1. Who we are
Vecor Ltd, trading as BoxPac, is the data controller responsible for the personal information collected and processed through our website www.boxpac.net and in the course of supplying products to you. Our registered office and principal trading address is Mill Road, Cromford, Matlock, Derbyshire, DE4 3RQ. Our company registration number is 15072131.
If you have any questions about this Privacy Policy or wish to exercise any of your rights described below, please contact us at sales@boxpac.net or write to us at our trading address above.
2. The personal information we collect
We collect and process the following categories of personal information about you:
- Identity and contact data: your name, billing and delivery address, email address, telephone number and, if you are a Trade Customer, your business name and VAT number.
- Account data: username, password and order history (for registered account holders).
- Transaction data: details of products you have purchased, payment confirmations, and the date and method of payment. Full card numbers are processed directly by our payment provider and are not stored on our servers.
- Technical data: IP address, browser type and version, operating system, referring URLs, time-zone setting, and similar information collected automatically through cookies and similar technologies.
- Marketing and communications data: your preferences in receiving marketing from us and your communication preferences.
- Customer service data: records of any correspondence between us and you, including chat logs, email threads and call notes.
3. How we collect your information
- Directly from you, when you register for an account, place an order, contact us, or sign up to our newsletter.
- Automatically, through cookies and similar technologies when you use the Site, in accordance with our cookie practices below.
- From third parties, such as our payment providers (confirmation of transactions), couriers (delivery information), Shopify (technical and platform data) and analytics providers (aggregated usage data).
4. Why we process your information and our lawful bases
Under UK GDPR we must have a lawful basis for each purpose for which we process your personal information. Our purposes and the corresponding bases are:
- To process and fulfil your order: performance of a contract with you.
- To create and manage your account: performance of a contract with you.
- To provide customer support: performance of a contract with you and our legitimate interests in providing high-quality service.
- To send order-related communications (dispatch, delivery, invoices): performance of a contract with you.
- To send marketing communications: your consent (which you may withdraw at any time) or, where you are an existing customer and the marketing relates to similar products, our legitimate interests under the soft opt-in rules.
- To prevent fraud and ensure security: our legitimate interests in protecting our business and our customers.
- To comply with legal obligations: for example, retaining tax records, our legal obligation.
- To improve the Site and our services: our legitimate interests, supported by anonymised analytics where possible.
5. Who we share your information with
We share your personal information only where necessary with the following categories of recipients:
- Shopify as our e-commerce platform provider, hosting the Site and providing storefront and order management infrastructure.
- Payment providers such as Shopify Payments, PayPal, Klarna and Apple Pay, who process your payment under their own privacy notices.
- Couriers and logistics providers such as Royal Mail, DPD, Parcelforce and pallet networks, to deliver your order.
- Communications providers such as our email service provider, for transactional and (where opted in) marketing emails.
- Analytics and advertising providers such as Google Analytics and Google Ads, to understand site usage and the effectiveness of advertising. These cookies are only set with your consent.
- Professional advisers such as accountants, auditors, lawyers and insurers, where reasonably required.
- Regulators and public authorities where we are required to disclose information by law (for example to HMRC) or in connection with the prevention of fraud or crime.
We do not sell your personal information.
6. International transfers
Some of our service providers are based outside the United Kingdom or the European Economic Area. Where we transfer your personal information outside the UK or EEA we ensure a similar degree of protection is afforded to it by using one or more of the following safeguards: transfer to countries that have been deemed to provide an adequate level of protection by the UK government or the European Commission; use of the UK International Data Transfer Agreement or Standard Contractual Clauses; or, where relevant, a derogation permitted under UK GDPR.
7. How long we keep your information
- Order and transaction records: 7 years from the end of the tax year to which they relate, to comply with HMRC record-keeping rules.
- Account data: for as long as your account is active. If you close your account, we will retain the data for a further 12 months before deletion, except where longer retention is required for legal or accounting reasons.
- Marketing data: until you withdraw consent or unsubscribe.
- Customer service correspondence: 3 years from the date of the last correspondence.
- Cookies and technical data: as set out in our cookie practices below.
8. Your rights
Under UK GDPR you have the following rights in relation to your personal information. To exercise any of these rights please contact us at sales@boxpac.net. We will respond within one calendar month and may extend this by a further two months if your request is particularly complex (we will notify you if so).
- Right of access: to obtain a copy of the personal information we hold about you.
- Right to rectification: to have inaccurate personal information corrected.
- Right to erasure: to have your personal information deleted in certain circumstances.
- Right to restrict processing: to ask us to suspend the processing of your personal information in certain circumstances.
- Right to data portability: to receive your personal information in a structured, commonly used, machine-readable format.
- Right to object: to object to processing based on our legitimate interests, and to object to direct marketing at any time.
- Right to withdraw consent: where we rely on your consent, you may withdraw it at any time.
- Right to lodge a complaint: with the Information Commissioner’s Office if you believe we have not handled your personal information correctly. We would, however, appreciate the chance to address your concerns before you approach the ICO.
9. Cookies
Our Site uses cookies and similar technologies to provide essential functionality, remember your preferences, run analytics, and (with your consent) deliver relevant marketing. When you first visit the Site you will be presented with a cookie banner allowing you to accept, reject or customise non-essential cookies. You can change your preferences at any time via the cookie settings link in the footer.
Essential cookies are necessary for the Site to function (for example, to keep items in your basket) and are set automatically. All other cookies require your consent.
10. Security
We use appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include HTTPS encryption sitewide, access controls on our systems, regular security reviews and staff training. No method of transmission over the internet is completely secure, but we work to protect your personal information using industry-standard methods.
11. Children
Our Site and services are not directed at children under the age of 13, and we do not knowingly collect personal information from anyone under 13. If you believe we hold information about a child, please contact us and we will delete it.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top of this page shows when the latest version came into effect. Where the changes are significant we will draw them to your attention by email or by a prominent notice on the Site.
13. Contact and complaints
If you have any questions or concerns about this Privacy Policy or how we process your personal information, please contact us at sales@boxpac.net or write to us at our registered office. You also have the right to complain to the Information Commissioner’s Office: www.ico.org.uk or 0303 123 1113.