Privacy Policy

1. Who we are

BubbleBasket is operated by Pixtech Ltd, a company registered in England and Wales (company number 17162193) (“we”, “us”). We take the privacy of personal data seriously and comply with the UK GDPR and the Data Protection Act 2018.

2. Controller and processor — two roles

Our role depends on whose data is involved:

• We are the controllerfor the personal data of our business customers — the laundrettes (“Tenants”) — and their staff users, such as account and billing details and how they use the Platform.
• We are a processorfor the personal data of a Tenant’s own customers (“End Customers”) that is submitted through their storefront. The Tenant is the controller of that data; we process it on their instructions under a data processing agreement, solely to provide the Platform.

This policy covers our activities as controller. Where we act as a processor, the relevant Tenant’s own privacy notice governs how that End Customer data is used.

3. The personal data we handle

• Tenant account data — names, work email, phone, business details and role of staff users.
• Billing data — subscription plan, invoices and payment status (card details are handled by our payment provider, not stored by us).
• Usage and technical data — log data, device/browser information, and actions taken in the Platform.
• End Customer data (as processor, on behalf of Tenants) — names, contact details, addresses, order and slot details, and order communications.

4. How we use personal data and our legal bases

• To provide and secure the Platform — performance of our contract with you, and our legitimate interests in keeping the service safe and reliable.
• To take payment and manage subscriptions — performance of our contract and compliance with legal obligations.
• To provide support and send service messages — performance of our contract and our legitimate interests.
• To improve the Platform and prevent abuse — our legitimate interests.
• For marketing to prospective business customers — consent or legitimate interests, with an opt-out in every message.

5. Sharing and sub-processors

We do not sell personal data. We share it with service providers who help us run the Platform, under contracts that require appropriate safeguards. These include providers of hosting and database services (Supabase, Vercel), payment processing (Stripe), email and network services (Cloudflare), SMS (Twilio), and address/postcode lookup (Ideal Postcodes, postcodes.io). We may also disclose data where required by law or to protect our rights.

6. International transfers

Some providers may process data outside the UK. Where they do, we rely on an adequacy decision or on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.

7. How long we keep data

We keep personal data only as long as needed for the purposes above. Tenant account data is kept for the life of the account and for a reasonable period afterwards; billing records are kept as required by law. As a processor, we retain End Customer data per our agreement with the Tenant and delete or return it on termination, subject to legal retention requirements. Abandoned booking drafts and cached postcode data are deleted on a rolling basis.

8. Security

We use appropriate technical and organisational measures to protect personal data, including strict tenant-isolation controls, encryption in transit, access controls and audit logging. No system is completely secure, but we work to protect data and to respond promptly to any incident.

9. Your rights

Under UK data-protection law you have rights to access, rectify, erase, restrict or object to processing of your personal data, and to data portability. To exercise these rights in relation to data for which we are the controller, contact us using the details below. If your request concerns data held by a Tenant (where we are a processor), we will refer you to that Tenant.

10. Cookies

We use essential cookies to keep you signed in and to keep the Platform secure. We do not use advertising cookies. Where any non-essential cookies are used, we ask for your consent first.

11. Children

The Platform is intended for businesses and is not directed at children. We do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version here and, where changes are material, give reasonable notice.

13. Contact and complaints

For any privacy question or to exercise your rights, contact Pixtech Ltd at privacy@bubblebasket.io. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to help first.