Privacy Policy

1. Who We Are (Data Controller)

Pug Mug Marketing Ltd (trading as Box Off) is the data controller for personal data collected through the Box Off platform and website.

• Company number: 10371822
]
• Privacy contact: info@boxoff.co.uk

As data controller, we determine the purposes and means of processing your personal data and are responsible for it being handled lawfully and securely.

2. Personal Data We Collect

We collect and process the following categories of personal data:

2.1 Account and Identity Data

• Name and email address (provided when you register)
• Phone number (if provided)
• Business name and trade type
• Account username and encrypted password

2.2 Billing Data

• Billing name and address
• VAT number (if applicable)
• Payment transaction references and history

We do not store full card numbers. All payment card data is processed and stored by our third-party payment processor in accordance with PCI-DSS standards. We only receive a payment token and the last four digits of your card.

2.3 Business Data You Enter

This is data you actively input into the platform, including:

• Customer names, addresses, phone numbers, and email addresses
• Job details, notes, and jobsheet content
• Quotes and invoice information
• Materials and supplier records

You are the data controller for any personal data belonging to your customers that you enter into Box Off. You are responsible for ensuring you have a lawful basis to process your customers' data and for complying with your own data protection obligations towards them. Box Off processes this data on your behalf as a data processor.

2.4 Technical and Usage Data

• IP address and approximate location (country/region)
• Browser type and version
• Device type and operating system
• Pages visited and features used within the platform
• Login timestamps and session data
• Error logs and crash reports

2.5 Communications Data

• Emails, messages, or support requests you send to us
• Survey responses or feedback you voluntarily provide

2.6 Cookie Data

See Section 10 (Cookies) for full details.

3. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

Purpose	Data used	Legal basis
Creating and managing your account	Account & identity data	Contract performance
Providing the Box Off platform	Account, business, technical data	Contract performance
Processing subscription payments	Account & billing data	Contract performance
Sending transactional emails (receipts, account notices)	Account data	Contract performance
Providing customer support	Account & communications data	Contract performance / Legitimate interests
Diagnosing technical issues and improving the platform	Technical & usage data	Legitimate interests
Security monitoring and fraud prevention	Technical & usage data	Legitimate interests
Complying with legal and tax obligations	Billing & account data	Legal obligation
Sending marketing emails about Box Off features and offers	Account data	Consent (you can opt out at any time)

4. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

• Contract performance: Processing necessary to provide the service you have subscribed to or requested
• Legitimate interests: Processing for our legitimate business interests (such as improving our service, security, and fraud prevention) where these are not overridden by your interests or rights
• Legal obligation: Processing required to comply with our legal obligations (such as tax and accounting requirements)
• Consent: Where you have given us clear, informed consent — principally for marketing communications. You can withdraw consent at any time

5. Sharing Your Data with Third Parties

We do not sell your personal data.

We may share your data with the following categories of third parties where necessary:

• Payment processor: To handle subscription billing securely (e.g. Stripe or similar). They process card data under their own privacy policy and PCI-DSS compliance
• Email service provider: To send transactional and account-related emails on our behalf
• Cloud hosting and infrastructure provider: Our platform is hosted on cloud infrastructure. Data may be stored on servers located in the UK or EEA
• Analytics tools: We may use privacy-respecting analytics to understand how the platform is used (aggregated, non-identifiable where possible)
• Professional advisers: Solicitors, accountants, and auditors, under obligations of confidentiality
• Law enforcement or regulators: Where we are legally required or compelled by a court order

We require all third-party service providers to maintain appropriate security measures and only process your data on our instructions.

6. International Data Transfers

Some of our third-party service providers may process data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place, such as:

• The recipient country has been granted UK adequacy status by the Secretary of State
• Standard contractual clauses approved by the ICO
• Other appropriate transfer mechanisms recognised under UK GDPR

7. How Long We Keep Your Data

Data type	Retention period
Account and identity data	For the duration of your account, plus 30 days after closure to allow data export, then deleted. Financial records retained for 7 years (legal requirement)
Business data you entered	For the duration of your account, plus 30 days after closure, then permanently deleted
Billing records	7 years from the date of the transaction (legal requirement for VAT/tax purposes)
Technical and usage logs	Up to 12 months
Support and communications	3 years from last contact
Marketing consent records	Until consent is withdrawn, plus 12 months for record-keeping

After the relevant retention period, data is securely and permanently deleted or anonymised.

8. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. Most of these can be exercised free of charge. We will respond to all requests within one month, though we may extend this by a further two months for complex requests.

8.1 Right of Access

You have the right to request a copy of the personal data we hold about you (a "subject access request").

8.2 Right to Rectification

You have the right to ask us to correct inaccurate or incomplete personal data we hold about you.

8.3 Right to Erasure ("Right to be Forgotten")

You have the right to ask us to delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purposes for which it was collected. This right does not apply where we are required to retain data by law (such as financial records).

8.4 Right to Restrict Processing

You have the right to ask us to pause the processing of your personal data in certain circumstances — for example, while the accuracy of data is being verified.

8.5 Right to Data Portability

You have the right to receive a copy of personal data you provided to us in a commonly used, machine-readable format, and to have that data transmitted to another provider where technically feasible. You can also export your data directly from within the Box Off platform at any time.

8.6 Right to Object

You have the right to object to our processing of your personal data where we rely on legitimate interests as our legal basis. You also have an absolute right to object to processing for direct marketing purposes — including profiling for marketing — at any time.

8.7 Rights Related to Automated Decision-Making

You have the right not to be subject to decisions made solely by automated processing that have a significant effect on you. Box Off does not currently make any solely automated decisions about you.

8.8 Right to Withdraw Consent

Where we process your data on the basis of your consent (e.g. marketing emails), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at info@boxoff.co.uk or write to us at our registered address. We may need to verify your identity before responding to your request.

9. Marketing Communications

We will only send you marketing emails if you have given us your consent, or where you are an existing customer and we are contacting you about similar products or services (the "soft opt-in" under PECR).

You can unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any marketing email, or by emailing info@boxoff.co.uk. We will process your opt-out promptly, within no more than 10 working days.

10. Cookies

Our website and platform use cookies — small text files stored on your device — to make things work properly and to help us understand how you use Box Off.

10.1 Essential / Functional Cookies

These cookies are strictly necessary for the platform to function. They include your login session cookie that keeps you logged in while you use Box Off. You cannot opt out of these without stopping using the platform.

10.2 Analytics Cookies

We may use analytics tools (such as anonymised page-view tracking) to understand which features are used and how the platform performs. Where we use analytics cookies, we will ask for your consent via a cookie banner.

10.3 Managing Cookies

You can control and delete cookies via your browser settings. Please note that disabling certain cookies may affect the functionality of the Box Off platform. For more information, visit allaboutcookies.org.

11. Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, disclosure, or destruction. These measures include:

• Encrypted data transmission (HTTPS/TLS)
• Encrypted password storage (hashed and salted)
• Access controls limiting who within our team can access personal data
• Regular automated backups
• Monitoring for unusual access patterns

No system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with our legal obligations.

12. Children's Data

Box Off is a business platform intended for use by adults aged 18 or over. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

13. Links to Other Websites

Our website may contain links to third-party websites. This Privacy Policy does not apply to those websites and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party websites you visit.

14. Your Right to Complain

If you are unhappy with how we have handled your personal data, please contact us first at info@boxoff.co.uk so we can try to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection matters:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law, our data practices, or our services. We will notify you of material changes by email or by displaying a prominent notice on our website. The "last updated" date at the top of this page shows when the policy was most recently revised.

Your continued use of Box Off after any changes constitutes your acceptance of the updated policy.

16. Contact Us

For any privacy-related questions, requests to exercise your rights, or data protection concerns, please contact us:

• Email: info@boxoff.co.uk
• Company: Pug Mug Marketing Ltd (trading as Box Off)

We aim to respond to all privacy enquiries within 5 working days.