This notice explains how BackMyTown handles personal data. BackMyTown is operated by BackMyTown Ltd, registered in England and Wales (company number 17360461, registered office 10 Beaufort Close, Reigate, RH2 9DG, United Kingdom). We are the controller of the data described here. Our ICO registration number is ZC206678. Privacy contact: privacy@backmytown.com.
It covers four kinds of people: buyers (households who register and shop), vendors (the people behind the local businesses), group contacts (the named contacts at the community groups we pay), and visitors to our website, www.backmytown.com.
1. What we collect
- Buyers: name, email, phone number (only if you choose WhatsApp), your chosen community groups (self-declared), order history, delivery or collection details, and your message preferences.
- Vendors: business and contact details, listings and sales records. Identity and bank verification happens at Stripe, not with us.
- Group contacts: name, role, contact email, and the group's payment records. Group bank details are deliberately kept out of the platform; they are held as a payee in our banking for the monthly payment run.
- Website visitors: only if you accept analytics cookies on www.backmytown.com, Google Analytics records the pages you view, how you arrived, and general details of your device, browser and approximate location (see section 7). If you decline, it records nothing.
We never collect card numbers. Stripe processes all payments; we never see or store card details.
2. Why we use it, and the legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Run your account, process orders, send order and payment confirmations | Contract |
| Pass your order details to the vendor so it can fulfil your order | Contract |
| Work out and pay each group's share; send payment statements | Contract with the group; our legitimate interest in running the scheme |
| Optional service updates (on by default, easy to turn off) | Legitimate interests |
| The weekly featured-offers email and other marketing | Your consent |
| Measuring how our website is used, if you accept analytics cookies | Your consent |
| Preventing fraud, keeping the service secure, enforcing our terms | Legitimate interests |
| Tax, accounting and other legal duties | Legal obligation |
Public group pages and vendor badges show aggregate totals only; no personal data is published.
3. Your message choices
Every message we send is one of three kinds:
- Transactional (order confirmations, receipts, payment statements, account and security messages): always sent while you have an account or an open order; part of the service.
- Operational (useful reminders and service updates): on by default, and every one carries a link that stops them. Today these go to the businesses selling on the platform (reminders to finish setting up, milestones as a shop grows, and an end-of-season summary) and to the named contacts at community groups (milestones, and an invitation to claim a group). We do not currently send buyers any; if that changes, each one will carry the same link. Stopping them never affects the messages in 1 above.
- Marketing (the weekly featured-offers email and similar): strictly opt-in under the Privacy and Electronic Communications Regulations. Every marketing email has a working unsubscribe. Marketing is email only; we never send marketing over WhatsApp.
WhatsApp: we do not send WhatsApp messages at present. If we offer it in your town it will be opt-in, for transactional (and, if enabled, operational) messages only, via approved templates, and we will update this notice before we start, including how to stop it. WhatsApp itself is provided by Meta under Meta's terms.
4. Who we share data with
- The vendor you buy from: the details needed to fulfil your order. The vendor is its own controller for fulfilment and may not use your details for marketing without consent you give the vendor directly.
- Stripe, the payment processor: handles your payment as a controller in its own right, and runs vendor identity checks.
- Community groups: see aggregate totals only, never who bought what.
- Google, which runs Google Analytics on our website if you accept analytics cookies (see section 7).
- Our service providers (cloud hosting on Microsoft Azure in the UK, website hosting, email delivery, WhatsApp Business messaging), as processors under contracts that bind them to protect the data.
- Authorities, where the law requires it.
We do not sell personal data. Where a provider processes data outside the UK, we rely on UK adequacy or the UK Addendum to the EU Standard Contractual Clauses; the current provider list is available from privacy@backmytown.com.
5. How long we keep it
- Account data: while your account is active, then deleted or anonymised within 12 months of closure unless the law requires longer.
- Order, fee and payment records: 6 years plus the current year (tax law).
- Consent and preference records: while relied on, plus 2 years after an opt-out as evidence of compliance.
- Website analytics: kept by Google Analytics for 14 months, then deleted automatically.
- Suppression records (so we never contact you after an opt-out or STOP): kept minimally, indefinitely.
6. Your rights
You can ask for a copy of your data, have it corrected or erased, restrict or object to processing (including an absolute right to stop direct marketing), receive your data in portable form, and withdraw consent at any time. Contact privacy@backmytown.com; we respond within one month.
You can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113 (Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF). We would welcome the chance to sort out your concern first, but the right is yours at any time.
7. Cookies and analytics
The platform's own pages use only the cookies needed to run the service (session and security).
Our website, www.backmytown.com, asks before using Google Analytics, and
nothing is collected until you accept: until then the site does not even
load it. If you accept, Google Analytics sets two cookies (_ga, and _ga_
followed by a code) so it can tell one visit from another, for up to two
years, and records which pages are viewed and how people arrive, so we can
see what is useful and improve the site. It tells us about visits, not who
you are. We never use it for advertising: advertising cookies and signals
stay switched off whatever you choose, and Google keeps the data for 14
months. Google provides the service and may also use the data for its own
purposes, under its own privacy policy.
If you decline, Google Analytics stays off.
You can change your mind at any time with the Cookie settings link at the foot of every page of the website. Choosing Decline there switches analytics off and removes those cookies from your browser. We will not add marketing cookies without updating this notice and asking first.
Town websites that embed BackMyTown (such as investreigate.org) have their own cookie policies for their analytics.
8. Children
The platform is for adults (18+). School and club affiliations are recorded against the adult household account, never against a child, and we do not knowingly collect children's data.
9. Changes
Changes will be posted here; material changes will be emailed to account holders before they take effect.