Privacy Policy
Last updated: 11 November 2026
1. Who we are
The Bag Rotation (thebagrotation.com) is an application-only designer bag rental club, currently in pre-launch. The website is run by Cassandra Beyer, Kreuzaeckerring 4, 88048 Friedrichshafen, Germany, who is the controller of your personal data. The Bag Rotation is not yet a registered company; this policy will be updated when it is.
For any privacy question or request, email hello@thebagrotation.com.
2. What this policy covers
This policy explains how we handle personal data when you visit our pre-launch website, apply for membership or receive emails from us. We do not take payments, carry out identity checks or deliver bags yet. Before we do, we will update this policy and tell members. Membership is currently open only to people living in the European Union or the European Economic Area.
3. The data we collect
When you apply for membership, we collect:
- your first and last name
- your email address
- your Instagram handle
- a referral code, if you have one, and the member who referred you
- the time you gave consent, and whether you agreed to receive marketing emails
- the outcome of your application
- technical details sent with the form: your country (worked out from your IP address; we do not store the IP address itself), your browser type and, if you arrived through a campaign link, that link's campaign tags (for example, which Instagram post or newsletter sent you)
To review your application, we look at your public Instagram profile. We do not save screenshots or copies of it.
When you visit the site, our hosting and security provider, Cloudflare, automatically processes technical data such as your IP address, browser type and the pages requested. This is needed to deliver the site and protect it from attacks. To stop spam applications, the form uses Cloudflare Turnstile, which checks signals from your browser to tell people from bots.
We do not collect payment details or ID documents at this stage.
Your name, email address and Instagram handle are required to apply. Without them we cannot review your application. The referral code is optional; if you enter one, we link your application to the member who shared it.
4. Why we use your data and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Reviewing your membership application and telling you the outcome | Application data | Steps you asked us to take before becoming a member (Art. 6(1)(b)) |
| Sending membership emails, such as your confirmation, approval and launch access | Name, email | Steps before membership (Art. 6(1)(b)) |
| Recording who referred you, to run the referral-based club | Referral code, referrer | Our legitimate interest in running a referral-based club (Art. 6(1)(f)) |
| Sending news, launch announcements and offers | Name, email | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Understanding where applications come from (country, browser, campaign link) | Technical details from the form | Our legitimate interest in knowing which channels reach applicants (Art. 6(1)(f)) |
| Keeping the website secure and blocking spam | Technical data, Turnstile check | Our legitimate interest in a secure, working site (Art. 6(1)(f)) |
| Keeping a record of your consent | Consent time | Our legal obligation to prove consent (Art. 6(1)(c), Art. 7(1)) |
Your application is reviewed by a person. We do not make automated decisions about you.
If you email us or message our Instagram account, we use your message and contact details to reply. Our legal basis is our legitimate interest in answering you (Art. 6(1)(f)), or steps before membership if you ask about joining (Art. 6(1)(b)).
5. Who we share your data with
We do not sell your personal data. We share it only with service providers who help us run the website, and only as needed:
- Cadabra Studio, Inc. (Delaware, USA): our web developer, who builds and maintains the website and the application database on our behalf
- Cloudflare, Inc.: website hosting (Cloudflare Pages), the application database (Cloudflare D1, stored in the EU), security and spam protection (Cloudflare Turnstile)
- Resend: sending confirmation and membership emails from hello@thebagrotation.com
- Google (Google Workspace): our email inbox, which holds your messages to us and our replies
These providers act on our instructions under data-processing agreements. We may also disclose data if the law requires it, or to a business that takes over The Bag Rotation, which would have to protect it in line with this policy.
6. International transfers
Applications are stored in a database located in the EU. Cloudflare, Resend and Cadabra Studio, Inc. are US companies, and Google may process email outside Europe, so some data can be accessed from or sent to the United States. Where data leaves the European Economic Area, we rely on recognised safeguards, such as the EU-US Data Privacy Framework or standard contractual clauses.
7. How we protect your data
The website only uses encrypted (HTTPS) connections. Only the operator and our developer, Cadabra Studio, can access applications, through accounts protected by two-factor authentication. Cadabra Studio uses this access only to maintain the site and database, under a data-processing agreement. Our providers encrypt stored data. If a data breach is likely to put you at risk, we will tell you and the data protection authority where the law requires.
8. How long we keep your data
- Rejected applications: deleted completely 30 days after our decision.
- Approved members: kept while you are a member. If you ask to leave, we delete your data unless we must keep some of it by law.
- Marketing consent: kept until you unsubscribe. We then keep only your email on a suppression list, so we do not email you again.
- Consent records: kept for as long as we may need to show that you agreed, generally up to three years after your consent ends.
- Emails and messages with us: kept while needed to deal with your request, then deleted.
- Technical data: kept by our providers for a short time, in line with their own retention rules.
9. Cookies
We do not use advertising, analytics or tracking cookies, and we do not use tracking pixels. Cloudflare may set a strictly necessary cookie, and Cloudflare Turnstile runs a short check on the application form, to protect the site from bots. Neither tracks you across other websites, and neither needs consent.
10. Our Instagram account
We run an Instagram account (@the.bag.rotation). If you follow us, comment or message us there, Instagram also processes your data under Meta's own privacy policy. Meta gives us statistics about how people use our account (Page Insights). For these statistics, we and Meta Platforms Ireland Limited are joint controllers, and Meta handles most rights requests about them.
11. Your rights
Under the EU General Data Protection Regulation (GDPR), you can:
- access the data we hold about you
- correct it if it is wrong
- ask us to delete it
- ask us to limit how we use it
- object to our use of it based on legitimate interest
- receive it in a portable format
- withdraw your marketing consent at any time, using the unsubscribe link in any email or by contacting us
Your right to object: where we rely on our legitimate interest (see section 4), you can object at any time for reasons relating to your situation. You can object to marketing at any time, without giving a reason, and we will stop.
To use any of these rights, email hello@thebagrotation.com. This is free of charge. We may ask you to confirm your identity before acting on a request, and we will reply within one month.
You can also complain to a data protection authority, in particular the one in the EU country where you live or work. We would appreciate the chance to deal with your concern first.
12. Age requirement
Membership is only open to people aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn that an applicant is under 18, we delete their application.
13. Changes to this policy
We will update this policy when we launch rentals, payments and identity checks, and whenever our practices change. We will post the new version here, and for significant changes we will email members.
14. Contact
Cassandra Beyer, The Bag Rotation
Kreuzaeckerring 4, 88048 Friedrichshafen, Germany
hello@thebagrotation.com