Privacy notice.

This portal is the retailer guest management system for Bentley's presence at the 2026 Goodwood Festival of Speed. It is operated by Vyra on behalf of Bentley Motors Ltd.

• Bentley Motors Ltd is the data controller for guest data submitted through the portal.
• Vyra operates the platform as a data processor under a written contract with Bentley.

This notice explains how personal data about portal users (retailers, stand staff, and administrators) is handled. It does not cover personal data that Bentley holds about you through other channels.

For the personal data of event guests entered into the portal by retailers, Bentley is the data controller and Bentley's own privacy information will apply to those individuals.

If you hold an account on the portal, we process:

• Account details — your name, email address, dealership affiliation (where applicable), and the role assigned to your account.
• Authentication events — sign-in timestamps, and your IP address (held briefly for rate-limiting and abuse prevention).
• Activity records — an audit trail of changes you make to guest entries, and administrative actions taken on your account.
• Correspondence — any messages you send to bentleyfos@vyra.co.uk.

• Legitimate interests — operating the portal, preventing misuse, maintaining an audit trail, and keeping the service secure.
• Contract — where your use of the portal forms part of your dealership's commercial relationship with Bentley.

We do not process your personal data for marketing and do not engage in automated decision-making or profiling.

• Bentley Motors Ltd, our client and recipient of the event submissions.
• A limited number of Vyra staff who operate the portal, each with access on a need-to-know basis.
• Infrastructure providers acting as sub-processors — our email delivery partner (Resend, for transactional emails) and our hosting environment. Each is bound by a written data processing agreement.
• Law enforcement or regulators where we are required to disclose by law.

• Account records are retained for the duration of the event and for up to six months afterwards, then deleted.
• Authentication logs are kept for 90 days.
• Audit entries linked to a guest record are retained with that record and deleted on the same schedule.

• All traffic is encrypted in transit over HTTPS.
• Passwords are stored as one-way bcrypt hashes.
• Database access is restricted to named operators; sign-ins and admin actions are logged.
• Backups are taken regularly and held within the same security boundary.

The portal uses a single strictly-necessary cookie to keep you signed in. It contains a signed session token and does not identify you to any third party. Under UK PECR, strictly necessary cookies do not require consent.

We do not use analytics, advertising, or third-party tracking cookies.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data (you can also update your own account details directly).
• Request erasure in certain circumstances.
• Object to processing based on legitimate interests.
• Restrict processing.
• Receive your data in a portable format.

To exercise any of these rights, contact bentleyfos@vyra.co.uk. We will respond within one month.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

We will update this notice if our practices change. The “Last updated” date at the top reflects the most recent revision. Material changes will be notified to account holders by email.

• Portal operations and rights requests (Vyra, processor): bentleyfos@vyra.co.uk
• Matters relating to the event itself or guest personal data (Bentley Motors Ltd, controller): via your retailer contact at Bentley, or through Bentley's usual privacy channels.
• UK supervisory authority: the Information Commissioner's Office, ico.org.uk.