Privacy Policy

Last updated: 2 November 2026

1. Who is responsible for your data

The School Bag Company is the data controller for the personal data described in this policy. We are a private limited company registered in England & Wales, company number 16051288, registered office Unit 10 Chertsey Business Park, Hanworth Lane, Chertsey, England, KT16 9GJ. We operate the website theschoolbagcompanyuk.com.

For any question about this policy or about your data, email [email protected] or write to us at the registered office address.

2. What we collect

When	What we collect
When you place an order	First and last name, email address, telephone number, delivery address, billing address if different, school or organisation if given, the items ordered, any personalisation text and thread colour, delivery instructions, and your order reference.
When you contact us	Your name, email address, telephone number if given, any order reference and the content of your message.
When you use the site	A session identifier so your basket and favourites persist between pages. See our Cookie Policy.
If you opt in to email	Your email address and the fact that you consented, with a date.
Server logs	Standard web server records including IP address, browser type, pages requested and timestamps, kept for security and diagnostics.

We do not collect or store payment card details on this website. Payment is taken through a secure payment link after your order is confirmed, and card data is handled by the payment provider, not by us.

3. Why we use it, and our lawful basis

Purpose	Lawful basis (UK GDPR Article 6)
To process, confirm, personalise, pack and deliver your order	Performance of a contract
To contact you about your order, including confirming stock and personalisation	Performance of a contract
To handle returns, refunds and warranty claims	Performance of a contract and legal obligation
To keep accounting and VAT records	Legal obligation
To answer an enquiry you send us	Legitimate interests — responding to the people who contact us
To protect the website from misuse and to diagnose faults	Legitimate interests — security and reliability
To send occasional marketing email	Consent, which you may withdraw at any time

4. Marketing

We only send marketing email to people who have opted in — the box at checkout is never pre-ticked. We send at most a few emails a year, about new models and back-to-school stock. Every email carries an unsubscribe link, and you can also unsubscribe at any time by emailing [email protected]. Withdrawing consent does not affect emails about an order you have placed, which we must send in order to fulfil it.

5. Who we share it with

We do not sell your personal data. We share it only with:

• Delivery carriers — your name, delivery address, telephone number, email address and any delivery instructions, so the parcel can be delivered and tracked.
• Our payment provider — the information needed to raise and process a payment link.
• Our hosting and email providers — as processors handling data on our instructions.
• Our accountants and, where required, HMRC — for statutory accounting purposes.
• Law enforcement, regulators or legal advisers — where we are required to do so by law or to establish, exercise or defend legal claims.

Where a processor acts on our behalf, we have a written agreement in place requiring them to protect your data and to use it only for the purposes we specify.

6. International transfers

We aim to keep personal data within the United Kingdom or the European Economic Area. Where a service provider processes data outside those areas, we ensure an appropriate safeguard is in place — an adequacy decision, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep it

Data	Retention period
Order records, including invoices	6 years from the end of the financial year in which the order was placed, to meet accounting and tax obligations
Warranty records	For the length of the warranty plus 1 year
Enquiries that do not become orders	12 months
Marketing consent records	Until you unsubscribe, plus 2 years to evidence the consent
Basket and favourites session data	Deleted when your browsing session ends
Web server logs	Up to 12 months

8. Your rights

Under the UK GDPR you have the right to:

• Be informed about how we use your data — this policy.
• Access a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected.
• Erasure — have data deleted where we no longer have a lawful reason to keep it. We cannot delete records we are legally required to retain, such as invoices.
• Restriction of processing in certain circumstances.
• Data portability — receive data you gave us in a structured, commonly used, machine-readable format.
• Object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email [email protected]. We will respond within one month. We may ask you for information to confirm your identity before acting on a request. Exercising these rights is free of charge.

9. Children's data

This website is intended for adults purchasing on behalf of children. We do not knowingly collect personal data directly from children. Where a personalisation text contains a child's first name, we treat it as part of the order record, use it only to manufacture and identify the bag, and delete it on the retention schedule above.

10. Security

We take appropriate technical and organisational measures to protect personal data, including encrypted connections to this website, access controls on our systems, and limiting access to order data to the people who need it to fulfil orders. No transmission over the internet can be guaranteed completely secure; where we are required to do so, we will notify you and the Information Commissioner's Office of a personal data breach.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at [email protected] so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.

12. Changes to this policy

We review this policy regularly and will update the "last updated" date at the top when it changes. Material changes will be highlighted on this page.