Privacy Policy
Last updated: March 2026
1. Introduction
Branded Boxes ("we", "our", "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website at brandedboxes.eu or use our services, in accordance with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).
2. Data Controller
Branded Boxes is the data controller responsible for your personal data. If you have any questions about this policy or our data practices, please contact us at support@brandedboxes.eu.
3. Information We Collect
We collect personal data that you voluntarily provide to us, including:
- Contact details (name, email address, telephone number, company name)
- Delivery and billing addresses
- Order details, specifications, and packaging requirements
- Artwork and design files uploaded for production
- Payment information processed securely through our payment providers
- Communications and correspondence with us
When you visit our website, we may automatically collect:
- IP address and device information
- Browser type and version
- Pages visited and time spent on each page
- Referring website addresses
- Information collected through cookies and similar technologies
4. Lawful Basis for Processing
We process your personal data on the following lawful bases under the GDPR:
- Contract: To fulfil orders and provide our packaging services to you
- Legitimate interests: To improve our website, prevent fraud, and manage our business
- Consent: To send you marketing communications where you have opted in
- Legal obligation: To comply with tax, accounting, and regulatory requirements
5. How We Use Your Information
We use your personal data to:
- Process and fulfil your packaging orders
- Communicate with you about your orders, quotes, and enquiries
- Send quotes, invoices, and delivery updates
- Improve our website, products, and services
- Send marketing communications (only with your consent)
- Comply with our legal and regulatory obligations
- Prevent fraud and enhance security
6. Information Sharing
We may share your personal data with:
- Manufacturing and printing partners who help fulfil your orders
- Delivery and courier services for order shipment across the EU
- Payment processors to handle transactions securely
- IT and hosting service providers who support our website infrastructure
- Professional advisers including accountants, auditors, and legal advisers
- Law enforcement or regulatory bodies where required by law
We do not sell your personal data to third parties under any circumstances.
7. International Transfers
Your personal data is primarily stored and processed within the European Economic Area (EEA). Where we transfer data outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR requirements, such as standard contractual clauses approved by the European Commission or adequacy decisions.
8. Cookies and Tracking
We use cookies and similar technologies to enhance your browsing experience, analyse website traffic, and understand how visitors interact with our website. We use Google Analytics to help us understand how our website is used. Under EU ePrivacy rules, we obtain your consent before placing non-essential cookies. You can manage your cookie preferences at any time through your browser settings or our cookie consent tool.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission, secure servers, and access controls. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours as required by the GDPR.
10. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Order records and financial data are typically retained for 7 years in accordance with EU tax and accounting requirements. Marketing consent records are retained until you withdraw consent. We regularly review and securely delete data that is no longer required.
11. Your Rights Under GDPR
Under EU data protection law, you have the following rights:
- Right of access: Request a copy of the personal data we hold about you
- Right to rectification: Request correction of inaccurate or incomplete data
- Right to erasure: Request deletion of your personal data in certain circumstances
- Right to restrict processing: Request that we limit how we use your data
- Right to data portability: Request a copy of your data in a machine-readable format
- Right to object: Object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent: Withdraw consent at any time where processing is based on consent
- Right not to be subject to automated decision-making: Not to be subject to solely automated decisions that significantly affect you
To exercise any of these rights, please contact us at support@brandedboxes.eu. We will respond to your request within one month as required by the GDPR.
12. Complaints
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with your local EU data protection supervisory authority. A full list of EU supervisory authorities is available on the European Data Protection Board website at edpb.europa.eu.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated revision date. Where changes are material, we will notify you by email or prominent notice on our website prior to the change becoming effective.
14. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at support@brandedboxes.eu or visit our Contact Page.