Privacy Policy

Last Updated: January 21, 2026

This Privacy Policy explains how The Cardboard Boxes ("we", "us", or "our") collects, uses, stores, and shares your personal information when you use our services ("Services"), including when you:

• Visit our website at https://thecardboardboxes.co.uk
• Contact us through our website or any other communication channel
• Request a quote, place an order, or sign up for marketing communications
• Take part in any of our sales, marketing, or business-related activities

This policy should be read alongside our Terms and Conditions.

1. Who We Are (Data Controller)

For the purposes of UK data protection law, The Cardboard Boxes is the data controller.

Registered UK Contact Address:
39 Argyle Road, Ilford, London, IG1 3BH, United Kingdom

Email: support@thecardboardboxes.co.uk
Phone: +44 7478 076 088

This Privacy Policy applies to users of our UK website and our UK-based services.

2. What Information We Collect

A. Personal Information You Give Us

We may collect personal information that you choose to share with us, such as:

• Full name
• Email address
• Phone number
• Billing and delivery address
• Company name and job title
• Order details and custom packaging requirements
• Artwork and design files you upload for printing
• Communication preferences

We don't intentionally collect any special category (sensitive) personal data.

It's your responsibility to make sure the information you give us is accurate and kept up to date.

B. Information We Collect Automatically

When you use our website, we may automatically collect:

• IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on each page
• Referring URLs
• Approximate location (city/country level)

We use this data for security, analytics, and to keep our website running smoothly.

3. Cookies and Tracking Technologies (PECR Compliance)

We use cookies and similar technologies to run our website and understand how it's used.

Types of cookies we use:

• Strictly necessary cookies: needed for the site to function
• Analytics cookies (such as Google Analytics), used only with your consent
• Marketing cookies: used only if you opt in

We don't place non-essential cookies unless you give us explicit consent through our cookie banner. You can change or withdraw your cookie preferences whenever you like.

4. How We Use Your Information

We only process personal data where it's legally permitted, which includes:

• Providing quotes, orders, and customer support
• Producing your order, including printing your approved artwork
• Responding to enquiries and requests
• Processing payments securely
• Arranging delivery of your order
• Improving website performance and user experience
• Sending marketing communications, but only if you've opted in
• Detecting fraud, security threats, and misuse
• Meeting our legal and regulatory obligations

5. Legal Bases for Processing (UK GDPR)

Under UK GDPR, we rely on these lawful bases:

• Consent: for marketing emails, cookies, and optional communications
• Contract: to provide the products or services you've asked for
• Legal obligation: for tax, accounting, and regulatory compliance
• Legitimate interests: to run and improve our business (this doesn't cover direct marketing without consent)

You can withdraw your consent at any time.

6. Marketing Communications (PECR)

We'll only send marketing emails to UK users where:

• You've actively opted in, or
• A lawful "soft opt-in" applies (existing customers, similar products, with the option to opt out)

Every marketing email we send includes an unsubscribe link, and you're free to opt out whenever you want.

7. Payment Processing

Payments are handled securely by third-party providers, including:

• Stripe
• PayPal
• Other supported payment gateways

We don't store your full card details. Payment providers act as independent data controllers and handle your data under their own privacy policies.

8. Data Sharing

We never sell your personal data, and we don't share it with third parties for their own marketing purposes.

We share your data only with the service providers we need to run the business and fulfil your order, and where the law requires it. That may include:

• Delivery and courier companies, who receive your name, delivery address and phone number so they can deliver your order
• Payment processors, such as Stripe and PayPal
• Website hosting and infrastructure providers (such as AWS or Cloudflare)
• Analytics providers (such as Google Analytics, on a consent basis)
• Professional advisers or legal authorities, where required by law

These providers process your data on our instructions under written agreements, and only for the purposes we've set out here.

9. Your Artwork and Design Files

We own the print files, tooling and materials used to make our products. We don't sell or share your artwork with third parties for their own use, and we only pass it to our production and printing partners as far as needed to make your order.

We may display photographs of custom printed boxes we've produced as examples of our work, on our website, in samples, or in marketing material. If you'd rather we didn't use your design that way, just email us and we won't.

10. International Data Transfers

Your data may be processed in the UK and the United States, since we use a mix of UK- and US-based servers.

Where personal data is transferred outside the UK, we make sure appropriate safeguards are in place, such as:

• The UK International Data Transfer Agreement (IDTA), or
• The UK Addendum to Standard Contractual Clauses (SCCs)

These safeguards keep your data protected to UK GDPR standards.

11. Data Retention

We only keep personal information for as long as it's needed, which includes:

• Fulfilling our contractual obligations
• Meeting legal, accounting, or tax requirements
• Resolving disputes and enforcing agreements

Order and payment records are kept for six years to meet UK tax and accounting rules. Artwork files are kept while you remain a customer so we can handle repeat orders, and you can ask us to delete them at any time.

Once data is no longer needed, we delete or anonymise it securely.

12. Data Security

We use appropriate technical and organisational measures to protect your data, including encryption, access controls, and secure servers.

That said, no system is completely secure, so any data transmission is at your own risk.

13. Children's Data

Our Services aren't intended for children under 13.

We don't knowingly collect personal data from children, and if we identify any, we'll delete it promptly.

14. Your Rights Under UK GDPR

You have the right to:

• Access your personal data
• Request that inaccurate data be corrected
• Request deletion ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Withdraw consent at any time

To exercise any of these rights, contact support@thecardboardboxes.co.uk. We'll respond within one month.

15. Complaints (UK Authority)

If you believe we've handled your data unlawfully, please tell us first so we can try to put it right. You also have the right to complain to:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk

16. Changes to This Policy

We may update this Privacy Policy from time to time. Any updates will be posted on this page with a revised date.

17. Contact Us

If you have any questions about this Privacy Policy or your data, you can reach us at:

The Cardboard Boxes UK
39 Argyle Road, Ilford, London, IG1 3BH, United Kingdom
support@thecardboardboxes.co.uk
+44 7478 076 088
Hours: 9:00am to 5:00pm, Monday to Friday