Privacy Policy

Effective date: 12 October 2026 · Last updated: 18 October 2026

01Overview

This Privacy Policy applies when you visit sowowbag.com, sowowbag.vip or another website or digital service operated by So Wow Bag, create or use an account, contact our Concierge, make a purchase, request sourcing, submit an item for consideration, use a verification or certificate service, or otherwise communicate with us (together, the “Services”).

So Wow Bag is a trading brand operated by Frolance Limited (“So Wow Bag”, “we”, “us” or “our”). In this Policy, “personal information” means information that identifies you or could reasonably be linked to you, as defined by applicable law.

We handle information in accordance with applicable data-protection and privacy requirements. The rights and obligations that apply may depend on where you live and how you interact with us. This Policy should be read alongside any privacy notice shown at the point where information is collected.

02Information we collect

The information we collect depends on the Services you use and the choices you make. It may include:

Information you provide

• Contact details: name, email address, telephone number, billing details and delivery address.
• Account information: account identifier, login and authentication data, profile details, preferences, saved items and account settings.
• Client correspondence: enquiries, concierge requests, sourcing briefs, appointment details, feedback and messages you choose to send us.
• Transaction and service information: orders, payment status, delivery arrangements, returns or complaints, gift cards, selling submissions, proposed payouts, certificates and verification requests.
• Optional information: details you choose to share to help us provide a more personal service, such as model preferences or occasion-related requirements.

Information collected through use of the Services

Our systems and service providers may collect technical and usage information such as IP address, browser and device type, operating system, approximate location inferred from technical information, referring page, pages viewed, interactions, timestamps, security logs and cookie identifiers.

n

Concierge communicator analytics: when you open the floating Concierge communicator or select a contact channel, we record the event time, selected channel (where applicable), referring page path, browser user-agent string and the IP address observed by our server. We use these records to understand channel demand, diagnose contact-routing issues and protect the service. Access is restricted to authorised administrators and communicator event records are automatically deleted after 90 days. When you follow a messenger link, that provider may separately process information under its own privacy terms.

Optional website analytics: only after you choose “Allow analytics” in the website notice, we use first-party session storage to generate a temporary pseudonymous visitor/session identifier and record page views, clicked links or controls, active page duration, page path, referring website host, browser user-agent, server-observed IP address and, when supplied by our hosting proxy, country/region. If you are signed in, events may be associated with your internal website user account to help authorised administrators understand that session’s journey. We do not send these analytics to a third-party analytics provider. You can reject optional analytics in the notice; if you do, this tracker does not run. Analytics events are retained for no longer than 7 days and then automatically deleted.

Change analytics preferences

Information from other sources

Where permitted by law, we may receive relevant information from payment and delivery providers, authentication or verification providers, technology and security providers, business partners involved in a requested service, or publicly available sources. We use such information only for appropriate business, service, security or legal purposes.

Please avoid sending sensitive personal information unless it is necessary for your request and we have asked you to provide it through an appropriate channel.

03How we use information

We use personal information only for purposes that are appropriate to our relationship with you, which may include:

• creating and administering accounts, protecting sign-in and managing account preferences;
• responding to enquiries and providing sourcing, concierge, private-client and other requested services;
• processing orders, payments, delivery, returns, selling submissions and related administration;
• maintaining records of purchases, certificates, ownership-related requests and verification activity where relevant to the service;
• communicating about orders, account activity, service updates, security matters and requests you have made;
• preventing fraud, misuse, unauthorised access and other activity that may compromise clients or our Services;
• maintaining, troubleshooting and improving our website, systems, service quality and accessibility;
• meeting legal, regulatory, tax, accounting and record-keeping obligations, and establishing or defending legal claims; and
• sending editorial or marketing communications where permitted and, when required, with your consent.

We do not use information for a materially different purpose without a lawful basis and any notice or consent required by applicable law.

04Legal bases for processing

Where applicable law requires a legal basis for processing, we may rely on one or more of the following:

• Contract or pre-contract steps: to provide a service, process a transaction or respond to a request you make before entering into an arrangement.
• Legitimate interests: to operate, secure and improve our business, communicate with clients about relevant services, prevent misuse and maintain business records, where those interests are not overridden by your rights.
• Consent: where you have given consent and it is required for the relevant activity, such as certain optional cookies or marketing communications.
• Legal obligations: to comply with applicable law or a lawful request from a competent authority.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before it was withdrawn, and some processing may continue where another lawful basis applies.

05Cookies & similar technologies

Cookies and similar technologies may help the Services function, remember your choices, protect accounts, understand website performance and, where enabled, measure or personalise content. The technologies in use may vary by page, device and the tools available on the website.

Essential technologies

These support core functions such as security, session management, sign-in, preferences and reliable page operation. Disabling them may prevent some parts of the Services from working properly.

Preferences and analytics

Preference technologies may remember choices such as language or currency. Analytics technologies, where used, help us understand how visitors use the website and where improvements may be needed. Where applicable law requires consent before optional technologies are used, we will seek that consent before activating them.

Your choices

You can manage cookies through your browser settings and, where provided, the website’s cookie controls. Blocking or deleting cookies may affect saved preferences or certain functions. Browser controls do not always prevent all forms of technical measurement, so use any site-provided controls where available.

