Legal

Privacy Notice

Last updated: 16 July 2026

This notice explains how Bookbag handles personal data collected from visitors to bookbagmedia.com, from users of the Bookbag platform, and from anyone who contacts us. It is written to satisfy Article 13 of the UK GDPR.

1. Who we are

Bookbag Media Ltd (referred to as "Bookbag", "we", "us") is the data controller for the information described in this notice. You can reach us by email at hello@bookbagmedia.com for any question about how we handle your data.

We are in the process of registering with the UK Information Commissioner's Office (ICO). Our ICO registration number will be added here once issued.

2. What data we collect and why

Enquiry and register-interest forms

When you fill in the contact form or one of the register-interest forms we collect your first name, last name, email address, organisation, and any optional fields you choose to complete (role, message, telephone). We use this to respond to your enquiry and, if you tick the marketing consent box, to send you occasional updates about Bookbag.

Accounts on the Bookbag platform

When a school or brand joins the platform we hold the account holder's name, email address, role or job title, and their organisation's details (school region, MAT membership, or brand information). This is used to run the platform: authenticating you, showing you the right campaigns, and processing payments where applicable.

We do not collect data about individual children. The activity sheets are anonymous — schools are the data controller for their pupils, and Bookbag never sees a child's name, class, or any other identifying information.

Site analytics and error reporting

On the public marketing pages we record Core Web Vitals performance metrics via Vercel Speed Insights, and aggregate page views via Plausible Analytics. Neither sets cookies or a cross-visit identifier. Plausible's design keeps this true even as its dashboard shows referrers and top pages — details at plausible.io/data-policy.

If you consent to the analytics cookie category, we additionally load Google Tag Manager, which sets a first-party bootstrap cookie (_gcl_au). The container is currently empty of tags that build advertising profiles.

Inside the signed-in Bookbag platform at /app we record uncaught runtime errors via Sentry so we can fix issues that affect your account. These may include your IP address (used only to correlate errors and mitigate abuse) and technical browser information. Session replay is disabled. We do not build advertising profiles.

See section 9 below for the full inventory of cookies and browser storage.

3. Lawful basis for processing

Under Article 6 of the UK GDPR, our lawful bases are:

• Legitimate interests (Art 6(1)(f)) — responding to enquiries you send us, running the Bookbag platform, keeping it secure and reliable, and understanding how the site is used. You can object to processing on this basis at any time.
• Consent (Art 6(1)(a)) — sending you marketing emails about Bookbag news and product updates. Only applies where you have ticked the marketing consent box. You can withdraw consent at any time.
• Contract (Art 6(1)(b)) — where processing is necessary to deliver a campaign or process payment you have agreed to.
• Legal obligation (Art 6(1)(c)) — where we are required to retain records for tax, accounting, or compliance reasons (typically 7 years for HMRC).

4. Who else processes your data

To run the platform we share your data with a small set of trusted processors. Each is under a Data Processing Agreement and only handles your data on our instructions:

• Supabase — database, authentication, and file storage (Ireland region).
• Vercel — hosting and serverless functions.
• Plausible Analytics — cookieless aggregate page-view metrics on the marketing site.
• Resend — transactional and marketing email delivery.
• Stripe — payment processing for brand campaigns.
• Upstash — rate limiting and anti-abuse counters.
• Sentry — error reporting and observability.
• Slack — internal notification of new enquiries.
• Google Cloud Storage — backup mirror of user-uploaded content.
• The print partner — receives school delivery addresses to fulfil campaigns. Governed by a signed Data Processing Agreement.

5. International transfers

Some of our processors are headquartered outside the UK / EEA. Where data leaves the UK we rely on the UK International Data Transfer Agreement (IDTA) or the European Commission's Standard Contractual Clauses (SCCs), and we choose processors that are certified under the EU-US Data Privacy Framework where relevant. If you would like the specific safeguards applying to any transfer, email hello@bookbagmedia.com.

6. How long we keep your data

• Enquiry and register-interest submissions — 2 years from the date you submitted, unless you become a customer (in which case retained for the life of the account) or you ask us to erase them earlier.
• Account data — for the life of your account, then archived per the retention rules below.
• Payment records — 7 years to comply with HMRC record-keeping requirements.
• Audit logs — 2 years, then automatically deleted.
• Fulfilment-proof images — 12 months from campaign completion.

7. Your rights

You have the following rights under the UK GDPR:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your data. We may still keep payment records where the law requires it.
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability — receive the data you gave us in a machine-readable format.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — where processing relies on consent (e.g. marketing emails), you can withdraw it at any time by clicking Unsubscribe in the email or writing to us.

To exercise any of these, email hello@bookbagmedia.com. We aim to respond within one calendar month.

8. Complaints

If you believe we have mishandled your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint.

9. Cookies and local storage

Bookbag follows the Privacy and Electronic Communications Regulations 2003 (PECR). Strictly-necessary items are set without asking; everything else is set only if you opt in via the cookie banner or the cookie preferences page.

On the public marketing pages: the only strictly-necessary write is the bookbag-consent cookie that stores your consent choice, plus (during the closed trials period) the bookbag-auth session cookie set when you enter the site password. Vercel Speed Insights sends anonymous performance beacons — no cookies, no cross-visit identifier.

Inside the signed-in Bookbag platform we store: your Supabase authentication session, the brand you are currently acting as (if you operate multiple brands), and any in-progress campaign draft the wizard has saved. Each item is necessary to run the service you signed in for.

Optional categories: analytics (Google Tag Manager and whatever it loads — currently only anonymous page-view metrics) and marketing (advertising / conversion pixels — none active today). Neither category is set unless you tick it on the banner or the preferences page. Full inventory at /cookies.

10. Changes to this notice

We may update this notice from time to time. Material changes will be flagged on the homepage and, where the change affects a specific processing activity you take part in, communicated to you directly. The "Last updated" date at the top of this page always reflects the current version.