Privacy Notice

1. Who this notice covers

This notice applies to website visitors, customers, prospective customers, providers, provider applicants, business-account users, referral contacts and people who communicate with Box and Van. BOX AND VAN LTD is the data controller unless a separate written arrangement says otherwise.

2. Personal data we may collect

• Names, email addresses, telephone numbers and contact preferences.
• Collection, delivery, billing and business addresses.
• Quote, booking, service, item, access, route and timing information.
• Payment status, billing references, refunds and payout records supplied by payment providers; Box and Van does not store full payment-card details on its own systems.
• Support messages, complaints, claims, photos, videos and other service evidence.
• Provider identity, business, vehicle, insurance, compliance, bank/payout and service-capability information.
• Business-account organisation, authorised-user, billing, portal and usage information.
• Referral source, campaign, tracked-link or QR-scan information where a referral route is used.
• Basic technical, security, session and request information needed to operate and protect the website and platform.

3. Where the data comes from

We collect data directly from people using our website and services, from customers or authorised business users placing bookings, from providers during onboarding and service delivery, from payment and infrastructure providers, from support and claims interactions, and from approved referral or business-partner routes where relevant.

4. Why we use personal data

• Provide quotes, create and manage bookings and arrange services.
• Match work to suitable approved providers and manage the job lifecycle.
• Process deposits, payments, refunds, subscriptions and provider payouts.
• Verify provider identity, insurance, vehicle and service compliance.
• Operate customer, provider and business portals and maintain account security.
• Send service, account, payment and support communications.
• Investigate claims, complaints, fraud, misuse, safety issues and disputes.
• Maintain legal, tax, accounting, insurance, audit and regulatory records.
• Measure referral performance and attribute referred quotes or bookings to the correct partner.
• Improve and protect the reliability and security of Box and Van systems.
• Send marketing where permitted by law and provide opt-out controls where required.

5. Our lawful bases

Depending on the activity, Box and Van relies on contract, legal obligation, legitimate interests and consent. Contract is used where data is needed to provide or prepare a booking, provider relationship or business account. Legal obligation is used where records or disclosures are required by law. Legitimate interests may apply to fraud prevention, platform security, service administration, referral attribution and proportionate business improvement. Consent is used where the law requires it, including certain marketing or non-essential storage/access technologies.

6. Who we may share data with

• Independent providers carrying out or preparing to carry out a booking.
• Payment and billing providers, including Stripe.
• Database, hosting, infrastructure and platform providers, including Supabase and the services used to host Box and Van.
• Email, messaging and communications providers used for service and account communications.
• Insurers, claims handlers, professional advisers and dispute-resolution parties where relevant.
• Business customers and their authorised users where a booking belongs to that business account.
• Referral partners only to the extent needed to operate an approved referral arrangement; Box and Van does not provide them with customer conversations or unnecessary personal data.
• Law-enforcement, courts, regulators or public authorities where disclosure is required or lawfully necessary.

7. Referral tracking

When someone opens an approved Box and Van referral link or QR code, Box and Van may record the referral source, partner, campaign, scan and destination so a later quote or booking can be attributed correctly. New referral links carry that attribution through the navigation and server-side booking flow without setting a persistent referral-tracking cookie.

Older referral cookies issued before this change may remain on a device until they expire or are deleted. They are retained only for backwards compatibility while those legacy cookies expire.

8. Cookies and similar technologies

Box and Van may use cookies or local/session storage that are necessary for security, authentication, session handling, checkout or another service requested by the user. If Box and Van introduces non-essential analytics, advertising or other storage/access technologies that require consent, the cookie policy and consent controls will be updated before they are used in that way.

9. Retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected. As a general rule, customer, provider and business-account records may be retained for up to six years after the relevant booking or relationship ends, with longer retention where necessary for legal claims, tax and accounting, fraud prevention, insurance, regulation or unresolved disputes.

10. International transfers

Some service providers may process data outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, Box and Van will use an appropriate lawful transfer mechanism or another permitted safeguard.

11. Your data-protection rights

• Ask for access to personal data held about you.
• Ask for inaccurate or incomplete data to be corrected.
• Ask for erasure where the legal conditions are met.
• Ask for processing to be restricted in applicable circumstances.
• Object to certain processing, including direct marketing and some legitimate-interest processing.
• Request data portability where the legal conditions apply.
• Withdraw consent at any time where consent is the lawful basis, without affecting earlier lawful processing.
• Raise a concern about automated decision-making where applicable under data-protection law.

12. How to make a privacy request or complaint

Privacy requests can be sent to support@boxandvan.co.uk or admin@boxandvan.co.uk. We may request proportionate proof of identity where necessary to protect the data from unauthorised disclosure.

If you are unhappy with how personal data has been handled, contact Box and Van first so we can investigate. You also have the right to complain to the UK Information Commissioner's Office.

13. Changes to this notice

This notice may be updated when Box and Van changes its services, systems, suppliers or legal obligations. The current version published on the website applies from its stated review date.