06Communications

We may contact you through email, telephone, messaging services or another channel you provide or ask us to use. Service communications may include order and delivery updates, account notices, security alerts, responses to enquiries, certificate or verification correspondence and information necessary to provide a requested service.

Where permitted by law, we may also send editorial, news or promotional communications. You can opt out of marketing messages using the unsubscribe option provided or by contacting us. Even after you opt out, we may still send non-promotional messages about an active order, your account, security or a service you have requested.

If you contact us through a third-party messaging platform, that platform may process information under its own privacy terms. Please review its policy before sharing information through it.

07Sharing information

We do not sell personal information for money. We may share relevant information, limited to what is reasonably needed, with the following categories of recipients:

• website hosting, infrastructure, account, authentication and technical support providers;
• payment providers and financial institutions to process or confirm transactions;
• delivery, logistics, insurance or fulfilment providers involved in a requested order or service;
• verification, authentication or specialist service providers where relevant to a request;
• email, communications, customer-support and messaging providers;
• analytics, security, fraud-prevention and website performance providers, where used;
• professional advisers, including legal, accounting and financial advisers; and
• public authorities, courts or other parties where disclosure is required by law or reasonably necessary to protect rights, safety or property.

We may also share information with a provider or business partner where that sharing is necessary to fulfil a service you have requested, or as part of a corporate transaction, subject to applicable confidentiality and legal requirements.

Payment details are handled according to the payment method and provider involved. We may receive transaction confirmations and limited payment-related information; the payment provider’s own privacy terms may also apply. We do not ask you to send full payment-card details by ordinary email or messaging.

Where a service provider processes information on our behalf, we take reasonable steps to require appropriate safeguards and use of the information for authorised purposes.

08International transfers

So Wow Bag works with clients and service providers in different locations. As a result, personal information may be accessed, stored or processed in a country other than the country where you live.

Where applicable law requires safeguards for an international transfer, we will use an appropriate mechanism recognised by that law. Depending on the circumstances, this may include an adequacy decision, contractual protections or another permitted transfer mechanism.

You may contact us using the details in Section 15 to ask for further information about safeguards relevant to a particular transfer, subject to applicable law.

09Security

We use reasonable technical, organisational and administrative measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Access should be limited to people and providers who need the information for an authorised purpose.

No website, transmission method or storage system can be guaranteed completely secure. Please use a strong, unique password where applicable, keep authentication details private and contact us promptly if you believe your account or communications have been compromised.

If a security incident triggers a notification obligation under applicable law, we will take the steps required by that law.

10Retention

We retain personal information for no longer than reasonably necessary for the purpose for which it was collected, taking account of the nature of the information, the service provided, the length of our relationship and applicable legal requirements.

Some records may need to be retained for longer to complete transactions, maintain financial and business records, respond to disputes, enforce agreements, preserve security or meet legal obligations. Retention periods may therefore differ by record type and context.

When information is no longer required, we take reasonable steps to delete it, anonymise it or securely dispose of it, subject to legal, technical and operational requirements. Concierge communicator open and click analytics are retained for up to 90 days and then deleted automatically.

11Your privacy rights

Depending on your location and the law that applies, you may have the right to request access to personal information, correction of inaccurate information, deletion, restriction of certain processing, objection to certain processing, data portability, or withdrawal of consent. You may also have rights concerning direct marketing or certain uses of personal information.

These rights are not absolute and may be subject to exemptions or other limitations. We may need to verify your identity and clarify your request before responding. Where permitted by law, we may decline or limit a request and will explain the reason when required.

To make a privacy request, contact concierge@sowowbag.com and include “Privacy Request” in the subject line. Please do not include passwords, payment-card details or unnecessary sensitive information. We will respond within the period required by applicable law.

12California privacy rights

If you are a California resident, California privacy law may provide additional rights, subject to applicable definitions and exceptions. These may include the right to know or access certain information, request correction or deletion, obtain certain information in a portable format, and opt out of a sale or sharing of personal information where those concepts apply.

We do not sell personal information for monetary consideration. Some disclosures or uses of information by online services may nevertheless be treated as “selling” or “sharing” under particular laws, depending on the technologies and circumstances involved. Where a legal opt-out or other control applies to our activities, we will provide it as required.

You may submit a request using the contact details in Section 15. We may take reasonable steps to verify the request and will respond in accordance with applicable law. An authorised agent may need to provide evidence of authority.

13Children’s privacy

The Services are intended for adults and are not directed to children below the age permitted to use the relevant service under applicable law. We do not knowingly collect children’s personal information where doing so is prohibited.

If you believe a child has provided personal information to us in circumstances where it should not have been collected, please contact us so that we can review the matter and take appropriate steps.

14Changes to this Policy

We may update this Policy to reflect changes to our Services, business practices, technologies or legal requirements. The “Last updated” date at the beginning of the Policy shows when it was most recently revised.

Where a change requires additional notice or consent under applicable law, we will provide it. We encourage you to review this page periodically so that you remain informed about how we handle personal information.

15Contact

For questions about this Policy, requests concerning your personal information, or further information about our privacy practices, please contact us:

Please include enough information for us to understand your request. We may need to verify your identity before completing certain requests.