Last updated: 3 October 2026
This policy explains what personal information Baggage & Luggage collects, why we collect it, who we share it with, how long we keep it and what your rights are. It covers people who visit our website, ask for a price, book with us, are named as a recipient in a booking, contact us, ask for a currency exchange rate or leave a review.
The short version
- We use your information to price, book and deliver your shipment.
- We share it with our transport partners and customs authorities only as needed to get your items delivered. For deliveries abroad, this means sending details to the destination country.
- If you ask for a currency exchange rate and tick the box to agree, we pass your request to our currency exchange partner so they can contact you.
- We do not sell your information. We do not use advertising cookies.
- You have rights over your information, and you can complain to the Information Commissioner's Office (ICO).
Who we are
The data controller is Onemove Limited, trading as Baggage & Luggage. This means we decide how and why your personal information is used.
- Registered in England and Wales, company number 08717311
- Registered office: First Floor 14-16 Powis Street, Woolwich, London, SE18 6LF
- Email: email us (please put "Privacy" in the subject line)
This policy follows the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What we collect
Information you give us
- Contact details: your name, email address and phone number.
- Collection and delivery details: collection and delivery addresses, the collection date and time, and the recipient's name, address, phone number and, if you give it, email address.
- Packing list: each item, the quantity, its value and whether it is new or used. Customs authorities need this. Please describe the items only, and do not add personal information that is not needed.
- Quote details: the route, the sizes and weights of your items, the service you chose and the price. If you tell us your airline, we use it to show you a comparison.
- Booking and payment records: your booking reference, the status history of your shipment, amounts due and payment confirmations. We do not take card payments online at present. When you pay us, we receive the details your bank sends with the payment, such as the payer's name and reference.
- Messages: what you send us through our contact form or by email.
- Currency exchange requests: the currencies you are changing between, roughly how much, when you need it, what it is for if you tell us, any notes, and whether you agreed to us passing your request to our currency exchange partner.
- Reviews: your name, your route and what you write.
Information we collect automatically
- IP address and browser details: when you ask for a price or submit a form, we record your IP address and your browser's user agent (a short description of your browser and device). We use these to protect against fraud and spam.
- Security checks: our website is protected by Cloudflare, which checks requests for attacks and automated abuse. To do this it processes your IP address and technical details of your request.
- Cookies: see the cookies section below.
Information we get from others
- If you are a recipient: we get your details from the person who booked the shipment.
- From our transport partners: collection and delivery updates, proof of delivery, and reports of damage or problems.
- From customs authorities: questions about a shipment, duty and tax information, and the results of inspections.
How we use your information and our lawful bases
The law says we must have a lawful basis for each way we use personal information. These are ours.
| What we do | Information used | Lawful basis |
|---|---|---|
| Give you a price | Quote details | Steps you ask us to take before entering into a contract |
| Take, confirm and manage your booking, including your booking page and booking emails | Contact details, collection and delivery details, packing list, booking records | Contract |
| Arrange collection and delivery, including sharing details with our transport partners | Contact details, collection and delivery details, packing list | Contract (for the person who booked). Legitimate interests (for recipients): delivering the shipment the sender asked us to deliver |
| Prepare customs paperwork and deal with customs authorities | Packing list, collection and delivery details | Contract. Legal obligation, where UK law requires export information. Legitimate interests: meeting the customs rules of the destination country |
| Take payment and keep accounts and tax records | Booking and payment records | Contract. Legal obligation |
| Handle claims, complaints and disputes | Any relevant records | Contract. Legitimate interests: dealing with and defending claims |
| Protect our website and customers from fraud, spam and attacks | IP address, browser user agent, form details | Legitimate interests: keeping our service secure |
| Reply to your messages | Contact form messages and emails | Legitimate interests: answering your question. Or steps before a contract, if you are asking about a booking |
| Pass your currency exchange request to our currency exchange partner, so they can contact you | Contact details and currency exchange request | Consent, given by ticking the box on the form. You can withdraw it at any time |
| Publish reviews on our website | Name, route and review text | Consent. You can withdraw it at any time |
| Improve our website and services | Quote and booking information, usually in summary form | Legitimate interests: running and improving our business |
| Meet legal requirements and respond to lawful requests from authorities | Any relevant information | Legal obligation |
| Marketing | We do not send marketing at present. If we start, we will only do so in line with the law, and you can opt out at any time | Consent |
Where we rely on legitimate interests, we have weighed our interests against yours. You can object to this use (see "Your rights" below).
If you do not give us the information we need for a booking or for customs, we cannot provide the service.
Our instant price. Our website works out your price automatically from the details of your shipment. This is a standard calculation, not a decision about you as a person. We do not use profiling.
Who we share your information with
- Transport partners. These are the companies we use to collect, carry, clear through customs and deliver your items, in the UK and abroad. They receive the names, addresses, phone numbers and email addresses of the sender and recipient, and the packing list. They use this to handle and deliver your shipment, and may contact you or the recipient about it. We choose partners for each route and may change them, so we do not list them here. If you would like to know which partners handled your booking, ask us.
