Privacy policy

Last updated: 30 October 2026

Who we are and how to contact us

BOXZY LTD, trading as Boxzy, is responsible for the personal information it uses to operate www.boxzy.co.uk, fulfil orders and support customers. We are a company registered in England and Wales, company number 12763606. Our registered office is PO Box MBX138, 592 London Road, MBX138, Isleworth, England, TW7 4EY.

For privacy questions, rights requests or complaints, email info@boxzy.co.uk, use our contact form, or write to Boxzy Privacy, BOXZY LTD, 592 London Road, Isleworth, TW7 4EY, United Kingdom.

Information we use and where it comes from

  • Information you give us: name, email, billing and delivery address, any telephone number you supply, account information, orders, returns, wishlist choices, gift messages and customer enquiries.
  • Transaction information: purchased items, amounts, payment status, payment references, limited payment-method information, delivery tracking and refund records. Payment providers process the payment details entered at checkout; do not send full card details in an email or contact message.
  • Website information: IP address, browser and device information, logs and security events, and cookie or similar-technology information about browsing, basket activity and preferences, subject to the relevant privacy controls.
  • Information from others: payment and fraud-prevention providers, Shopify and store-service providers, and carriers may supply payment, security, order and delivery updates. If you give us another person's details for a gift delivery, please tell them about this notice and provide only what is needed.

We need the contact, delivery and payment information necessary to process an order; without it, we may be unable to accept or fulfil the order. Optional marketing choices are not a condition of purchase. Please avoid including sensitive personal information about yourself or others in gift messages or ordinary enquiries.

Why we use information and our legal bases

  • Taking and fulfilling orders, payments, delivery and contractual returns: performance of our contract with you, or steps you ask us to take before a contract.
  • Delivering a gift to someone named by the buyer: our legitimate interests and the buyer's legitimate interests in sending the requested gift, using only the recipient information needed for delivery.
  • Customer accounts, requested wishlist or gift features and pre-purchase assistance: providing the service you request; our legitimate interests in administering customer relationships where the activity is not necessary for a contract.
  • Customer enquiries, complaints, security, fraud prevention and handling legal claims: our legitimate interests in assisting customers, protecting people and the business, securing the store and establishing or defending legal rights; compliance with a legal obligation where applicable.
  • Tax, accounting, statutory consumer obligations and privacy requests: compliance with our legal obligations.
  • Email marketing: your consent. Where the legal existing-customer exception is used, our legitimate interests in promoting our own similar products, provided you were offered an opt-out when your details were collected and in every marketing message. You can object to direct marketing at any time.
  • Optional analytics, advertising and preference technologies: consent where required. Strictly necessary technologies support the service you request; related personal information is used to perform our contract or for our legitimate interests in operating and securing the store.

Where we rely on legitimate interests, those interests must be balanced against your rights and reasonable expectations. You may contact us for more information about that assessment.

Cookies, similar technologies and marketing choices

Cookies and similar technologies support the basket, checkout, security and consent choices. Optional preference, analytics and marketing technologies can remember choices, measure use of the store and help personalise or measure advertising. Optional purposes requiring consent must not be activated unless you agree. Rejecting optional cookies does not prevent an ordinary purchase.

Use the store's cookie banner or cookie-preferences page to accept, reject or change optional purposes. If you cannot find that control, contact us using the details above. Your browser can also block or delete cookies, although blocking necessary cookies may affect basket or checkout functions. Clearing cookies can remove a saved consent choice. Cookie names, providers, purposes and durations depend on the active technologies and are described in the cookie-preferences information where provided. Shopify explains its cookies in its Cookie Policy.

You can unsubscribe from promotional emails using the unsubscribe link in each message or by emailing us. Withdrawing consent does not affect the lawfulness of earlier processing. Order, delivery and other necessary service messages are separate from promotional emails.

