Privacy Policy

1. Who We Are

Waggy Wash Club Ltd (company number 16899039) is the data controller for your personal data. Our registered address is 35 Park Place, Cardiff, Wales, CF10 3RL.

For any privacy-related enquiries, contact us at hello@waggywashclub.co.uk.

2. What Data We Collect

We collect the following personal data:

Account Information

• Name (first and last)
• Email address
• Hashed password (we never store your password in plain text)
• Membership ID

Payment Information

• Payment card details are processed and stored by Stripe — we only store a reference token and the last four digits of your card for display purposes.
• Transaction history and order records

Dog Profile Information

• Dog name, breed, and coat type

Usage Data

• Wash session history (date, location, duration, wash type)
• Token balance and transaction history
• Loyalty programme progress

Technical Data

• IP address
• Browser type and version
• Device information
• Pages visited and interaction data

3. How We Use Your Data

We use your personal data to:

• Provide and manage your account
• Process payments and manage subscriptions
• Grant, track, and redeem wash tokens
• Operate our loyalty rewards programme
• Send transactional emails (verification, password reset, receipts)
• Provide customer support
• Improve our services and fix technical issues
• Comply with legal obligations

4. Legal Basis for Processing

We process your data under the following legal bases (UK GDPR):

• Contract — processing necessary to provide our services (account management, token redemption, payment processing).
• Legitimate interests — improving our services, preventing fraud, and ensuring platform security.
• Legal obligation — retaining financial records as required by law.
• Consent — where applicable, for marketing communications (you can withdraw consent at any time).

5. Third-Party Data Sharing

We share your data with the following third parties:

We do not sell your personal data to any third party. We only share data where necessary to provide our services.

6. Data Retention

• Account data — retained for as long as your account is active, plus 6 years after closure (for legal and financial record-keeping).
• Transaction records — retained for 6 years as required by HMRC.
• Wash session history — retained for 2 years after the session date.
• Technical logs — retained for up to 90 days.

7. Your Rights (UK GDPR)

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — ask us to delete your data (subject to legal retention requirements).
• Restriction — ask us to limit how we use your data.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.

To exercise any of these rights, email us at hello@waggywashclub.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Passwords stored using bcrypt hashing
• Parameterised database queries to prevent injection attacks
• Role-based access controls for staff
• Regular security reviews and audit logging

9. Cookies

We use cookies to operate our service. For full details, see our Cookie Policy.

10. Children

Our services are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or a notice on our website. The “last updated” date at the top indicates when this policy was last revised.

12. Contact

For any questions about this privacy policy or your personal data, contact us at hello@waggywashclub.co.uk.