Privacy policy
This policy explains what personal data Madrasah Bag collects, why, and your rights. Madrasah Bag is a small UK business run by an individual, who is the data controller. Contact: [email protected].
What we collect
| When | What |
|---|---|
| You register your interest in the bag (the sign-up form while the bag is not on sale) | Email; optionally your first name and which colour interests you |
| You use the contact form | Name, email, topic, message |
| You place an order | Name, delivery and billing address, email, phone (for the courier), order details. Card details are handled by our payment provider and never reach us. |
| You visit the site | Our host's standard server logs (IP address, browser, pages requested) for security and troubleshooting |
| You accept optional cookies | Anonymous usage statistics, only if we switch analytics on. See the cookie policy. |
Why we use it, and the legal basis
- Emailing you when the bag is available (the interest list): your consent, given when you submit the form. Withdraw it any time using the unsubscribe link or by emailing us.
- Deciding what to make (colours, sizes, where to ship): our legitimate interests, looking at answers in aggregate.
- Replying to messages: legitimate interests.
- Making and delivering your order, returns and repairs: performance of a contract.
- Keeping order and tax records: legal obligation.
- Site security (server logs, spam protection): legitimate interests.
Who we share it with
- Brevo (Sendinblue SAS, France): sends order and service emails, and stores the interest list (your email, and your name and colour choice if you gave them)
- Our web host (UK): hosts the site and keeps order records outside the public website
- Stripe, our payment provider (card details go straight to Stripe), the courier delivering your order, and our leather workshop (name and delivery details only, if they ship directly)
- Authorities, if the law requires it
We never sell your data or share it with others for their marketing.
International transfers
Brevo processes data in the EU, which the UK recognises as providing adequate protection. If any provider transfers data elsewhere, we rely on approved safeguards such as the UK International Data Transfer Addendum.
How long we keep it
- Interest list: until you unsubscribe, or 24 months after you register if we have not emailed you about the bag by then. A copy is also kept in a private file on our host, deleted on the same schedule
- Contact messages: 12 months
- Orders: 6 years after the end of the tax year, as UK tax law requires
- Server logs: as set by our host, typically up to 90 days
Your rights
Under UK GDPR you can ask for a copy of your data, and ask us to correct it, delete it, restrict or object to its use, or transfer it. Email [email protected]. We'll reply within one month. You can also complain to the Information Commissioner's Office.
Children
Our bags are for children and adults, but the shop is for adults. If you're under 18, ask a parent or guardian to order for you.
Changes
We'll update this page if anything changes, with the date at the top.