This Privacy Policy explains what personal information we collect, why we use it, who may process it on our behalf and the choices you have.

Who we are

TagLink is a trading name of Orange Feather Ltd, registered in England and Wales under company number 14263776, based in Lightwater, Surrey.

For data protection purposes, Orange Feather Ltd is the controller of personal information processed through TagLink.

Contact: hello@taglink.co.uk

Information we collect

The information we collect depends on how you interact with TagLink.

When you activate a TagLink

We collect:

• your email address

• the TagLink activation code associated with your TagLink

You may also provide a trusted contact name, but this is optional and is used only to personalise notifications.

This information connects the TagLink to the email address that should receive a notification when somebody scans it and submits a message.

For TagLink Connect, the email address should belong to the adult wearer or trusted contact who should receive messages. This may be different from the person wearing or carrying the TagLink.

Where the wearer is under 18, TagLink Connect must be activated and managed by their parent or legal guardian, or another responsible adult authorised by their parent or legal guardian. The child’s email address should not be used as the trusted contact.

We do not require an owner’s or wearer’s phone number, home address or live location to operate the TagLink notification service.

For TagLink Connect, we do not require the wearer’s name, date of birth, school, diagnosis, SEND information, medical history, medication information, care plan or capacity assessment.

When someone scans a TagLink and sends a message

When someone scans a TagLink and submits a message, we may collect:

• where the item was found or where the person was encountered

• a message explaining the situation or how the item or person can be reconnected with the owner or trusted contact

• any name, email address or phone number the person scanning chooses to provide

Providing the scanner’s own name and contact details is voluntary.

The message and any contact details voluntarily provided are sent to the TagLink owner or trusted contact so they can understand the situation and decide how to respond.

The owner’s or trusted contact’s email address, phone number and home address are not displayed to the person scanning the TagLink.

Where a message relates to a child, young person or adult wearing or carrying TagLink Connect, the information provided may be personal information about that person even if their name is not included.

People using the message form should avoid including a child’s full name, school, home address, diagnosis, medical information, SEND information or other sensitive details unless genuinely necessary to explain the immediate situation.

Support, feedback and community programmes

Where you request support, provide feedback or take part in a TagLink community programme, we may collect limited information including:

• the trusted contact’s name, where voluntarily provided

• the trusted contact’s contact details

• the relevant TagLink activation code

• feedback about activation and the scan-and-message journey

• feedback about wearing the Band or carrying the Wallet Card

• details of technical problems, support requests or reported concerns

We use this information to provide support, administer the relevant programme and improve the TagLink service.

Providing feedback is voluntary. Choosing not to provide feedback will not prevent an activated TagLink from continuing to operate.

We do not routinely ask wearers, trusted contacts, families or participating organisations to provide diagnoses, medical histories, SEND records, care plans or capacity assessments.

Participating organisations may separately hold their own parental-agreement, consent, capacity, care, distribution or safeguarding records under their own policies. TagLink does not routinely receive or store those records.

If health or other sensitive information is voluntarily provided in connection with a message, support request or reported safeguarding concern, we will only use it where reasonably necessary to understand and respond to the matter and where permitted by applicable data-protection law.

We may anonymise or combine feedback so that it no longer identifies an individual. We may retain and use that anonymised information to improve TagLink.

When you place an order

Purchases are processed through Stripe. Information collected in connection with an order may include:

• name

• email address

• phone number

• delivery address

• products ordered

• personalisation or engraving information

• payment and transaction information

Payment-card information is processed securely by Stripe. TagLink does not receive or store your full payment-card details.

We receive the information needed to prepare and deliver your order.

When you contact us

If you submit an enquiry through our website or contact us directly, we may collect:

• your name

• email address

• organisation or club details, where relevant

• the nature of your enquiry

• any information you choose to include in your message

We use this information only to respond to and manage your enquiry or request.

