Privacy policy

Who we are

Custom Boxez is the trading name of Custom Boxez Limited, which is the controller responsible for the personal data described in this policy. In this policy, 'we', 'us' and 'our' mean Custom Boxez Limited.

We sell custom printed packaging mainly to businesses. If you contact us on behalf of a business, this policy covers the personal data we hold about you as that business's contact.

You can contact us about this policy or your personal data by email at quotes@customboxez.co.uk or by phone on +44 7446 230747 (10:00–18:00 UK time).

The personal data we collect

Depending on how you use our website and services, we may collect:

• Contact details: your name, email address, phone number, company name and, if you give it, your job title.
• Enquiry and quotation details: the product specification (box style, dimensions, quantity, materials and finishes), your required delivery date, your delivery address or postcode, and anything else you tell us about your project.
• Artwork and files: artwork, logos, dielines, photographs and other files you send us. These can contain personal data if you include it, such as a name or signature.
• Conversations: emails, phone calls and messages with our team, and conversations with Aura, our AI chat assistant.
• Order and payment records: what you ordered, delivery details, invoices and payment status. Payments are processed by Stripe; we do not store card details.
• Marketing attribution data, only if you consent: advertising click identifiers (gclid, gbraid and wbraid), campaign (UTM) tags, the page you first landed on, the website that referred you and when you arrived.
• Website usage data, only if you consent: the pages you view and how you use the site, your device and browser type and your approximate location, collected by Google Analytics and Google Ads through Google Tag Manager.
• Technical data: your IP address, browser details and the pages requested, recorded by our website hosting provider so it can deliver and secure the site.

How we use your data and our lawful bases

UK data protection law requires a lawful basis for each way we use personal data. Ours are:

Where we rely on legitimate interests, we have weighed them against your interests and rights. You can ask us for more information about that assessment.

• To answer enquiries and prepare quotations: to take steps you ask for before entering into a contract or, where you act for a business, our legitimate interest in responding to business enquiries.
• To produce, deliver and support your order, including proofs, production, delivery and reorders: performance of our contract with you or, where you act for a business, our legitimate interest in performing our contract with that business.
• To take payment, issue invoices and keep accounting records: performance of a contract and compliance with our legal obligations, including tax and company law.
• To run Aura and hand conversations to our staff: our legitimate interest in answering questions promptly and following up on requests you make in the chat.
• To measure which pages, campaigns and adverts lead to enquiries, using analytics, advertising and attribution data: your consent, which you can withdraw at any time.
• To keep our website, systems and records secure and to prevent fraud and misuse: our legitimate interests.
• To establish, exercise or defend legal claims: our legitimate interests.
• To send you news or offers by email: your consent or, where the law allows, our legitimate interest in telling existing customers about similar products. Every marketing email will include a simple way to opt out.

Quote requests

When you use our online quote form, the details you enter and any files you upload are passed to our team so we can prepare your quotation. We use them to check the specification, prepare a dieline and proof, and follow up with you about your enquiry.

You do not have to use the form. You can send the same information by email to quotes@customboxez.co.uk or talk it through with us by phone on +44 7446 230747.

Aura, our AI chat assistant

Aura is an automated chat assistant that answers questions about packaging on our website. It is powered by an AI model provider, which processes the messages you type in order to generate Aura's replies.

Conversations are kept so that Aura can continue the conversation, so that a member of our team can read it and take over the same conversation when you ask for a person or when Aura cannot help, and so that we can follow up on any request you make, such as a quotation.

Aura's answers are general guidance. Aura does not make decisions that have legal or similarly significant effects on you: quotations, prices and delivery timing are always confirmed by our team.

Please do not share sensitive personal information, payment details or passwords in the chat. If you would rather speak to a person, ask Aura, email quotes@customboxez.co.uk or call +44 7446 230747.

Cookies, analytics and advertising

We use Google Tag Manager to manage analytics and advertising tools on our website, Google Analytics 4 to understand how the site is used, and Google Ads to measure and improve our adverts. These tools only store or read information on your device if you accept them in our cookie banner, as the Privacy and Electronic Communications Regulations require.

