep your delivered file, your original file and the build record so we can support you, revise the file later and show what was delivered. Email about your order is kept for the same reason.
- Enquiries. Contact form messages are kept in our mailbox for as long as they are useful to answer you.
- Payments. Stripe keeps payment records under its own policy. We keep our receipt and the payment reference for accounting.
Who processes it for us
We use a small number of providers. Each one processes only what it needs for its job.
- Cloudflare hosts and serves this site. It also runs Turnstile on the order form and the order service at orders.cmperf.uk, which stores uploaded files and a temporary recovery copy after import to our workshop system.
- Stripe handles card payments.
- Google serves the web fonts on this site, which means your browser requests them from Google when a page loads.
- WhatsApp is used only if you choose to continue a request there.
- Resend and Google Gmail process order email, including verification codes, receipts and delivery messages.
Our order upload bucket is hosted in the United States. Other providers may also process information outside the UK. Contact us for details about the providers and transfer arrangements relevant to your order.
We do not sell your information, and we do not use advertising trackers or analytics cookies.
Cookies and storage
The order form sets a session cookie at orders.cmperf.uk so your verified email stays verified while you complete a request. While you fill in the order form, your entries and the files you choose are kept in your browser so a reload does not lose them. Entries last only for that tab. Files are restored only with the matching draft and for no more than 24 hours. Expired copies are removed when the order page is next opened. Submitting or starting a new request clears the current draft and its saved files; clear the site data to remove all earlier copies. On a shared computer, submit or start a new request before leaving, or clear the site data. Your browser also keeps a local list of request references you have sent, visible only on that device; you can remove it from the Sent requests page. No other cookies are set by us.
Your rights
Under UK data protection law you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email [email protected] from the address you used with us. You may also have rights to restrict or object to processing and to receive portable copies, depending on the information and legal basis. We normally answer within one month; if a lawful extension is needed, we explain why. If we need to keep something, for example a payment record, we tell you why. You can also complain to the Information Commissioner's Office at ico.org.uk.
Changes
If this policy changes, the date at the top changes with it. Material changes are noted on the page for a period after they take effect.