PRIVACY POLICY — BOX & VAN

Box and Van is a trading name of Rhys Gordon, a UK sole trader. For the purposes of UK data protection law, Box and Van is the controller of personal information collected through the website and the managed booking service unless another organisation is identified as the controller for a particular activity.

Privacy contact: support@boxandvan.co.uk

Website: boxandvan.co.uk

Depending on how you use Box and Van, we may collect:

• Name, email address and phone number
• Collection, delivery and service addresses
• Quote, booking, inventory, access, parking and service details
• Business-account information where a booking is made for an organisation
• Provider, vehicle and compliance information where you apply to work with Box and Van
• Photographs or other evidence supplied for job completion, damage, claims or support
• Support messages, call notes and other communications with us
• Payment references, amounts and payment status. Card details are processed by Stripe and are not stored by Box and Van
• Technical and security information such as IP address, browser/device information, session data and application logs
• Referral, campaign or attribution information where you arrive through a tracked link or code

We use personal information only where we have a lawful basis. The basis depends on the activity:

• Contract and steps before a contract: providing quotes, taking bookings, arranging Providers, processing booking changes and providing customer or provider portal access.
• Legal obligations: accounting, tax, responding to lawful requests and meeting regulatory obligations that apply to the service.
• Legitimate interests: operating and improving the service, preventing fraud and misuse, maintaining security, handling complaints and disputes, monitoring service quality and keeping appropriate operational records. We consider these interests against your rights and expectations.
• Consent: where consent is specifically requested for an optional activity. You can withdraw consent for that activity at any time.

We share only the information reasonably needed for the relevant purpose. Recipients may include:

• The Provider assigned to, offered or managing a booking, where necessary to deliver the service
• Payment processors such as Stripe
• Cloud hosting, database and application infrastructure providers
• Email, SMS, telephony and other communications providers used to deliver service messages
• Address, mapping or routing providers where required for quoting and service delivery
• Professional advisers, insurers and claims handlers where relevant
• Law-enforcement, courts, regulators or other authorities where disclosure is required or permitted by law

We do not sell personal information.

Some technology or communications suppliers may process information outside the United Kingdom. Where a restricted international transfer takes place, we require an appropriate lawful transfer mechanism or other safeguard required by UK data protection law.

You can contact us if you would like more information about safeguards relevant to your personal information.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including providing the service, maintaining accounting and business records, meeting legal requirements, preventing fraud and resolving complaints, claims or disputes.

Retention periods vary by record type. When information is no longer required, we delete it, anonymise it or otherwise remove it from normal operational use where appropriate.

Parts of the quote, pricing, booking and provider-matching process use software rules. These rules help calculate prices, identify suitable jobs or Providers and flag unusual or higher-risk cases for review.

Larger, unusual or otherwise flagged jobs may require manual review before a final booking is confirmed. If you believe an automated process has produced an incorrect result, contact us so we can review the relevant information.

Depending on the circumstances and lawful basis, you may have rights to:

• Request access to personal information we hold about you
• Ask us to correct inaccurate or incomplete information
• Ask us to delete information in circumstances where the law gives you that right
• Ask us to restrict how information is used
• Object to processing based on legitimate interests
• Receive or transfer certain information in a portable format where the right applies
• Withdraw consent at any time where we rely on consent

To exercise a right, email support@boxandvan.co.uk. We may need to verify your identity before acting on a request.

Please contact us first if you have a concern about how we use personal information so we have an opportunity to address it.

You also have the right to complain to the UK Information Commissioner's Office (ICO). Information about making a complaint is available at ico.org.uk.

Box and Van uses cookies or similar browser storage where needed for functions such as secure sessions, portal access, booking continuity, security and referral attribution.

If optional analytics, advertising or similar non-essential technologies are introduced, they must be handled in accordance with the applicable cookie and consent requirements.

We use technical and organisational measures intended to protect personal information from unauthorised access, loss, alteration or disclosure. No online service can guarantee absolute security.

We may update this notice as the service, suppliers or legal requirements change. The date at the top shows when the published notice was last updated.