If you consent to advertising cookies, we also keep a small record in your browser of how you arrived at our website: the advertising click identifier (gclid, gbraid or wbraid), any campaign (UTM) tags, the page you landed on and the website that referred you. If you then send a quote request or start a chat, that record is attached to it so we can see which campaigns lead to enquiries.

Google processes this data under its own terms and, for some advertising purposes, as a separate controller. You can change your choices at any time; our Cookie Policy explains the categories we use and how to change them.

Payments

Payments are processed by Stripe; we do not store card details. Card details go to Stripe, which processes them under its own terms and privacy policy. We receive confirmation of the payment and limited details of the transaction, such as the amount and date.

Who we share your data with

We do not sell your personal data. We share it only with organisations that help us run our business, and only as much as they need:

Our service providers act on our instructions under contracts that require them to protect your data. Where a recipient uses data for its own purposes, as Stripe and Google may, its own privacy policy also applies.

• our website hosting provider, which serves the website and keeps technical logs to secure it;
• our content management system provider, which stores the content of the website;
• our database provider, which stores quote requests and Aura conversations for us on servers in London, in the UK (files you attach to a quote request are stored with our content management system provider, which also holds a request temporarily if the database is unavailable, so that it is not lost);
• our email provider, which carries emails between you and our team, and any email delivery provider we use to send automatic messages such as enquiry confirmations;
• the AI model provider that powers Aura;
• Google, for analytics and advertising measurement, only if you consent;
• Stripe, to process payments;
• the production, finishing and delivery partners that make and deliver your order, who receive the specification, artwork and delivery details they need;
• our professional advisers, such as accountants and lawyers, and our insurers, where needed;
• the police, regulators, courts or other authorities, where the law requires it or to protect our rights;
• a buyer or successor, if our business or its assets are sold or reorganised, who must continue to protect your data in line with this policy.

International transfers

Some of our service providers, or the companies they use, may process personal data outside the UK.

Where that happens, we make sure the transfer is protected as UK law requires: for example, because the UK has recognised the destination as providing an adequate level of protection, or by using the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. You can ask us for details of the safeguards that apply to your data.

How long we keep your data

We keep personal data only for as long as we need it for the purposes in this policy, and then delete or anonymise it. In particular:

• Enquiries and quotations that do not become orders are kept for a limited period, so we can answer follow-up questions and requote.
• Orders, invoices and accounting records are kept for as long as UK tax and company law requires.
• Artwork and specifications for orders are kept while you may reasonably want to reorder, unless you ask us to delete them sooner.
• Aura conversations are kept for as long as we need them to answer and follow up on your enquiry.
• Analytics and attribution data are kept for the periods set in the tools we use, and the attribution record in your browser expires automatically.
• Technical logs are kept for the short period set by our hosting provider.

Your rights

Under UK data protection law you have the right to:

To use any of these rights, contact us at quotes@customboxez.co.uk. We may need to confirm your identity first. We will respond within one month; for complex requests this can be extended by up to two further months, and we will tell you if that happens. There is usually no charge.

• access the personal data we hold about you and receive a copy;
• have inaccurate or incomplete data corrected;
• have your data erased in certain circumstances;
• restrict how we use your data in certain circumstances;
• object to our use of your data where we rely on legitimate interests, and object at any time to direct marketing;
• receive data you gave us in a portable format, or have it sent to another organisation, where the law allows;
• withdraw your consent at any time where we rely on consent, without affecting what we did before you withdrew it.

Keeping your data secure

We use appropriate technical and organisational measures to protect personal data, including access controls so that only people who need your data can see it. No method of sending information over the internet is completely secure, so please do not send payment details or passwords by email or in the chat.

If a personal data breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office where the law requires it.

Complaints

If you have a concern about how we use your personal data, please contact us first at quotes@customboxez.co.uk so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.

Children

Our website and services are intended for businesses and adults. We do not knowingly collect personal data from children.

Changes to this policy

We will update this policy when our services, our providers or the law change. The effective date shows when it last changed. If a change significantly affects how we use your data, we will tell you.