GDPR Policy
This GDPR Policy explains how BAGS & BOARDS, LLC, operating under the store name BagsBoards ("BagsBoards", "we", "us", or "our"), processes personal information where the United Kingdom General Data Protection Regulation ("UK GDPR"), the European Union General Data Protection Regulation ("EU GDPR"), or another applicable data-protection law applies.
This GDPR Policy supplements our Privacy Policy and Cookie Policy. Those policies provide additional information about our general privacy practices and use of cookies and similar technologies.
1. Scope of This GDPR Policy
This GDPR Policy applies when BagsBoards processes personal information in circumstances governed by the UK GDPR, EU GDPR, or another law providing comparable data-protection rights.
The UK GDPR may apply where BagsBoards offers products or services to individuals in the United Kingdom or otherwise carries out processing within its territorial scope.
The EU GDPR applies only where our activities fall within its territorial scope, including where we intentionally offer products or services to individuals in the European Economic Area or monitor their behaviour in a manner covered by applicable law.
References to "you" or "your" mean the customer, website visitor, or other individual whose personal information is processed.
2. Data Controller
For personal information processed through BagsBoards for our own business purposes, the controller is:
BAGS & BOARDS, LLC
Store name: BagsBoards
Website: bagsboards.shop
Address: 1201 Elegance Ct., Orlando, FL 32828, United States
Email: contact@bagsboards.shop
Phone: +19549001988
BAGS & BOARDS, LLC determines the purposes and means of the processing described in this GDPR Policy, except where an independent provider acts as a separate controller under its own privacy information.
3. Representatives and Data-Protection Contacts
BAGS & BOARDS, LLC is established in the United States.
Where applicable law requires BagsBoards to appoint a representative in the United Kingdom or European Economic Area, the representative’s identity and contact details will be published in this GDPR Policy, our Privacy Policy, or another easily accessible part of the website.
A representative does not replace the responsibility of BAGS & BOARDS, LLC for compliance with applicable data-protection law.
Privacy questions and requests may always be submitted directly to BAGS & BOARDS, LLC using the contact information provided in Section 19.
Where appointment of a Data Protection Officer is legally required, the applicable contact information will also be published through the website. General privacy requests should currently be directed to our customer-support contact.
4. Personal Information We Process
The personal information we process depends on how you interact with BagsBoards.
4.1 Contact and Identity Information
This may include:
• Full name.
• Email address.
• Telephone number.
• Billing address.
• Shipping address.
• Country or region.
• Information used to verify a privacy request.
4.2 Order and Transaction Information
This may include:
• Products viewed, ordered, purchased, returned, or exchanged.
• Order number and order status.
• Billing and delivery details.
• Transaction date, amount, and currency.
• Payment confirmation and payment-method type.
• Shipping and tracking information.
• Cancellation, return, exchange, and refund information.
• Communications relating to an order.
Complete payment-card details are entered through secure checkout and processed by Shopify and authorized payment-service providers. BagsBoards does not need customers to send complete payment-card information directly to us.
4.3 Customer-Account Information
Where customer-account features are available and used, this may include:
• Account name.
• Email address.
• Login and authentication information.
• Saved addresses.
• Order history.
• Account and communication preferences.
4.4 Customer-Support and Submitted Information
This may include information provided when you:
• Contact customer support.
• Submit a contact form.
• Ask a product or order question.
• Request a cancellation, return, exchange, or refund.
• Report an issue with an order.
• Submit photographs or documents in support of a request.
• Provide feedback, a review, or another communication.
Please do not submit unnecessary payment, authentication, health, biometric, or other sensitive information through customer-support channels.
4.5 Device, Usage, and Cookie Information
When you use the website, BagsBoards, Shopify, or enabled service providers may process:
• IP address.
• Browser type and version.
• Device type.
• Operating system.
• Language and regional settings.
• Approximate location derived from technical information.
• Referring and exit pages.
• Pages, products, and collections viewed.
• Dates and times of access.
• Shopping-cart and checkout interactions.
• Cookie identifiers.
• Privacy and Cookie preferences.
• Website-performance, error, fraud, and security information.
Further information is available in our Cookie Policy.
4.6 Marketing Information
Where marketing features are enabled, we may process:
• Marketing subscription status.
• Email or text-message preferences.
• Cookie and advertising preferences.
