Privacy policy
Business Boxed Limited respects your privacy. This policy explains what personal data we collect through this website and in the course of our business, why we collect it, how we keep it safe and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who is responsible for your data
Business Boxed Limited, company number 07946924, registered office Coppice House, Halesfield 7, Telford, TF7 4NA, is the data controller for personal data collected through this website and for our own business contacts. You can contact us about data protection at mike@bbxd.net or on 07859 881298.
2. The data we collect
| When | What | Why and legal basis |
|---|---|---|
| You use the contact form | Name, company, email address, the topic you select and the message you write | To respond to your enquiry and arrange a call. Legal basis: our legitimate interest in responding to enquiries, and taking steps at your request before entering into a contract. |
| You email or phone us | Your contact details and the content of our correspondence | To communicate with you about our services. Legal basis: legitimate interest and, where relevant, performance of a contract. |
| You become a customer or supplier | Business contact details, contract and billing information, correspondence and records of the work we do | To deliver and manage our services and meet our accounting obligations. Legal basis: performance of a contract and legal obligation. |
| You browse this website | Server logs held by our hosting provider, including IP address, browser type, pages requested and time of request | To keep the website secure and available. Legal basis: legitimate interest. |
We do not collect special category data through this website, and we do not knowingly collect data from children.
3. Cookies and analytics
This website does not set any cookies and does not use analytics or advertising trackers. Details are in our cookie policy. If we introduce analytics in future we will update that policy and, where required, ask for your consent first.
4. Data we process on behalf of customers
When we provide consultancy, development, migration or support services, we may have access to personal data held in your Business Central system or related systems, such as the details of your customers, suppliers and employees. In that case you are the controller and we act as your processor, only on your documented instructions and under a data processing agreement. We do not use that data for any purpose of our own.
5. Who we share data with
We do not sell personal data. We share it only with service providers who help us run our business and who are bound by contract to protect it, including our website hosting provider, our email and productivity provider (Microsoft 365), and our accountants and professional advisers. We may also disclose data where the law requires it.
6. International transfers
Our systems are hosted in the United Kingdom and the European Economic Area wherever possible. Where a provider processes data outside the UK, we rely on an adequacy regulation or the UK International Data Transfer Agreement or Addendum to ensure your data remains protected.
7. How long we keep data
- Contact form enquiries that do not lead to an engagement: 12 months.
- Customer and supplier records: for the duration of the relationship and 7 years afterwards, to meet our legal and accounting obligations.
- Website server logs: as retained by our hosting provider, normally no more than 90 days.
8. Security
We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), multi factor authentication on our business systems, access limited to those who need it, and regular review of our suppliers' security practices.
9. Your rights
You have the right to ask us for access to the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, email mike@bbxd.net. We will respond within one month. If you are not satisfied with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
11. Jobs board
Posters. When you post a job we collect your name, email address, company and the listing details, plus the IP address of the submission. We use them to review and publish the listing, to forward applications to you, to send listing confirmations, expiry reminders and a private management link, and to contact you about the listing. Legal basis: performance of a contract (providing the listing service) and legitimate interest in preventing abuse. We keep listings and poster details for 24 months after the listing expires.
Candidates. When you apply through the site we collect your name, email address, phone number if given, covering note and CV. We send these by email to the poster of that role, who then becomes an independent data controller for your application. We keep a record of your name, email, phone and covering note for 12 months for the purposes of fraud prevention and to evidence what was sent; we do not keep a copy of your CV on our systems after it has been emailed. Legal basis: your consent, given when you submit the application, which you can withdraw by contacting us, although we cannot retrieve information already passed to the poster.
Job alerts. If you subscribe to job alerts we store your email address and chosen filters and send a weekly email of matching roles. Subscriptions are confirmed by email (double opt-in) and every email contains an unsubscribe link, which deletes your record immediately. Legal basis: consent.
Usage counts. We count views and applications per listing to show posters how their role is performing. These counts are not linked to individuals.
12. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed. Significant changes will be highlighted on this page.