Privacy Policy

This policy explains how Lemonz Services Ltd, a company registered in England and Wales (company number [company number]), registered office [registered address], trading as Bagd, collects and uses personal data when you use the Bagd service. We are registered with the UK Information Commissioner’s Office (registration [ICO registration number]).

1. Controller and processor

For the account details of the business owners and managers who sign up to Bagd, we are the controller. For the personal data a customer puts into Bagd about their own staff (names, contact details, shifts, hours, pay), the customer is the controller and we act as their processor — we only process that data to provide the Service and on the customer’s instructions. A data processing agreement is available to customers on request.

2. What we collect

• Account data – name, email, phone, password (stored hashed), workspace and role.
• Staff data entered by customers – team members’ names, emails, phone numbers, skills, availability, shifts, clock-in times, pay rates and timesheets.
• Billing data – your plan and subscription status. Card details are handled by Stripe; we do not see or store full card numbers.
• Content you add – messages, notes, files and images you upload.
• Usage and technical data – log-in events, IP address, device/browser information and basic activity logs, used for security and to run the Service.

3. How and why we use it

• To provide and run the Service for you and your team – performance of our contract with you.
• To take payment and manage subscriptions – performance of our contract.
• To secure the Service, prevent abuse, and keep it working and improving – our legitimate interests.
• To send service emails (shift offers, reminders, password resets, important notices) – contract / legitimate interests.
• To meet legal and accounting obligations – legal obligation.
• Any marketing email would be sent only with a lawful basis, and you can opt out at any time.

4. Who we share it with

We do not sell your data. We share it only with the providers that help us run Bagd, acting as our sub-processors:

• OVH – server hosting (EU).
• Stripe – subscription payments.
• Resend – sending service emails.
• Microsoft – our business email.

We may also disclose data if required by law, or to protect our rights, users or the Service.

5. International transfers

Our servers are in the EU. Some providers (such as Stripe) may process data outside the UK/EEA; where they do, we rely on appropriate safeguards such as the UK’s International Data Transfer Agreement or Standard Contractual Clauses.

6. How long we keep it

We keep workspace data while your account is active. If you delete your workspace, we delete its data, and residual copies are removed from backups within a short period. We may keep limited records (for example billing records) for as long as the law requires.

7. How we protect it

We use encryption in transit (HTTPS), hashed passwords, access controls and tenant isolation so one customer’s data is kept separate from another’s. No system is perfectly secure, but we take reasonable steps to protect your data and will notify you of a breach where the law requires.

8. Your rights

Under UK data protection law you have the right to access, correct, delete, restrict or object to our use of your personal data, and to data portability. To exercise these rights contact us below.

If you are a member of staff whose data is in Bagd because your employer uses it, your employer is the controller of that data — please contact them first; we will help them respond.

9. Cookies

We use a small number of essential cookies to keep you logged in and keep the app working. We do not use third-party advertising or tracking cookies. Your browser can block cookies, but the app may not work properly without the essential ones.

10. Children

Bagd is for businesses and is not intended for anyone under 16.

11. Changes to this policy

We may update this policy; we will post the new version here and update the date above, and tell you about material changes.

12. Contact and complaints

For any privacy question or to exercise your rights, contact privacy@getbagd.com.

If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner’s Office at ico.org.uk, though we’d appreciate the chance to put things right first.