General
 

boxxe Limited, a company incorporated in England and Wales with company number 02109168 and registered office at Artemis House, Eboracum Way, York, YO31 7RE (“boxxe”) together with any group companies (“we” “us” “ours”) is committed to protecting and respecting your privacy and personal data. 
 

For the purposes of data protection legislation, we are the data processor and we will process your personal data in accordance with the UK - General Data Protection Regulation (EU) 2016/679, the Data Protection Act 2018 and any other applicable national laws which relate to the processing of personal data.
 

When we use the term “services”, we are referring to all the services that we offer on our own behalf, including our product offerings. We are not referring to services that we provide solely on behalf of a third party, such as outsourced IT services we may provide to another company or software licenses from a third party. Please refer to the privacy notice of the third party with which you have a relationship for information on how they engage service providers, like us, to process personal information on their behalf. 
 

How and why we process your data
 

This privacy policy describes how boxxe collects, uses, shares, retains and destroys personal data that you provide to us or that we collect when you visit the website or when you purchase goods or services from us.
 

We will collect your data when you engage with us over various media (telephone, email or via our website). This will be transactional data when you request information or purchase a product or service from us and we use the contract between us and you as the legal basis for processing your personal data. Where a contract is not yet in place, we use consent or legitimate interest as the legal basis for processing your personal data. 
 

We collect your data to enable the transaction for goods or services that you request from boxxe. This information is necessary for providing any pre sales information you have requested, the delivery of goods or services and the support that you expect from boxxe.
 

Types of data we collect
 

The data we collect includes, but is not limited to:

boxxe do not collect or process sensitive personal data (race, ethnic origin, political opinion, religious or philosophical beliefs, trade union membership, genetic data, biometric data, sexual orientation of health data).
 

If you fail to provide personal data
 

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide the data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example to provide you with our goods or services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.
 

Data processing principles
 

To ensure your data is being processed correctly, we have adopted the following general principles for data processing in accordance with applicable data protection laws:

Who We Share Your Data with
 

We may need to disclose your personal data to third parties for the performance of a contract with you, to meet a legal obligation or for our legitimate interests, which may include but is not limited to:

Overseas transfers and sharing personal data with sub-processors
 

Your personal data may be transferred to, and processed in, countries other than the UK, and these countries may have data protection laws that differ from the laws of the UK. 
 

Specifically, our group companies and our website servers are located in the EU and UK, however, some of our third-party service providers, and partners operate around the world. This means that when we collect your personal data, we may process it in a number of different countries.
 

However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this privacy policy. These include implementing the International Data Transfer Agreement (IDTA) and the international data transfer addendum to the European Commission’s standard contractual clauses for international data transfers (Addendum) for transfers of personal data between us and each of our sub-processors, which requires all sub-processors to protect personal data they process from the UK in accordance with UK data protection laws.  Our IDTA and Addendum can be available on request. 
 

Visitors to our website
 

We use Google Analytics cookies to collect data about the visitors to the site which includes the number of visitors, session duration, pages visited during the session etc. This information is anonymous and cannot be used to identify you personally.
 

Our website may, from time to time, contain links to and from the websites of third parties and if you purchase products or services from us, those manufacturers, suppliers or partners may also have their own policies. Please note that if you follow a link to any of these websites, such websites will apply different terms to the collection and privacy of your personal data, and we do not accept any responsibility or liability for these policies. When you leave our website, we encourage you to read the privacy notice/policy of every website you visit.
 

Marketing
 

We also use your information to send you personal communications for events, services or updates that we consider may be of a legitimate interest to you. These may include information about webinars, events, products and services. You can opt-out of marketing communications at any time by sending an email to Marketing@boxxe.com or following any unsubscribe link on an email received from us. 
 

We do not sell any of our marketing data to third parties. 
 

Data Retention and Disposal
 

We retain your personal data for as long as is necessary to fulfil the purpose that we collected it for, including the satisfaction of any legal, accounting or reporting requirements. This includes data for tax and accounting requirements under applicable law. If you make a purchase from boxxe, we will keep the information for tax and accounting requirements under applicable law.
 

Data is reviewed regularly and only retained where necessary. To determine the appropriate retention period of your data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from a loss of confidentiality to the data and any legal requirements to retain such personal data. Once any legal requirements have expired for the data, we destroy all personal data associated with you and the product or service that you have purchased.
 

Data Security
 

The confidentiality of your information is extremely important to us. boxxe use reasonable physical, technical and organisational measures to safeguard the personal data you provide to us.
 

All data collected by boxxe is stored on our own IT system that is administered by boxxe staff. The boxxe IT system has been accredited to ISO 27001, Cyber Essentials and Cyber Essentials Plus.
 

Your Rights
 

It is important that the personal data we hold about you is accurate and current. Please keep us informed if the personal data we hold about you changes.
 

Data protection legislation provides you with several rights which you can enforce by contacting us at privacy@boxxe.com, including:

 

If you would like a copy of some or all of your personal data, please send an email to privacy@boxxe.com . In certain circumstances we reserve the right to charge a reasonable fee to comply with your request and we will ensure we respond to you within the deadlines set out within the applicable legislation.
We may request specific information from you to help us confirm your identity and your right to access, and to provide you with the personal data that we hold about you or make your requested changes. Data protection legislation may allow or require us to refuse to provide you with access to some or all the personal data that we hold about you or to comply with any requests made in accordance with your rights referred to above. If we cannot provide you with access to your personal data, or process any other request we receive, we will inform you of the reasons why, subject to any legal or regulatory restrictions.
 

Please send any requests relating to the above to privacy@boxxe.com specifying your name and the action you would like us to undertake.
 

Policy Changes
 

From time to time, we may need to update or modify this policy to reflect changes in our organisation or business practices, data collection practices or legislation. We reserve the right to amend this policy at any time, for any reason, without notice to you, other than the posting of the amended policy on this website. It is recommended to check the website regularly for the most up to date version.
 

Contact Us
 

We welcome any comment regarding this policy. You can contact us by email at privacy@boxxe.com or by mail to boxxe Limited, Artemis House, Eboracum Way, York, YO31 7RE. This is in addition to your right to contact the Information Commissioners Office if you are unsatisfied with our response to any issues you raise at https://ico.org.uk/global/contact-us/
 

This privacy policy was last updated: September 2022