For larger business or organisational orders, we may also hold appropriate contact, billing and invoicing information.

How we use personal information

We use personal information to:

• activate and operate TagLinks

• connect a TagLink with its owner or trusted contact

• route messages from people scanning TagLinks to owners or trusted contacts

• provide and support TagLink Connect

• administer relevant community programmes

• respond appropriately to reported safety or safeguarding concerns

• provide customer and technical support

• process and fulfil orders

• personalise products where requested

• arrange delivery

• respond to customer, club, community and business enquiries

• administer invoices and business transactions

• maintain appropriate financial and accounting records

• protect and operate our services securely

• improve the TagLink service using appropriate feedback and anonymised learning

We do not currently use customer, owner, trusted-contact, scanner, wearer, programme-participant or enquiry information for marketing mailing lists or promotional email campaigns.

We do not sell personal information.

Our lawful bases for processing

UK data-protection law requires us to have a lawful basis for using personal information.

Depending on the circumstances, we rely on:

Contract

Where processing is necessary to fulfil an order, provide a TagLink service requested by you or take steps relating to a potential purchase.

Legitimate interests

Where necessary to operate the TagLink service, route a message to an owner or trusted contact, provide customer support, administer an appropriate community programme, respond to enquiries and operate TagLink effectively and securely.

We only rely on legitimate interests where we consider that our use of the information is proportionate and does not override the individual’s rights and interests.

Where personal information relates to a child, young person or somebody receiving support, we give particular consideration to their interests, rights and the safeguards appropriate to their circumstances.

Legal obligation

Where information must be retained or processed to comply with legal, tax or accounting requirements.

Sensitive personal information

TagLink does not routinely ask for health information, SEND information or other special-category personal information.

People using TagLink should avoid submitting this type of information unless it is genuinely necessary to explain an immediate situation, request appropriate support or report a concern.

If sensitive personal information is voluntarily provided, we will only process it where necessary and where an appropriate lawful basis and additional condition under UK data-protection law applies.

Where information is not required, we may delete or anonymise it.

How the TagLink notification service works

When a TagLink is activated, its activation code is associated with the email address of the owner or trusted contact within the systems used to operate the notification service.

When someone scans the TagLink:

1. they scan the QR code

2. they complete a secure message form

3. the information they submit is processed through TagLink’s automation system

4. a notification is sent to the email address associated with that TagLink

The person scanning does not need to see the owner’s or trusted contact’s email address, phone number or home address to send the message.

If the person scanning voluntarily provides their own contact details, those details will be included in the message sent to the owner or trusted contact.

Service providers

We use trusted third-party services to help operate TagLink.

These currently include services such as:

Stripe for processing purchases, payments and order information.

Tally for forms used when someone scans a TagLink and submits a message.

Zapier for automation, TagLink activation records and routing TagLink messages and notifications.

FreeAgent for accounting, invoicing and financial administration where appropriate, particularly for larger and business transactions.

Delivery providers

For delivering orders. We provide the delivery information required for the carrier to deliver the parcel.

We may also use website-hosting, email and other technology providers where necessary to operate TagLink.

These organisations process information only where needed to provide their services.

We do not sell or rent personal information to third parties.

International processing

Some of the technology providers used by TagLink may process or store information outside the United Kingdom.

Where personal information is transferred internationally, we take reasonable steps to ensure that appropriate protections recognised under UK data-protection law are in place.

UK GDPR contains specific requirements covering international transfers, including adequacy arrangements and approved safeguards.

How long we keep information

We keep personal information only for as long as it is reasonably required for the purpose for which it was collected.

As a general guide:

TagLink activation information

Kept while the TagLink remains active. An owner or trusted contact can ask us to deactivate their TagLink and remove the associated personal information.

TagLink messages

Normally retained for no longer than 90 days after the message is submitted, unless we need to keep the information for longer to resolve a support, safety, safeguarding or legal issue.