• Interactions with marketing communications.
• Records of consent, refusal, or withdrawal of consent.
• Advertising or campaign attribution information where permitted.
5. Special-Category and Sensitive Information
BagsBoards does not intentionally request special-category personal information, such as information concerning health, racial or ethnic origin, religious beliefs, political opinions, trade-union membership, genetics, biometrics used for identification, sex life, or sexual orientation.
Please do not submit special-category information unless it is genuinely necessary for a specific request and we have clearly explained why it is required.
Where BagsBoards processes special-category or other sensitive information, we will identify an applicable legal basis and any additional condition required by law.
Payment information, account credentials, and identity-verification information will be handled only to the extent reasonably necessary for payment, security, fraud prevention, account access, or completion of an applicable request.
6. How We Obtain Personal Information
We may obtain personal information:
• Directly from you when you browse the website, place an order, create an account, contact us, submit information, or exercise a privacy right.
• Automatically through Cookies, logs, pixels, and similar technologies.
• From Shopify, which hosts and supports the online store.
• From payment providers that supply payment authorization, transaction-status, and fraud-prevention information.
• From shipping and fulfilment providers that supply delivery, tracking, and address-status information.
• From customer-support, security, analytics, or technical providers where their services are enabled.
• From advertising or marketing providers where their tools are enabled and the processing is permitted by applicable law.
• From public authorities, professional advisers, or other lawful sources where necessary.
7. Purposes and Lawful Bases for Processing
We process personal information only where an applicable lawful basis is available.
7.1 Performance of a Contract
We may process personal information where necessary to:
• Take steps requested before a purchase.
• Accept, confirm, and fulfil an order.
• Process or confirm a payment.
• Arrange shipping and delivery.
• Provide order and tracking updates.
• Provide customer-account features.
• Process cancellations, returns, exchanges, and refunds.
• Communicate about a transaction or customer request.
7.2 Legal Obligations
We may process personal information where necessary to:
• Maintain legally required accounting, tax, payment, and transaction records.
• Comply with consumer-protection requirements.
• Respond to valid court orders, regulatory requests, or other legal processes.
• Meet fraud-prevention, security, sanctions, or reporting obligations where applicable.
• Comply with other applicable laws and regulations.
7.3 Legitimate Interests
We may process personal information where necessary for legitimate business interests, provided those interests are not overridden by your rights and freedoms.
These interests may include:
• Operating and maintaining the website.
• Providing effective customer support.
• Protecting customers, transactions, accounts, and the website.
• Detecting and preventing fraud, misuse, or unlawful activity.
• Understanding and improving website performance.
• Managing orders and business records.
• Improving products, services, navigation, and customer experience.
• Establishing, exercising, or defending legal claims.
• Managing business operations and service-provider relationships.
Where required, we assess the purpose, necessity, and impact of processing based on legitimate interests.
7.4 Consent
Where required by law, we may rely on consent to:
• Use non-essential analytics Cookies.
• Use advertising or marketing Cookies.
• Send certain promotional communications.
• Process information for another purpose clearly explained when consent is requested.
You may withdraw consent at any time through the available preference controls or by contacting BagsBoards.
Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.
7.5 Other Lawful Bases
In limited circumstances, another lawful basis recognized by applicable law may apply, such as protection of vital interests.
We will not rely on another basis unless it is appropriate to the specific processing activity.
8. How We Use Personal Information
We may use personal information to:
• Operate and maintain the BagsBoards website.
• Display products and maintain shopping-cart functionality.
• Process payments and orders.
• Arrange fulfilment, shipping, tracking, and delivery.
• Process cancellations, returns, exchanges, and refunds.
• Communicate about orders and customer requests.
• Respond to questions, complaints, and support messages.
• Maintain customer accounts and preferences.
• Protect the website, payments, customers, and service providers.
• Detect, investigate, and prevent fraud or unlawful activity.
• Diagnose technical errors and improve website performance.
• Measure website use and the effectiveness of communications.
• Send marketing communications where permitted.
• Maintain accounting, tax, transaction, and legal records.
• Comply with applicable legal and regulatory requirements.
• Establish, exercise, or defend legal rights.
9. Cookies and Marketing Preferences
Strictly necessary Cookies may operate where required for the cart, checkout, payments, fraud prevention, security, account access, privacy choices, and other requested website functions.
