Privacy Policy

1. Who is responsible for your information?

Bag Market Limited, trading as Bag Market, is the controller responsible for the personal information we use to run our business and www.bag-market.co.uk. We are registered in England and Wales under company number 03269709. Our registered office is 12 Simwood Court, Beacon Way, Stafford, England, ST18 0DG.

For privacy questions, rights requests or complaints, email sales@bag-market.co.uk, call 01785 303 545, or write to: Privacy enquiries, Bag Market Limited, Unit 12, Simwood Court, Beacon Business Park, Beacon Way, Stafford, ST18 0DG, United Kingdom. You do not need to use a particular form or legal expression.

This notice covers customers, people receiving orders, website visitors and people contacting us. Our use of personal information is governed by the UK GDPR, the Data Protection Act 2018 and applicable electronic communications rules, as amended.

2. Information we collect and where it comes from

• Identity and contact information: your name, business name where relevant, email address, telephone number, billing address and delivery address.
• Account and order information: account details, saved addresses, products and quantities purchased, invoices, order history, discounts, delivery instructions, returns and refunds.
• Payment information: payment status, transaction references and limited payment information supplied by the payment provider, such as card type and masked card details. Please do not email us full card numbers or security codes.
• Correspondence and evidence: enquiries, complaints and information you send us, including relevant photographs or documents about an order.
• Technical and security information: IP address, browser and device information, access times, website requests, session identifiers and records needed to diagnose faults, protect accounts or investigate suspected misuse.
• Preferences and permitted website activity information: marketing choices, cookie choices and information obtained through optional analytics or advertising tools where those tools are enabled in accordance with your choices.

Most information comes from you when you browse, order, create an account or contact us. We also receive payment and fraud-check results from payment providers and delivery updates or delivery evidence from couriers. A purchaser may provide a recipient's details, or a business may give us its staff's contact details to fulfil an order. Where you supply another person's information, give them access to this notice and provide only what is needed.

We need enough identity, contact, address and payment information to process an order. If required information is missing, we may be unable to supply the goods or resolve an enquiry. Marketing permission is optional and is not a condition of buying from us.

3. Why we use information and our legal bases

• Orders, payments, deliveries, collections and requested account services: to take steps you request before a contract and perform our contract with you. For a business's staff contact or a nominated recipient who is not personally party to the contract, we rely on our legitimate interests in administering the order and communicating with the relevant person.
• Enquiries, returns and customer service: to deal with your request, perform the contract, meet consumer-law obligations where applicable, and pursue our legitimate interests in resolving problems and maintaining service records.
• Accounting, tax, legal requests and product-safety obligations: to comply with legal obligations that apply to us, including retaining required transaction records.
• Security, fraud prevention, reasonable promotion-eligibility checks and disputes: our legitimate interests in protecting customers and our business, preventing misuse, establishing what happened and bringing or defending legal claims. We consider whether our use is necessary and proportionate and balance it against people's rights. Where a specific law requires processing, we rely on that legal obligation.
• Optional analytics and advertising: your consent where those features are offered. Necessary technical and security records are handled separately under the relevant contract, legal obligation or legitimate-interest basis above.
• Records of consent, objections and rights requests: our legal obligations and legitimate interests in respecting your choices and demonstrating how we handled them.

Where we rely on legitimate interests, you can ask us to explain the assessment and object to the processing for reasons relating to your circumstances.

4. Service messages and marketing choices

We do not currently send newsletters. We use your contact information to send order confirmations, delivery updates and other necessary messages about your purchase or enquiry. These service messages are separate from promotional newsletters.

If we introduce newsletters, we will update this notice to explain the service and provider and give you the applicable choice before using your information for that purpose. Placing an order or accepting our sales terms does not, by itself, subscribe you to a newsletter.

You can object to direct marketing at any time by contacting sales@bag-market.co.uk. Website analytics and advertising choices are explained in section 6. Withdrawing consent does not affect the lawfulness of earlier processing.

5. Who receives information?

We share information needed for a specific purpose with the following recipients or categories of recipients:

• Couriers — Evri and DPD: the courier selected by us receives the delivery address, recipient and contact details needed to deliver your order, provide tracking and investigate delivery issues.
• Payment providers — Stripe and PayPal: both are available at checkout. The provider handling your payment receives the information needed to process and authenticate it, prevent fraud, and handle refunds or disputes. This can include contact, billing, delivery, transaction and relevant device information. See the Stripe Privacy Policy and PayPal Privacy Statement.
• Website hosting — Dazzle: hosts our website and the information stored within it, including relevant account, order and technical records. Hosting and related support require processing that information on our behalf.
• Analytics — Google Analytics 4: when you allow Analytics, Google processes online identifiers, browser and device information, website activity and purchase-event details, such as a transaction reference, product information and order value, to help us understand website use and completed purchases. We use Google Tag Manager to manage website tags. See how Google uses information from sites that use its services.
• Advertising — Google Ads: we use Google Ads to advertise our products. Where website advertising or conversion-measurement features are enabled with your consent, Google receives the relevant identifiers and information about advertising interactions and website events. Section 6 explains the choices that apply. See how Google uses information from sites that use its services.
• Other business service providers: technical support, business email, account and order administration, and accounting services, where their service requires access to the relevant information.
• Professional advisers and authorities: accountants, legal advisers, insurers, courts, regulators or law-enforcement bodies where disclosure is required by law or necessary and lawful to obtain advice, protect rights or deal with a claim.

Google Shopping product listings: we use Channable only to manage our Google Shopping product listings. It does not import or synchronise our customer orders.

Providers working on our behalf must process information under appropriate contractual instructions and safeguards. Some recipients, including payment providers and couriers, also act as controllers for their own fraud-prevention, legal or service purposes; their privacy notices explain those activities. A provider does not gain unrestricted permission to use your information for unrelated marketing merely because it helps with an order.

