Bag2Charity Privacy Policy

Next Best Clothing Limited (trading as Bag2Charity)

ICO Registration: ZA881745

Last updated: March 2026

Introduction

Next Best Clothing Limited ("we", "us", "our"), trading as Bag2Charity, is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store and protect your personal information when you use our website, booking form, or web app at bag2charity.co.uk.

We are registered with the Information Commissioner's Office (ICO) under registration number ZA881745. This policy applies to all personal data we collect across our brands: Bag2Charity, Bag2School, Green Garments, New Life Garments, and Smart Recycling.

1. Who We Are

Full legal name: Next Best Clothing Limited

Trading name: Bag2Charity

Address: Unit 6-7 Omega Business Village, Thurston Road, Northallerton, North Yorkshire, DL6 2NJ

Email: info@bag2charity.co.uk

Telephone: 01609 780 452

Data requests are handled directly by our management team. We do not have a dedicated Data Protection Officer.

2. Data We Collect

When you use our website or web app, we may collect:

• Full name
• Email address
• Phone number
• Collection address (including postcode and What3Words location)
• Preferred charity
• Collection date
• Notes or directions for our drivers
• Marketing and data-sharing consent preferences
• Account login credentials (email and password, stored securely)
• IP address and basic technical data

3. How We Collect Your Data

We collect your personal data through:

• The Bag2Charity booking form on our website (bag2charity.co.uk)
• The Bag2Charity web app, where you can create an account and manage your collections
• Direct correspondence by phone or email
• Automated technical data collected when you visit our website

4. How We Use Your Data

We use your personal data to:

• Process and manage your collection booking
• Assign and route collections to our drivers
• Send booking confirmations and collection reminders
• Share relevant details with your chosen charity partner (with your consent)
• Manage your web app account
• Respond to enquiries and complaints
• Improve our services

Our legal basis for processing is the performance of a contract (to carry out your collection booking) and, where applicable, your consent (for marketing communications and charity data sharing).

5. Third-Party Data Processing

To deliver our service, your data is processed by a number of trusted third-party providers. All providers are assessed for UK GDPR compliance and are contractually required to handle your data securely. Where providers are based outside the UK or EEA, appropriate safeguards are in place (such as Standard Contractual Clauses or participation in the UK-US Data Bridge).

The categories of third-party processing we use are:

• Secure cloud database and authentication: Your booking data and account details are stored in an encrypted, GDPR-compliant cloud database hosted on infrastructure based in the USA.
• Route planning and driver dispatch: Your name, address, phone number, email, and collection details are shared with our route planning system so that our drivers can locate and complete your collection.
• Form processing: Bookings submitted through our website pass through a secure form processing service before being stored in our systems. Data is in transit only and not stored permanently by this provider.
• Automated workflow processing: We use automation software to route booking data between our internal systems. Data passes through in transit and is not stored permanently.
• Transactional email delivery: Your email address is used by a third-party email delivery provider to send booking confirmations and service notifications on our behalf.
• Web app hosting: Our booking web app is hosted by a cloud hosting provider. Standard technical data such as IP addresses may be logged as part of normal hosting operations.
• Website hosting and content management: Our main website is hosted on a third-party platform which may collect standard technical and analytics data associated with your visit.
• AI chatbot: Our website includes an AI-powered chatbot to assist with enquiries. Any messages sent via the chatbot may be processed by the chatbot provider. Please avoid sharing sensitive personal data through the chatbot.

We do not sell your personal data to any third party.

6. Data Retention

We retain your personal data for the following periods:

• Booking and transaction records: 6 years (in line with the Limitation Act 1980)
• Web app account data: 3 years from last account activity
• Marketing consent records: 3 years from the date consent was given or withdrawn
• Driver routing data: 1 year

After these periods, your data will be securely deleted from our systems. Deletion requests may be fulfilled sooner where there is no legal reason to retain the data.

7. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights:

• Right to access: Request a copy of the personal data we hold about you (Subject Access Request). We will respond within 30 days.
• Right to rectification: Ask us to correct inaccurate or incomplete data.
• Right to erasure: Ask us to delete your personal data where there is no legitimate reason for us to continue holding it.
• Right to restrict processing: Ask us to pause processing your data in certain circumstances.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to us processing your data for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.
• Right to complain: Lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

To exercise any of these rights, please contact us:

Email: info@bag2charity.co.uk

Post: Unit 6-7 Omega Business Village, Thurston Road, Northallerton, North Yorkshire, DL6 2NJ

8. Data Deletion Requests

If you request deletion of your personal data, we will:

• Delete or anonymise your booking records from our database
• Remove your account from the Bag2Charity web app
• Request deletion of your data from our third-party service providers
• Confirm completion of the deletion within 30 days of your request

Please note that we may be required to retain certain records for legal or accounting purposes (e.g. transaction records for up to 6 years). In such cases, we will inform you of what data must be retained and why.

9. Data Security

We take data security seriously. All personal data is encrypted at rest and in transit. Our web app uses secure authentication and all connections are protected by HTTPS. Access to personal data is restricted to authorised personnel only. We have procedures in place to detect and respond to data breaches, and we will notify you and the ICO where legally required.

10. Cookies

Our website uses cookies to improve your browsing experience and to collect anonymous usage data. You can manage your cookie preferences using the cookie consent tool on our website.

11. Children's Privacy

Our services are not intended for children under the age of 13. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us at info@bag2charity.co.uk and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our services or legal requirements. The latest version will always be available at bag2charity.co.uk/privacy-policy. We will notify you of significant changes by email where we hold your contact details.

Next Best Clothing Limited | ICO Registration ZA881745 | info@bag2charity.co.uk | 01609 780 452

‍