Where consent is required, non-essential analytics, personalization, or advertising technologies will be used only after the applicable choice has been made.
You may manage available Cookie choices using the Cookie banner or privacy-preference controls displayed on the website.
You may unsubscribe from marketing emails using the unsubscribe option in the applicable message or by contacting BagsBoards.
Withdrawing from marketing does not stop necessary communications relating to an order, payment, delivery, return, refund, account, security matter, or customer-support request.
Further information is available in our Cookie Policy.
10. Disclosure of Personal Information
We may disclose personal information only where reasonably necessary for the purposes described in this GDPR Policy and our Privacy Policy.
Recipients may include:
• Shopify, which hosts and supports the e-commerce platform.
• Payment and financial-service providers.
• Shipping, delivery, tracking, and fulfilment providers.
• Security and fraud-prevention providers.
• Website-hosting, technical, data-storage, and support providers.
• Customer-support and communication providers.
• Analytics providers where enabled and permitted.
• Advertising or marketing providers where enabled and permitted.
• Accountants, insurers, legal advisers, and other professional advisers.
• Government bodies, regulators, courts, law-enforcement agencies, or other authorities where disclosure is legally required.
Service providers may process information under contractual obligations applicable to the services they provide. Some providers may act as independent controllers and process information under their own privacy notices.
We may also disclose information in connection with a proposed or completed merger, acquisition, restructuring, financing, bankruptcy, or sale of all or part of the business, subject to applicable safeguards.
11. International Data Transfers
BAGS & BOARDS, LLC is established in the United States.
Personal information may be processed in the United States, Canada, the United Kingdom, the European Economic Area, or other countries where Shopify and authorized service providers operate.
The data-protection laws of a destination country may differ from those applicable in your location.
Where a transfer is restricted by applicable data-protection law, BagsBoards or the relevant provider may rely on an appropriate transfer mechanism, including:
• An adequacy decision or adequacy regulation.
• Approved standard contractual clauses.
• The United Kingdom International Data Transfer Agreement.
• The United Kingdom Addendum to approved European Commission standard contractual clauses.
• Binding corporate rules where applicable.
• Another safeguard or exception recognized by applicable law.
Where required, the transfer will also be subject to an assessment and any additional measures reasonably necessary under applicable law.
12. Retention of Personal Information
We retain personal information only for as long as reasonably necessary for the purposes for which it was processed.
Retention periods may depend on:
• Whether a customer account remains active.
• The status of an order, payment, delivery, return, exchange, or refund.
• Customer-support and complaint requirements.
• Fraud-prevention and security needs.
• Tax, accounting, payment, and record-keeping obligations.
• Applicable legal limitation periods.
• The establishment, exercise, or defence of legal claims.
• Whether a valid consent remains in effect.
A deletion request does not always require immediate deletion. Information may be retained where continued retention is required or permitted by applicable law.
When personal information is no longer reasonably required, it may be deleted, anonymized, or securely restricted from further use.
13. Information Security
BagsBoards and its service providers use reasonable administrative, technical, and organizational measures intended to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.
These measures may include access restrictions, secure checkout, authentication controls, platform security, fraud monitoring, and provider security practices.
No website, storage system, or method of electronic transmission can guarantee absolute security.
Customers should:
• Protect account passwords and devices.
• Use secure networks where possible.
• Avoid sending payment-card details, security codes, passwords, or unnecessary sensitive information through email, telephone, or contact forms.
• Contact BagsBoards promptly if they believe an account, order, or communication has been compromised.
14. Your Data-Protection Rights
Depending on your location, the applicable law, and the circumstances of the processing, you may have some or all of the following rights:
14.1 Right to Be Informed
You have the right to receive clear information about the collection and use of your personal information.
14.2 Right of Access
You may request confirmation that we process your personal information and request access to eligible personal information and related processing information.
14.3 Right to Rectification
You may request correction of inaccurate personal information or completion of incomplete information.
14.4 Right to Erasure
You may request deletion of eligible personal information in circumstances provided by law.
This right is not absolute. Information may be retained where necessary for legal obligations, transaction records, fraud prevention, security, disputes, or legal claims.
14.5 Right to Restrict Processing
You may request restriction of processing in circumstances provided by applicable law, including while the accuracy or lawfulness of processing is being reviewed.
