Privacy Policy

Drop That Bag is operated by DTB Holdings, a company based in Menton, France. This Privacy Policy explains how we collect, use, and protect your personal data in compliance with the General Data Protection Regulation (GDPR) and applicable French law.

1. Who We Are

DTB Holdings
Menton, France
Contact: hello@dropthatbag.com

2. Data We Collect

When you submit a request through our website, we may collect the following personal data:

• First and last name
• Email address
• Phone number
• Delivery address
• Any files or links you submit (bag photos, TikTok/Instagram URLs)

We do not collect sensitive data (health, financial, or identity document data) and we do not collect data from users under the age of 16.

3. How We Use Your Data

We use your data exclusively for the following purposes:

• Processing your sourcing or OEM manufacturing request
• Communicating with you about your order or quote
• Sending transactional emails related to your request
• Sending marketing emails if you have opted in (you may unsubscribe at any time)
• Analysing website traffic to improve our service (analytics only)

4. Data Storage and Processors

Your data is stored and processed using the following third-party services:

• Zapier + Google Sheets — Form submissions are routed via Zapier and stored in Google Sheets for internal processing
• Google Workspace — Used for transactional email communications
• Google Analytics 4 (ID: G-1NH3L3E677) — Anonymous website analytics
• Klaviyo (ID: Y8Cdpu) — Email marketing platform, used only if you have opted in

All processors are GDPR-compliant and subject to data processing agreements where required. We do not sell, rent, or share your personal data with third parties for commercial purposes.

5. Legal Basis for Processing

We process your data on the following legal bases:

• Contract performance — to process your sourcing or manufacturing request
• Legitimate interest — to respond to your enquiries and improve our service
• Consent — for marketing emails (Klaviyo). You may withdraw consent at any time

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by French law. Typically, data related to a request is retained for up to 3 years from the date of last contact.

7. Your Rights Under GDPR

As a data subject under the GDPR, you have the following rights:

• Right of access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your personal data
• Right to restriction — request that we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest or direct marketing

To exercise any of these rights, contact us at the address below. We will respond within 30 days.

8. Cookies

We use cookies to improve your experience and analyse traffic. For full details, please read our Cookie Policy.

9. International Transfers

Some of our data processors (Google, Klaviyo) may transfer data outside the European Economic Area. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any significant changes will be communicated on this page with a revised "Last updated" date.