This notice explains how BackMyTown handles personal data. BackMyTown is operated by BackMyTown Ltd, registered in England and Wales (company number 17360461, registered office 10 Beaufort Close, Reigate, RH2 9DG, United Kingdom). We are the controller of the data described here. Our ICO registration number is [ICO REGISTRATION NUMBER]. Privacy contact: privacy@backmytown.com.
It covers three kinds of people: buyers (households who register and shop), vendors (the people behind the local businesses), and group contacts (the named contacts at the community groups we pay).
1. What we collect
- Buyers: name, email, phone number (only if you choose WhatsApp), your chosen community groups (self-declared), order history, delivery or collection details, and your message preferences.
- Vendors: business and contact details, listings and sales records. Identity and bank verification happens at Stripe, not with us.
- Group contacts: name, role, contact email, and the group's payment records. Group bank details are deliberately kept out of the platform; they are held as a payee in our banking for the monthly payment run.
We never collect card numbers. Stripe processes all payments; we never see or store card details.
2. Why we use it, and the legal basis
| What we do | Legal basis (UK GDPR) |
|---|---|
| Run your account, process orders, send order and payment confirmations | Contract |
| Pass your order details to the vendor so it can fulfil your order | Contract |
| Work out and pay each group's share; send payment statements | Contract with the group; our legitimate interest in running the scheme |
| Optional service updates (on by default, easy to turn off) | Legitimate interests |
| The weekly featured-offers email and other marketing | Your consent |
| Preventing fraud, keeping the service secure, enforcing our terms | Legitimate interests |
| Tax, accounting and other legal duties | Legal obligation |
Public group pages and vendor badges show aggregate totals only; no personal data is published.
3. Your message choices
Every message we send is one of three kinds:
- Transactional (order confirmations, receipts, payment statements, account and security messages): always sent while you have an account or an open order; part of the service.
- Operational (useful reminders and service updates): on by default, turn them off any time in settings or via the link in the message.
- Marketing (the weekly featured-offers email and similar): strictly opt-in under the Privacy and Electronic Communications Regulations. Every marketing email has a working unsubscribe. Marketing is email only; we never send marketing over WhatsApp.
WhatsApp: if you opt in, we use it for transactional (and, if enabled, operational) messages only, via approved templates. Reply STOP to any message and we stop using WhatsApp for that number; transactional messages switch to email. WhatsApp itself is provided by Meta under Meta's terms.
4. Who we share data with
- The vendor you buy from: the details needed to fulfil your order. The vendor is its own controller for fulfilment and may not use your details for marketing without consent you give the vendor directly.
- Stripe, the payment processor: handles your payment as a controller in its own right, and runs vendor identity checks.
- Community groups: see aggregate totals only, never who bought what.
- Our service providers (cloud hosting on Microsoft Azure in the UK, email delivery, WhatsApp Business messaging), as processors under contracts that bind them to protect the data.
- Authorities, where the law requires it.
We do not sell personal data. Where a provider processes data outside the UK, we rely on UK adequacy or the UK Addendum to the EU Standard Contractual Clauses; the current provider list is available from privacy@backmytown.com.
5. How long we keep it
- Account data: while your account is active, then deleted or anonymised within 12 months of closure unless the law requires longer.
- Order, fee and payment records: 6 years plus the current year (tax law).
- Consent and preference records: while relied on, plus 2 years after an opt-out as evidence of compliance.
- Suppression records (so we never contact you after an opt-out or STOP): kept minimally, indefinitely.
6. Your rights
You can ask for a copy of your data, have it corrected or erased, restrict or object to processing (including an absolute right to stop direct marketing), receive your data in portable form, and withdraw consent at any time. Contact privacy@backmytown.com; we respond within one month.
You can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113 (Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF). We would welcome the chance to sort out your concern first, but the right is yours at any time.
7. Cookies
The platform's own pages use only the cookies needed to run the service (session and security). Town websites that embed BackMyTown (such as investreigate.org) have their own cookie policies for their analytics. If we ever add analytics or marketing cookies to platform pages, we will update this notice and ask first.
8. Children
The platform is for adults (18+). School and club affiliations are recorded against the adult household account, never against a child, and we do not knowingly collect children's data.
9. Changes
Changes will be posted here; material changes will be emailed to account holders before they take effect.