Privacy Policy

Last Updated: 8 March 2026

OfficeBox AI ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Our Data Collection Philosophy

We collect only the data you explicitly choose to provide. In line with our core business of keeping your data private, we take a minimalist approach to data collection. We do not automatically harvest information about you when you browse our website.

2. Information We Collect

We collect personal data only through the following explicit channels:

2.1 Information You Provide to Us

We collect personal data that you voluntarily submit to us through:

• Contact forms: Name, email address, phone number, company name, and any other details you include in your message.
• Direct communications: Information you provide via email, telephone, or in-person consultations.
• Order information: Details required to process your purchase, including delivery address. Payment information is processed securely by our third-party payment providers and is not stored by us.
• Marketing preferences: Your explicit consent preferences for receiving communications from us.

We do not collect any personal data automatically when you visit our website. We do not use tracking scripts, device fingerprinting, or other automated data collection technologies that operate without your knowledge.

3. What We Do Not Collect

We do not:

• Store cookies on your device.
• Collect your IP address or geographic location.
• Use third-party analytics services that track you personally.
• Build profiles of your browsing behaviour.
• Sell or share your personal data with data brokers or advertisers.

4. Anonymised Website Analytics

We reserve the right to collect anonymised, aggregated data relating to website performance and usage patterns. This may include:

• Total page view counts.
• Aggregate traffic sources (without individual tracking).
• General performance metrics such as page load times.

This data is strictly anonymised and cannot be used to identify individual visitors. We do not collect or store IP addresses, geo-location data, or any other information that could be used to personally identify you through our analytics.

5. How We Use Your Information

We use your personal data only for the following purposes:

• To respond to enquiries: Processing and responding to your questions submitted via contact forms or direct communication (legitimate interest).
• To fulfil orders: Processing your purchase, arranging delivery and installation, and providing customer support (contractual necessity).
• To comply with legal obligations: Maintaining records for tax, accounting, and regulatory purposes (legal obligation).
• To improve our website: Using anonymised analytics to identify technical issues and improve site performance (legitimate interest).

6. Data Sharing & Third Parties

We do not sell your personal data. We share data only when necessary to deliver our services:

• Service providers: Payment processors (who handle payment data directly), shipping companies, and installation partners who require access to perform their contractual duties.
• Professional advisers: Lawyers, accountants, and insurers where legally necessary.
• Legal authorities: When required by law or to protect our legal rights.

All third parties are contractually bound to process your data only for specified purposes and in accordance with data protection laws.

7. International Transfers

We are based in the United Kingdom and process personal data primarily within the UK and European Economic Area (EEA). Where data must be transferred outside these areas (for example, to shipping partners in the USA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data:

• Encryption of data in transit using industry-standard protocols.
• Secure access controls and authentication requirements for our systems.
• Regular security assessments and staff training on data protection.
• Secure data storage with reputable cloud service providers.

While we employ robust security measures, no system is entirely immune from risk. We will notify you and the relevant supervisory authority of any data breach that poses a risk to your rights and freedoms, in accordance with our legal obligations.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

• Enquiry and consultation records: 2 years from the date of last contact, unless you become a customer.
• Order and transaction records: 7 years (UK tax and accounting legal requirement).
• Customer support records: 3 years from the date of the last interaction.
• Anonymised analytics data: Retained indefinitely as it cannot identify individuals.

10. Your Rights

Under UK data protection law, you have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data.
• Right to erasure: Request deletion of your data where there is no overriding legal basis for us to retain it.
• Right to restrict processing: Request that we limit the processing of your data in certain circumstances.
• Right to data portability: Receive your data in a structured, commonly used format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time (this does not affect the lawfulness of processing prior to withdrawal).

To exercise any of these rights, please contact our Data Protection Officer at dpo@officeboxai.com. We will respond within one month of receiving your request.

11. Children's Privacy

Our products and services are intended for business use and are not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with a revised "Last Updated" date. For significant changes, we will provide notice via a prominent banner on our website.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at contact@officeboxai.com.

You may also write to us by postal letter at our registered office address on Companies House.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data in accordance with data protection law.