14.6 Right to Data Portability
Where applicable, you may request eligible personal information in a structured, commonly used, and machine-readable format.
You may also request direct transfer to another controller where the legal and technical requirements are satisfied.
14.7 Right to Object
You may object to processing based on legitimate interests where your circumstances provide grounds for the objection.
We may continue processing where legally permitted, including where compelling legitimate grounds override the objection or processing is necessary for legal claims.
14.8 Right to Object to Direct Marketing
You may object at any time to processing for direct-marketing purposes.
After a valid objection, personal information will no longer be used for direct marketing, although limited information may be retained to record and respect the opt-out.
14.9 Right to Withdraw Consent
Where processing is based on consent, you may withdraw consent at any time.
Withdrawal does not affect processing carried out lawfully before the withdrawal.
14.10 Rights Concerning Automated Decision-Making
Automated tools may assist with payment authorization, fraud detection, transaction security, advertising, or website operation.
Where a decision is based solely on automated processing and produces legal or similarly significant effects, you may have the right to:
• Request human intervention.
• Express your point of view.
• Challenge the decision.
• Receive meaningful information about the applicable decision process, subject to legal limitations.
These rights apply only where the legal conditions for them are met.
14.11 Right to Complain
You may submit a complaint to a competent data-protection authority.
Individuals in the United Kingdom may complain to the Information Commissioner’s Office.
Individuals in the European Economic Area may complain to the competent supervisory authority in the country where they live, work, or believe an infringement occurred.
15. How to Exercise Your Rights
To submit a data-protection request, contact:
Email: contact@bagsboards.shop
Phone: +19549001988
Please provide:
• Your full name.
• The email address associated with your account or order.
• Your order number, where relevant.
• A clear description of the right or request.
• The country or region in which you reside.
We may request reasonable information to verify your identity and protect personal information from unauthorized access or disclosure.
Verification may involve confirming information already associated with an account, order, email address, telephone number, billing address, or delivery address.
We will not request your payment-card security code, account password, or unnecessary sensitive information to verify a privacy request.
An authorized person may submit a request on your behalf where permitted by law. We may request evidence of that person’s authority and may verify your identity directly.
We will respond without undue delay and normally within one month where the UK GDPR or EU GDPR applies.
Where permitted by law, the response period may be extended for complex or multiple requests. If an extension applies, we will inform you and explain the reason.
Requests are normally handled without charge.
Where permitted by applicable law, we may charge a reasonable administrative fee or refuse to act where a request is manifestly unfounded or excessive. Any such decision will be considered individually and explained to the requester.
16. Children’s Privacy
The website and Services are not directed to children under the age of 16.
BagsBoards does not knowingly collect personal information directly from children under 16 in violation of applicable law.
If a parent or legal guardian believes that a child has provided personal information to BagsBoards, they may contact us to request review and, where appropriate, deletion.
17. Privacy Complaints
Questions or complaints concerning our handling of personal information should first be submitted using the contact information in Section 19.
We will acknowledge and review the matter as soon as reasonably possible.
Our normal customer-support acknowledgment target is within one business day. This does not replace or shorten the formal response periods that apply to data-protection requests or complaints under applicable law.
Where required, we will provide information about the outcome of the complaint and available escalation rights.
You may also complain directly to the competent data-protection authority without contacting BagsBoards first.
18. Relationship With Other Policies and Updates
This GDPR Policy supplements our Privacy Policy and Cookie Policy.
Where another policy contains more specific information about a particular processing activity, that information should be read together with this GDPR Policy.
We may update this GDPR Policy to reflect changes to:
• The website or Services.
• Shopify features and applications.
• Service providers.
• Processing activities.
• Business operations.
• Applicable legal or regulatory requirements.
The updated version will be published on this page with a revised "Last Updated" date.
Where required by law, we will provide additional notice or request consent before a material change takes effect.
19. Contact Us
For privacy questions, data-protection requests, or complaints, contact:
BAGS & BOARDS, LLC
Store name: BagsBoards
Address: 1201 Elegance Ct., Orlando, FL 32828, United States
Email: contact@bagsboards.shop
Phone: +19549001988
Customer-support hours:
Monday to Friday, 9:00 AM to 5:00 PM ET
We normally acknowledge customer-support communications within one business day.
Formal data-protection requests will be handled within the period required by applicable law.