Privacy
Policy.

1.1 Bag Terminal Limited is the data controller for the personal data we process. We're registered in England and Wales and listed with the Information Commissioner's Office (ICO) under reference ZB909829.

1.2 For any privacy-related questions, our contact email is privacy@bagterminal.com.

We only collect what we need to run the service. Depending on how you use Bag Terminal, that includes:

We use your data to:

• set up and run your account, including signing you in
• process bookings and send confirmations
• send one-time login codes (via our email partner)
• take payments through Stripe and issue receipts
• keep the service secure and prevent fraud or abuse
• respond to your messages and provide support
• comply with our legal and tax obligations
• improve the service — for example, fixing bugs and understanding which features are useful

We don't sell your personal data, and we don't use it for automated decision-making that has legal effects on you.

Under UK GDPR, we need a lawful reason for each thing we do with your data. Ours are:

We share limited data with the partners who help us run the service. They're only allowed to use it for the purposes we tell them to, and they're bound by contract to keep it confidential and secure:

We may also disclose data if we're legally required to — for example, in response to a valid request from a regulator, court, or law enforcement.

6.1 We use a small number of cookies and similar storage to keep you signed in, remember your theme preference, and understand how the site is used.

6.2 You can clear or block cookies through your browser settings, but doing so may break parts of the site that rely on essential cookies.

Our infrastructure is primarily based in the UK, but some of our partners (such as Google and Stripe) operate globally and may process your data in other countries. When that happens, we rely on safeguards such as the UK International Data Transfer Agreement or adequacy decisions to keep your data protected.

Under UK GDPR, you have the right to:

• access a copy of the personal data we hold about you
• ask us to correct anything that's inaccurate
• ask us to delete your data ('right to be forgotten')
• ask us to restrict how we use it
• object to certain uses, such as marketing
• receive your data in a portable format
• withdraw consent at any time, where consent is the legal basis

To exercise any of these, just email privacy@bagterminal.com. We'll respond within one month. We may need to verify your identity first to make sure we're sending data to the right person.

You can delete your account at any time from your profile page. When you do, we put your account on hold for 14 days before anything is permanently removed.

Changed your mind? Just sign back in within those 14 days and your account will be restored exactly as it was — no action needed beyond signing in.

After 14 days, we permanently delete:

• your account profile (name, email, phone, photo)
• your sign-in credentials
• any preferences or settings tied to your account

We anonymise — but keep — your past booking records (booking reference, locker, dates, amount paid, receipt number). Your name and email are stripped and replaced with [deleted user]. We're required to keep these for accounting, tax, and dispute resolution purposes (see Section 8 for retention periods).

If you'd prefer immediate deletion or have a more specific request (e.g. erasing email evidence held by our email provider), email privacy@bagterminal.com and we'll handle it manually within one month.

We take security seriously. Some of the things we do:

• encrypt data in transit (HTTPS) and at rest
• limit access to personal data to people who need it
• store login credentials hashed, never as plain text
• monitor for suspicious activity and rate-limit sensitive endpoints
• review our security practices regularly

No system is perfectly secure — but if a breach happens that affects your rights or freedoms, we'll notify you and the ICO as required by law.

Bag Terminal isn't intended for under-16s. We don't knowingly collect data from children. If you think a child has signed up, contact us and we'll delete the account.

We may update this policy as the service evolves. If the changes are material, we'll let registered customers know by email or post a notice on bagterminal.com. The “Last updated” date at the top of this page always shows when it last changed.

Questions, requests, or concerns? Email us at privacy@bagterminal.com.

If you're not happy with how we've handled your data, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk. We'd appreciate the chance to put things right first, though, so please get in touch with us before going there.