Legal

Privacy Notice

Last updated: 16 July 2026

This notice explains how Bookbag handles personal data collected from visitors to bookbagmedia.com, from users of the Bookbag platform, and from anyone who contacts us. It is written to satisfy Article 13 of the UK GDPR.

1. Who we are

Bookbag Media Ltd (referred to as "Bookbag", "we", "us") is the data controller for the information described in this notice. You can reach us by email at hello@bookbagmedia.com for any question about how we handle your data.

We are in the process of registering with the UK Information Commissioner's Office (ICO). Our ICO registration number will be added here once issued.

2. What data we collect and why

Enquiry and register-interest forms

When you fill in the contact form or one of the register-interest forms we collect your first name, last name, email address, organisation, and any optional fields you choose to complete (role, message, telephone). We use this to respond to your enquiry and, if you tick the marketing consent box, to send you occasional updates about Bookbag.

Accounts on the Bookbag platform

When a school or brand joins the platform we hold the account holder's name, email address, role or job title, and their organisation's details (school region, MAT membership, or brand information). This is used to run the platform: authenticating you, showing you the right campaigns, and processing payments where applicable.

We do not collect data about individual children. The activity sheets are anonymous — schools are the data controller for their pupils, and Bookbag never sees a child's name, class, or any other identifying information.

Site analytics and error reporting

We record aggregate site-performance metrics and error diagnostics via Vercel Speed Insights and Sentry. These may include your IP address (used only to correlate errors and mitigate abuse) and technical browser information. We do not build advertising profiles.

3. Lawful basis for processing

Under Article 6 of the UK GDPR, our lawful bases are:

• Legitimate interests (Art 6(1)(f)) — responding to enquiries you send us, running the Bookbag platform, keeping it secure and reliable, and understanding how the site is used. You can object to processing on this basis at any time.
• Consent (Art 6(1)(a)) — sending you marketing emails about Bookbag news and product updates. Only applies where you have ticked the marketing consent box. You can withdraw consent at any time.
• Contract (Art 6(1)(b)) — where processing is necessary to deliver a campaign or process payment you have agreed to.
• Legal obligation (Art 6(1)(c)) — where we are required to retain records for tax, accounting, or compliance reasons (typically 7 years for HMRC).

4. Who else processes your data

To run the platform we share your data with a small set of trusted processors. Each is under a Data Processing Agreement and only handles your data on our instructions:

• Supabase — database, authentication, and file storage (Ireland region).
• Vercel — hosting and serverless functions.
• Resend — transactional and marketing email delivery.
• Stripe — payment processing for brand campaigns.
• Upstash — rate limiting and anti-abuse counters.
• Sentry — error reporting and observability.
• Slack — internal notification of new enquiries.
• Google Cloud Storage — backup mirror of user-uploaded content.
• The print partner — receives school delivery addresses to fulfil campaigns. Governed by a signed Data Processing Agreement.

5. International transfers

Some of our processors are headquartered outside the UK / EEA. Where data leaves the UK we rely on the UK International Data Transfer Agreement (IDTA) or the European Commission's Standard Contractual Clauses (SCCs), and we choose processors that are certified under the EU-US Data Privacy Framework where relevant. If you would like the specific safeguards applying to any transfer, email hello@bookbagmedia.com.

6. How long we keep your data

• Enquiry and register-interest submissions — 2 years from the date you submitted, unless you become a customer (in which case retained for the life of the account) or you ask us to erase them earlier.
• Account data — for the life of your account, then archived per the retention rules below.
• Payment records — 7 years to comply with HMRC record-keeping requirements.
• Audit logs — 2 years, then automatically deleted.
• Fulfilment-proof images — 12 months from campaign completion.

7. Your rights

You have the following rights under the UK GDPR:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct data that is inaccurate or incomplete.
• Erasure — ask us to delete your data. We may still keep payment records where the law requires it.
• Restriction — ask us to pause processing while a dispute is resolved.
• Portability — receive the data you gave us in a machine-readable format.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Withdraw consent — where processing relies on consent (e.g. marketing emails), you can withdraw it at any time by clicking Unsubscribe in the email or writing to us.

To exercise any of these, email hello@bookbagmedia.com. We aim to respond within one calendar month.

8. Complaints

If you believe we have mishandled your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint.

9. Cookies and local storage

Bookbag uses only strictly-necessary cookies and browser storage. That currently means: your Supabase authentication session (when you are signed in), site-preview cookies during the closed-trial period, and short-lived state used by the campaign wizard. We do not use third-party advertising, tracking, or analytics cookies. When we introduce any non-essential cookies we will publish a cookie policy and add a consent banner.

10. Changes to this notice

We may update this notice from time to time. Material changes will be flagged on the homepage and, where the change affects a specific processing activity you take part in, communicated to you directly. The "Last updated" date at the top of this page always reflects the current version.