- Our currency exchange partner, only if you ask for a currency exchange rate and tick the box to agree. They receive your name, email address, phone number and the details of your request, and use them to contact you about it. If you go ahead with them, they use your information under their own privacy policy, including the identity checks the law requires of them. If you would like to know who our partner is, ask us. If you withdraw your agreement, we stop passing on your details and ask our partner to stop contacting you.
- Customs and border authorities in the UK, in the destination country and in any country your items pass through.
- Our service providers: the companies that host our website and email, Cloudflare, which protects our website, and postcodes.io, a postcode lookup service. When you type a UK postcode on our forms, our website sends that postcode, and nothing else about you, to postcodes.io to suggest matching postcodes and check that it exists.
- Professional advisers, such as accountants and lawyers, where needed.
- Police, HMRC, regulators or courts, where the law requires it or to prevent fraud or crime.
- A buyer of our business, if all or part of it is sold. They would have to protect your information in the same way.
Transport partners and customs authorities also use your information for their own legal and operational purposes, under their own privacy policies and the law of their country.
We do not sell your personal information. We do not pass your details to insurers. The only time we pass your details to another company for it to contact you is when you ask us to, as with a currency exchange request.
Sending information abroad
Deliveries abroad. To deliver items to another country, we must send the recipient's details and the packing list to our partners and to the customs authorities in that country. This can also apply to countries your items pass through. Some of these countries do not have data protection laws that the UK recognises as adequate. We make these transfers because they are necessary to carry out the contract you asked for, in your interest and the recipient's (UK GDPR, Article 49(1)(b) and (c)).
Our service providers. Where a service provider processes personal information outside the UK, we make sure it is protected, for example by using providers in countries the UK recognises as adequate, or under the UK's approved data transfer agreements.
How long we keep your information
We keep information only as long as we need it. After that, we delete it or make it anonymous.
| Information | How long we keep it |
|---|---|
| Quotes that do not become bookings | 12 months |
| Bookings, packing lists, customs paperwork, invoices and payment records | 6 years from the end of the financial year in which the booking was completed |
| Claims and complaints | 6 years after the claim or complaint is closed |
| Messages that are not linked to a booking | 12 months |
| Currency exchange requests, including your agreement to us passing them on | 12 months |
| IP addresses and browser user agents recorded with a quote, booking or message | 12 months |
| Reviews | For as long as the review is published, and removed within 30 days of a request |
We keep booking and payment records for 6 years because HMRC expects business records to be kept for at least that long, and 6 years is also the time limit for most contract claims in England and Wales.
Your rights
You have the right to:
- access the personal information we hold about you;
- correct information that is wrong or incomplete;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to us using your information, in particular where we rely on legitimate interests;
- receive a copy of information you gave us in a format you can reuse or pass to someone else, where we use it under a contract or with your consent; and
- withdraw consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
Some rights depend on the lawful basis we use, and some have exceptions. For example, we must keep tax records for a set time even if you ask us to delete them. If we cannot do what you ask, we will explain why.
Recipients named in a booking have the same rights.
To use any of these rights, email email us. It is usually free. We will reply within one month. If your request is complex, we may extend this by up to two more months, and we will tell you if we do. We may ask you to confirm your identity first.
Cookies
Cookies are small files that a website stores in your browser. We only use cookies that the website needs to work securely, so the law does not require us to ask for your consent. We tell you about them here.
| Cookie | What it does | Who gets it | How long it lasts |
|---|---|---|---|
| __RequestVerificationToken | Security: helps stop other websites sending forms to our site in your name | Anyone who opens a form on our website | Until you close your browser |
| Cloudflare security cookies, such as __cf_bm and cf_clearance | Security: help Cloudflare tell people from automated attacks, and remember that you passed a security check | Visitors Cloudflare needs to check | Usually 30 minutes or less |
| .NETKLIPAUTH and __netklip_msg | Keep our staff signed in to the admin area and show them messages there | Our staff only | Up to 8 hours, or until the browser closes |
We do not use advertising cookies or analytics cookies. If we ever add analytics, we will ask for your consent first where the law requires it, and update this policy.
You can block or delete cookies in your browser settings. If you block the security cookies, our forms may not work.
Keeping your information safe
We protect your information with encrypted connections (HTTPS) across the whole website, security checks on our forms, limits on who can reach our admin area, and access for staff only where they need it.
Your booking page link is private. Please do not share it.
Please do not send us card details by email.
Children
Our service is for adults. You must be 18 or over to book with us.
Complaints
If you are unhappy with how we have handled your information, please contact us first at email us. We will acknowledge your complaint within 30 days and reply without undue delay.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it last changed. If we make a significant change, we will tell customers with open bookings by email.