6. Cookies, tracking and your choices

We use cookies and similar technologies to keep your shopping session working, operate the basket and checkout, maintain account security and remember your cookie choices. Technologies strictly necessary to provide a service you request do not require optional-cookie consent.

Our cookie panel offers separate choices for:

• Analytics: Google Analytics 4 helps us understand visits, website activity and completed purchases so we can assess and improve our website.
• Advertising: Google Ads tools help measure advertising results and, where the relevant features are enabled, support personalised advertising. The features actually used and the information shared must be explained before consent is requested.

Both optional categories are off until you choose to allow them. You can select Reject non-essential, Accept all, or select individual categories and press Save my choices. Closing the panel, continuing to browse or accepting our sales terms does not give consent to optional tracking.

To change or withdraw consent, use Cookie settings in the website footer. Turn off a category and select Save my choices, or select Reject non-essential to withdraw both optional choices. Rejecting optional tracking does not prevent you shopping. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

We remember the choices you save in this browser for up to 180 days. You can change them sooner. If the preference expires, you clear it, or you use another browser or device, you may be asked again. If your browser prevents the preference being saved, you may need to choose again on another page or visit.

The cookie used to remember your choices is:

Browser settings can also restrict or delete cookies, although blocking essential cookies can affect the basket or checkout. To change your optional choices for this website, use the footer control rather than relying solely on deleting cookies.

7. How long we keep information

We keep information only for as long as needed for its purpose, relevant legal duties and a proportionate need to resolve disputes. Our retention approach is:

• Orders, invoices and accounting records: normally six years from the end of the company financial year to which they relate, or longer where tax law, an ongoing enquiry or another specific legal requirement requires it.
• Customer accounts: while needed to provide the account service. If you request closure, we remove or anonymise information no longer required, while retaining transaction or dispute records that have a separate justified retention period.
• Enquiries, returns, complaints and claims: while the matter is active and for a justified period afterwards, assessed against the nature of the issue, applicable claim time limits, any actual dispute and legal recordkeeping needs. We do not keep every enquiry indefinitely because a claim is theoretically possible.
• Preference records: for as long as needed to respect your choices, manage objections and demonstrate how consent or requests were handled. We review these records and retain only the information needed for those purposes.
• Security logs: for the period necessary to identify incidents, investigate misuse and protect the service, taking account of the sensitivity of the information and whether an incident is active.
• Cookie and analytics information: the cookie recording your choices lasts for up to 180 days from saving a choice. Other cookie durations and the separate retention periods for information held by Analytics and advertising services are stated in the completed cookie information and relevant service settings.

We review retention and delete or anonymise information that is no longer needed. A specific dispute or legal obligation may require relevant records to be preserved for longer; this does not justify keeping unrelated information. Information in backups is retained only for an appropriate recovery period and is protected against ordinary use after it is no longer needed in active systems.

8. Protecting information

We use technical and organisational measures appropriate to the information and risks, including controlling access and working with service providers under suitable safeguards. No internet service can promise absolute security. If a personal-data breach occurs, we will assess it and notify the relevant authority and affected people where the law requires.

Do not send us payment security codes, account passwords or unnecessary sensitive information in an enquiry or return photograph.

9. International processing and automated decisions

We use UK and international service providers. Some information may be processed outside the United Kingdom, including in the European Economic Area and the United States. Where the UK rules on international transfers apply, an appropriate transfer arrangement is required, such as UK adequacy regulations or contractual safeguards with the required assessment of protection.

The providers' published arrangements include:

• Stripe: its privacy notice describes processing in countries including the United States and India, using applicable adequacy arrangements or standard contractual clauses with the UK Addendum where required.
• PayPal: its privacy notice describes international processing, including in the United States. Its published arrangements include binding corporate rules for transfers within its group and other applicable safeguards.
• Google: processes information on a global infrastructure. Its transfer frameworks include the UK Extension to the EU–US Data Privacy Framework for covered US transfers and standard contractual clauses where required.

You can contact us for information about the safeguards applicable to our processing and how to obtain a copy, subject to necessary redactions. A provider's privacy notice also explains its own international processing where it acts as an independent controller.

10. Your rights

Depending on the circumstances and the legal basis involved, you may ask to access and receive a copy of your personal information; correct inaccurate information; delete information; restrict its use; receive certain information in a portable format; or withdraw consent. Some information must be retained for legal obligations or to establish, exercise or defend legal claims, so a request does not always require deletion of all records.

You have an absolute right to stop use of your information for direct marketing, including associated profiling. You may also object to processing based on legitimate interests for reasons relating to your situation. In that case we must stop unless an applicable legal ground allows us to continue.

Contact us using the details in section 1. Requests are normally free. We respond without undue delay, usually within one calendar month. Where the law permits a longer period, or reasonably necessary identity verification or clarification affects the deadline, we will explain this. If we cannot comply fully, we will explain the reason and the routes for challenging our decision. Any fee or refusal is limited to circumstances in which the law permits it.

11. Privacy complaints

You can complain to us by email, telephone or post using the details in section 1. Tell us what concerned you and the outcome you seek; there is no fee or mandatory form. We will acknowledge the complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome and any action taken.

You also have the right to complain to the Information Commissioner's Office (ICO). Visit ico.org.uk/make-a-complaint or call 0303 123 1113. The ICO normally asks that you first give the organisation an opportunity to respond. This does not remove your right to seek independent advice or a legal remedy.

12. Changes to this notice

We may update this notice to reflect changes in our services, practices or the law and will show the current version date. Where a change requires notice or fresh consent, we will provide it before the relevant new use. Updating this page does not itself give us permission to use information for a new purpose.