Privacy policy

Privacy Policy

Last updated: October 2026

This policy explains how MYBAG GROUP LTD, trading as MyBag ("we", "us", "our") collects and uses your personal information when you visit mybag.com, buy from us, or get in touch. We are the "data controller" of your personal information. Our registered office is 55 Loudoun Road, London, NW8 0DL. You can contact us about anything in this policy using the form on our Contact Us page.

1. What information we collect

Information you give us: your name, email address, delivery and billing addresses, phone number (if you give one), order details, account details, and anything you tell us when you contact us.
Payment information: payments are processed securely by our payment providers. We do not see or store your full card details.
Information collected automatically: your IP address, device and browser type, pages visited and how you use the Site, collected using cookies and similar technologies (see our Cookie Policy).
Marketing information: whether you have subscribed to our emails, and how you interact with them.

2. How and why we use your information

What we do	Why we are allowed to (legal basis)
Take and process your orders, arrange delivery, process payments and returns, and tell you about your order	To perform our contract with you
Respond to your messages and deal with complaints	To perform our contract with you, and our legitimate interest in providing good customer service
Prevent fraud and keep the Site secure	Our legitimate interest in protecting our business and customers, and legal obligations
Keep records for accounting and tax	Legal obligation
Send you marketing emails about new arrivals, offers and news	Your consent, or, for existing customers, our legitimate interest in marketing similar products (you can opt out at any time)
Understand how the Site is used, so we can improve it	Your consent for non-essential cookies; our legitimate interest for essential ones

3. Marketing emails

We use Klaviyo to send marketing emails, and we may also send emails through Shopify. We will only send you marketing emails if you have signed up, or if you have bought from us before and we are contacting you about similar products. Every marketing email contains an unsubscribe link. You can also ask us to stop at any time using our contact form. We will still send you service messages about orders you have placed.

Some of our customers first joined the MyBag mailing list when the MyBag website was run by a previous owner. We only email people from that list where we are lawfully able to do so, and we always give you an easy way to opt out.

4. Who we share your information with

We do not sell your personal information. We share it only with organisations that help us run the business, and only as far as they need it, including:

Shopify, which hosts the Site and processes orders and payments;
Payment providers, to take payment securely;
Delivery and fulfilment partners, to pick, pack and deliver your order;
ZigZag, our returns portal provider;
Klaviyo, our email marketing provider;
our professional advisers, and public authorities where the law requires.

If we add other tools, such as analytics or advertising services, we will update this policy and our Cookie Policy.

5. Transfers outside the UK

Some of the organisations above are based outside the UK, including in the USA. Where this happens we make sure your information is protected, for example by using approved contractual safeguards or relying on UK-approved data transfer arrangements.

6. How long we keep your information

We keep order and accounting records for as long as the law requires (normally six years). We keep marketing information until you unsubscribe or ask us to delete it. We keep customer service messages for as long as needed to deal with your query and any follow-up. We delete or anonymise other information when we no longer need it.

7. Your rights

Under UK data protection law you have the right to: be told how your information is used; access a copy of your information; have inaccurate information corrected; ask us to delete your information; restrict or object to our use of it; receive your information in a portable format; and withdraw your consent at any time where we rely on it. To use any of these rights, contact us using our contact form. We may need to verify your identity first. We will normally respond within one month.

8. Complaints

If you are unhappy with how we have used your information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Security

We use appropriate technical and organisational measures to protect your information. No online service can be completely secure, so please take care with your account details.