Who receives information

We share information needed for the relevant purpose with:

  • Shopify, which hosts the store and supplies checkout, account, messaging, security and related commerce services.
  • Payment providers and financial institutions for payment, refund, fraud and dispute handling. A provider such as Klarna applies its own privacy notice when you choose its service.
  • Royal Mail and delivery or fulfilment providers for dispatch, tracking and returns. Where an order is fulfilled by a supplier, that supplier receives the information needed to fulfil it.
  • Store-service providers for email and support, consent management, wishlists, gift options, order documents, search and store administration; and analytics or advertising providers where those services are enabled and permitted by your choices.
  • Professional advisers, authorities or another party to a business transaction where reasonably necessary for legal compliance, advice, protecting rights or a genuine business reorganisation, subject to applicable data-protection requirements.

We use service providers under appropriate contractual arrangements. Some organisations, including payment providers and Shopify for certain services, also act as independent controllers and explain their own processing in their privacy notices.

Shopify's enhanced services

Shopify Network Intelligence is enabled for this store. Shopify may use information about interactions with this store together with information from other Shopify merchants and services to improve and personalise services and advertising, subject to applicable law and privacy choices. For these enhanced services Shopify acts as an independent controller. See Shopify's Consumer Privacy Policy for its uses, rights and controls, including its privacy-request portal. Where consent is required, optional processing must respect your consent choice.

Information processed outside the UK

Shopify and other service providers may process information outside the UK, including in the EEA, Canada and the United States. For transfers subject to UK transfer restrictions, the applicable route is a UK adequacy regulation covering the destination and recipient, or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses. Shopify's arrangements are described in its Data Processing Addendum. Contact us for information about the safeguards relevant to your information and how to obtain a copy, subject to lawful redactions.

How long information is kept

Information must be kept only as long as needed for its purpose and applicable legal requirements. Necessary order, invoice and accounting records are normally kept for six years from the end of the company financial year to which they relate, and longer where a tax enquiry, legal obligation or ongoing dispute requires it. This does not mean every item of browsing or marketing information needs to be kept for six years.

For account, enquiry, support, security and consent records, the retention criteria are whether the account or feature remains in use, the time needed to resolve the matter, the need to demonstrate consent or honour an objection, applicable claim periods and any ongoing investigation. Information no longer needed should be deleted or anonymised. A limited suppression record may be retained to avoid sending marketing after an opt-out. Cookie retention varies by purpose and provider; session cookies expire with the session and persistent cookies remain until their expiry or deletion.

Your privacy rights

Depending on the circumstances, you may request access to your personal information, correction, erasure, restriction of processing, or a portable copy of information you provided where portability applies. You may withdraw consent at any time without affecting earlier lawful processing. These rights are subject to the conditions and exemptions in data-protection law; for example, an erasure request does not require deletion of records we must retain by law.

You have an absolute right to object to use of your information for direct marketing, including associated profiling. You may also object to processing based on legitimate interests, on grounds relating to your particular situation.

Send requests to info@boxzy.co.uk or use the contact or postal details above. No particular wording or paid service is required. We may ask for proportionate information to confirm identity or clarify a request. We respond within the time required by law, normally one month for a rights request, with any lawful extension explained. A fee or refusal is possible only where the law allows it.

Payment and security providers may use automated checks to assess fraud or payment risk. If an automated check affects an order, contact us so we can explain the relevant process, review matters within our control and direct you to the provider where appropriate. Any applicable rights to information, human intervention and contesting a significant automated decision remain available.

Privacy complaints

You can complain by email, contact form or post using the details at the start of this notice. Tell us what happened and what you would like us to investigate; an order number or particular form is not required. We will acknowledge a data-protection complaint within 30 days, make appropriate enquiries, keep you informed and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO). Visit ico.org.uk/make-a-complaint, call 0303 123 1113, or write to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Contacting us first can help resolve concerns but does not remove your right to complain to the ICO.

Updates

We may update this notice when our services, practices or legal requirements change. The date above identifies this version. Where required, we will give additional notice or request fresh consent; publishing an update does not itself provide consent.