Community-programme, support and feedback information

Identifiable programme-administration, support and feedback records will normally be retained for no longer than 12 months after the relevant programme ends or the last relevant interaction, unless information needs to be retained for longer to address a complaint, safeguarding concern or legal requirement.

Anonymised or aggregated findings may be retained for longer because they no longer identify an individual.

General enquiries

Normally retained for up to 12 months after the last interaction, unless the enquiry develops into an ongoing customer or business relationship.

Orders and financial records

Transaction, order, invoice and accounting information may be retained for up to six years, or longer where required by law or reasonably necessary for accounting, tax or legal purposes.

We periodically review the personal information we hold and delete or anonymise information that is no longer needed.

Children, young people and adults receiving support

TagLink is designed so that personal contact information does not need to be displayed publicly on a child’s bag, kit or belongings.

Where TagLinks are supplied for children’s belongings through families, clubs, schools or youth organisations, they should be activated and managed using the contact information of a parent, legal guardian or other responsible adult.

TagLink Connect may also be worn or carried by children, young people and adults who may benefit from an additional communication route to somebody they trust.

Where the wearer is under 18, TagLink Connect must be activated and managed by their parent or legal guardian, or another responsible adult authorised by their parent or legal guardian.

TagLink does not intentionally require children or young people to provide their own email address, phone number, home address, name, date of birth, school, diagnosis or SEND information to activate or use the service.

The purpose of TagLink Connect should be explained in a way appropriate to the wearer’s age, communication needs and understanding. The wearer should be involved in the decision wherever reasonably possible.

Although TagLink does not require the child or wearer’s identity during activation, a message submitted by somebody scanning the TagLink may contain information relating to them. We treat that information in accordance with this Privacy Policy.

Families, schools, clubs, parent-carer forums and other participating organisations may separately hold their own distribution, parental-agreement, care or safeguarding records. Those organisations are responsible for their own use of personal information under their applicable policies.

TagLink does not routinely require those records to be shared with us.

TagLink does not make decisions about a person’s care, capacity, support needs or eligibility for services.

Children and young people have data-protection rights in relation to their personal information. Depending on the circumstances and the individual’s understanding, these rights may be exercised by the child or young person or by an appropriate adult acting on their behalf.

More information about our approach is available on our Data & Safeguarding page.

Cookies and analytics

TagLink does not currently use Google Analytics, advertising pixels or behavioural-tracking technologies for marketing purposes.

We do not currently use personal information collected through the website to create advertising profiles or for targeted advertising.

The website and the third-party services required to operate it may use technologies that are strictly necessary for functionality, security or delivery of the service.

If we introduce analytics, advertising or other non-essential tracking technologies in the future, we will update this Privacy Policy and introduce appropriate cookie controls where required.

Security

We take reasonable technical and organisational measures to protect personal information from unauthorised access, misuse, loss or disclosure.

We also aim to minimise the amount of information required to operate TagLink.

No internet-based service can guarantee absolute security, but privacy and data minimisation form part of the way TagLink has been designed.

TagLink does not use personal information to make automated decisions about individuals or to profile owners, trusted contacts, wearers or people scanning TagLinks.

Your rights

Depending on the circumstances, UK data-protection law may give you the right to:

• request access to the personal information we hold about you

• ask us to correct inaccurate information

• ask us to delete information

• ask us to restrict how information is used

• object to certain uses of your information

• request transfer of certain information in a portable format

• withdraw consent where processing is based on consent

Some rights depend on the lawful basis on which the information is being processed and are therefore not absolute.

To exercise your rights, contact:

hello@taglink.co.uk

You also have the right to raise a concern with the Information Commissioner’s Office, the UK’s data-protection regulator.

Changes to this policy

We may update this Privacy Policy as TagLink develops, our services change or our legal obligations change.

The latest version will always be published on this page.

If you have any questions about this policy or how TagLink handles personal information, contact:

hello@taglink.co.uk