Privacy Policy

This notice explains how BackMyTown handles personal data. BackMyTown is operated by BackMyTown Ltd, registered in England and Wales (company number 17360461, registered office 10 Beaufort Close, Reigate, RH2 9DG, United Kingdom). We are the controller of the data described here. Our ICO registration number is ZC206678. Privacy contact: privacy@backmytown.com.

It covers four kinds of people: buyers (households who register and shop, and anyone who asks us to tell them when a shop opens), vendors (the people behind the local businesses), group contacts (the named contacts at the community groups we pay), and visitors to our website, www.backmytown.com, including anyone who uses its form to ask us to bring BackMyTown to their town. Section 8 explains the one case where we handle details about a child, and why the club is in charge of them rather than us.

1. What we collect

• Buyers: name, email, phone number (only if you choose WhatsApp), your chosen community groups (self-declared), order history, delivery or collection details, and your message preferences.

• Vendors: business and contact details, listings and sales records. Identity and bank verification happens at Stripe, not with us. If we agree reservations with a shop on the phone, we also keep the name of the person who agreed, the day, what was agreed and who at BackMyTown recorded it.

• Group contacts: name, role, contact email, and the group's payment records, plus the bank account the group gives us to be paid into (account name, sort code, account number and any building society roll number). We only ask for those when we are ready to pay the group, by a single-use link sent to the group's contact, and they are entered on a BackMyTown page, never on a town's website. They are stored encrypted, only the last two digits of each number are shown on screen, and the full details are opened only by our staff to make the monthly payment, with each opening recorded. Whenever they are set or changed we email the group's contacts, without the numbers, so a change nobody asked for is noticed.

• Website visitors: only if you accept analytics cookies on www.backmytown.com, Google Analytics records the pages you view, how you arrived, and general details of your device, browser and approximate location (see section 7). If you decline, it records nothing.

• People who ask for BackMyTown in their town, using the form on www.backmytown.com: your name and email address, the town and county, how you are involved there, any school, club, business or group you name, what you could help with, and anything you write to us. The form collects nothing else, and nothing you type into it is sent to Google Analytics.

• People who ask to hear when a shop opens: on a town's shop page, a shop that is not taking orders yet offers "Tell me when it opens". If you are signed in, we note your account and the shop, and use your account's email address. If you are not, you give us an email address, we send it one link, and nothing is kept for you unless that link is pressed. Either way we hold which shop, the address (or your account) and when you asked, and nothing else: no name, and nothing about the device you asked from.

• Reservations: a shop that is not taking payments yet may let signed-in households reserve what it has agreed with us to sell. We hold your account, which shop and offers, how many of each, the group whose link you came through (if any), and when we sent you a link to pay and a reminder. Nothing is charged until you pay through that link.

We never collect card numbers. Stripe processes all payments; we never see or store card details.

2. Why we use it, and the legal basis

Public group pages and vendor badges show aggregate totals only; no personal data is published.

3. Your message choices

Every message we send is one of three kinds:

1. Transactional (order confirmations, receipts, payment statements, account and security messages): always sent while you have an account or an open order; part of the service.
2. Operational (useful reminders and service updates): on by default, and every one carries a link that stops them. Today these go to the businesses selling on the platform (reminders to finish setting up, milestones as a shop grows, and an end-of-season summary) and to the named contacts at community groups (milestones, and an invitation to claim a group). We do not currently send buyers any; if that changes, each one will carry the same link. Stopping them never affects the messages in 1 above.
3. Marketing (the weekly featured-offers email and similar): strictly opt-in under the Privacy and Electronic Communications Regulations. Every marketing email has a working unsubscribe. Marketing is email only; we never send marketing over WhatsApp.

For You. The weekly email may start with a few more of the week's offers picked for your household. We pick them from the groups you back, what you have ordered through BackMyTown in the last year, and the offers themselves (when they happen, whether they cost less than usual, how many are left). We never use anything a club asks you when you book a class, and never anything you have ordered from a club. The labels beside each offer only ever describe the offer, never what you bought, so a forwarded email does not reveal it. Every email with For You in it carries a link that turns it off; after that we stop using what you have ordered to choose offers for you, and the rest of the email stays the same. To see whether For You helps, a small share of households, chosen at random, gets the email without it, and we compare how often each group orders. We keep a record of what For You showed you, and which of those two groups you were in.

When a shop opens. If you asked us to tell you when a shop opens, we send you one email when it starts taking orders, and delete your request as we do. It is the only message we send about it, it is not marketing, and it is sent only because you asked. To change your mind before then, write to privacy@backmytown.com and we will delete the request.

Reservations. If you reserve, we email you a receipt; then, when the shop can take payments, one link to pay; and one reminder three days later if you have not paid. If the shop is not ready by the date it agreed, or takes its page down, we tell you your reservation has lapsed. These are about your reservation only and are not marketing. You can change or cancel a reservation on the shop's page until the last day to reserve.

WhatsApp: we do not send WhatsApp messages at present. If we offer it in your town it will be opt-in, for transactional (and, if enabled, operational) messages only, via approved templates, and we will update this notice before we start, including how to stop it. WhatsApp itself is provided by Meta under Meta's terms.

4. Who we share data with

Class sign-up details (section 8) go only to the club whose class you bought a place in, on its own signed-in dashboard. We never send them by email.

• The vendor you buy from: the details needed to fulfil your order. The vendor is its own controller for fulfilment and may not use your details for marketing without consent you give the vendor directly.
• Stripe, the payment processor: handles your payment as a controller in its own right, and runs vendor identity checks.
• Community groups: see aggregate totals only, never who bought what.
• A shop you asked to hear from: sees how many people asked to hear when it opens, never who they are or their addresses.
• A shop you reserved from: sees how many households reserved and how many of each offer, never who. When you pay, it receives your order as it would any order.
• Google, which runs Google Analytics on our website if you accept analytics cookies (see section 7).
• Our service providers (cloud hosting on Microsoft Azure in the UK, website hosting, which also receives what you send with our website's form and emails it to us, email delivery, WhatsApp Business messaging), as processors under contracts that bind them to protect the data.
• Authorities, where the law requires it.

We do not sell personal data. Where a provider processes data outside the UK, we rely on UK adequacy or the UK Addendum to the EU Standard Contractual Clauses; the current provider list is available from privacy@backmytown.com.

5. How long we keep it

• Account data: while your account is active, then deleted or anonymised within 12 months of closure unless the law requires longer.
• Order, fee and payment records: 6 years plus the current year (tax law).
• A group's bank details: while the group is on the platform; replaced when the group gives us new ones, and deleted with the group's record.
• Consent and preference records: while relied on, plus 2 years after an opt-out as evidence of compliance.
• What the weekly email's For You section showed you: 13 months, and deleted with your account.
• Website analytics: kept by Google Analytics for 14 months, then deleted automatically.
• A request to bring BackMyTown to your town: 2 years from the last time we were in touch about it, then deleted. If your town opens and you join it, your account is covered by the rest of this notice.
• A request to hear when a shop opens: deleted as soon as we email you that it has opened, and in any case 6 months after you made it (or confirmed it) if the shop has not opened by then. An address whose link is never pressed is deleted when the link runs out, 7 days after we sent it. A request also goes if you close your account or the shop leaves the platform.
• A reservation: deleted two weeks after we email you the link to pay, or sooner if you cancel it or it lapses. After that we keep only two counts for the shop (how many households were sent a link, and how many paid), with nothing about who. A reservation also goes if you close your account or the shop leaves the platform. The record of a shop's phone agreement is kept while the shop is on the platform.
• Suppression records (so we never contact you after an opt-out or STOP): kept minimally, indefinitely.
• Class sign-up details (section 8): deleted 30 days after the term ends, or 90 days after you book a place that is not a term. If the order is never paid, they are deleted a day after checkout, or as soon after that as we know the payment cannot arrive, and 21 days after checkout at the latest, because some payments, such as a Bacs Direct Debit, take several days to clear. The record that a place was bought is kept with the order.

6. Your rights

You can ask for a copy of your data, have it corrected or erased, restrict or object to processing (including an absolute right to stop direct marketing, and the use of your orders to choose what it shows you), receive your data in portable form, and withdraw consent at any time. Contact privacy@backmytown.com; we respond within one month.

You can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113 (Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF). We would welcome the chance to sort out your concern first, but the right is yours at any time.

7. Cookies and analytics

The platform's own pages use only the cookies needed to run the service (session and security).

Our website, www.backmytown.com, asks before using Google Analytics, and nothing is collected until you accept: until then the site does not even load it. If you accept, Google Analytics sets two cookies (_ga, and _ga_ followed by a code) so it can tell one visit from another, for up to two years, and records which pages are viewed and how people arrive, so we can see what is useful and improve the site. It tells us about visits, not who you are. We never use it for advertising: advertising cookies and signals stay switched off whatever you choose, and Google keeps the data for 14 months. Google provides the service and may also use the data for its own purposes, under its own privacy policy. If you decline, Google Analytics stays off.

You can change your mind at any time with the Cookie settings link at the foot of every page of the website. Choosing Decline there switches analytics off and removes those cookies from your browser. We will not add marketing cookies without updating this notice and asking first.

Town websites that embed BackMyTown (such as investreigate.org) have their own cookie policies for their analytics.

8. Children, and class sign-ups

The platform is for adults (18+), and accounts are only ever for adults. School and club affiliations are recorded against the adult household account, never against a child.

When you buy a place in a club's class, the club may need some details to enrol your child, and we collect them at checkout on the club's behalf. The club is the controller of those details and we are its processor, acting only on its instructions under a data processing agreement every club accepts before it can ask anything. We have no purpose of our own for them.

The club chooses from a short fixed list, and you are only ever asked what that club chose: your child's name; and, if the club asks, their date of birth, your phone number and home address, and an emergency contact number for someone other than you. A club may also offer one box for anything it should know about allergies, medical or additional needs. That box is always optional, and what you write in it goes only to the club. We store it encrypted.

These details are shown only to the club, on its own dashboard. We never put them in an email, never show them to anyone else, and delete them 30 days after the term ends, or 90 days after you book a place that is not a term (section 5). The club keeps its own copy to enrol your child, under its own privacy notice; for questions about that copy, or to ask for details about your child to be seen, corrected or deleted, contact the club, or us at privacy@backmytown.com and we will pass your request on.

9. Changes

Changes will be posted here; material changes will be emailed to account holders before they take effect.