Privacy PolicyPrivacy Policy

Box 3 Projects Ltd (trading as Box 3 Projects, "we", "us", "our") is a company registered in England and Wales under company number 00000000, with its registered office at Level 5, 55 Broadway, London SW1H 0BD.

We are the "data controller" of any personal data we collect about you through our website at https://box3projects.co.uk ("the Site"), through correspondence by email or phone, and in the course of providing our services.

If you have any questions about this policy or how we handle your data, please contact us at hello@box3projects.co.uk.

We collect personal data that you provide to us directly, that is generated through your use of the Site, and that we receive from third parties such as analytics providers. The categories of personal data we typically process are set out below.

Information you give us

• Identity and contact data — your name, company name, job title, email address and phone number, when you complete a contact form, request a callback, or correspond with us.
• Project data — details about a project, brief or enquiry that you choose to share with us, including any attachments or supporting documents.
• Recruitment data — your CV, employment history and references when you apply for a role with us.

Information we collect automatically

• Technical data — IP address, browser type and version, device type, operating system, referring URL, and pages visited on the Site.
• Usage data — how you interact with the Site, including session duration, scroll depth, and which pages or links you engage with.
• Cookie data — see the Cookies section below.

We do not knowingly collect any special-category data (such as health, ethnicity, religion, political opinions, biometric or genetic data) through the Site, and we do not collect data from anyone we know to be under 16.

We use your personal data only where we have a lawful basis to do so under the UK GDPR and the EU GDPR. The principal purposes and lawful bases on which we rely are:

• To respond to enquiries, prepare proposals and provide our services to you — necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract.
• To communicate with you about a live project, including updates, scheduling and invoicing — necessary for the performance of our contract with you.
• To process job applications and assess your suitability for a role — necessary for taking steps at your request prior to entering into an employment contract, and our legitimate interest in recruiting suitable candidates.
• To improve the Site and our services, including by analysing usage and performance — our legitimate interest in operating and improving our business.
• To comply with legal, regulatory and tax obligations — necessary to comply with a legal obligation.
• To send marketing communications about our work — based on your consent, which you can withdraw at any time.

We will never sell your personal data, and we do not use it for any automated decision-making or profiling that produces legal or similarly significant effects.

Our Site uses a small number of cookies and similar technologies to make the Site work and to help us understand how visitors use it. We use the following categories:

• Strictly necessary cookies — required for the Site to function (for example, to remember your cookie preferences). These are always set.
• Analytics cookies — help us measure how visitors interact with the Site so we can improve it. These are only set with your consent.

When you first visit the Site you will be asked to accept or decline non-essential cookies. You can change your choice at any time through your browser settings, or by clearing the cookies set by our domain.

We share your personal data only where it is necessary, lawful, and proportionate. The categories of recipients are:

• Service providers we engage to operate our business — including hosting (Netlify), content management (Sanity), email delivery, and analytics providers. Each is bound by a written data-processing agreement.
• Professional advisers — including our accountants, insurers and lawyers, where the disclosure is necessary for them to provide services to us.
• Project partners — where you have engaged us on a project, we may share relevant details with subcontractors, designers, suppliers and other parties strictly to deliver the project.
• Authorities and regulators — where we are required to do so by law, or to establish, exercise or defend legal claims.

We do not sell, rent or trade your personal data, and we do not share it for third-party advertising.

Some of our service providers are based outside the UK and the European Economic Area. Where personal data is transferred to a country that has not been deemed to provide an adequate level of protection, we put in place appropriate safeguards — typically the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or equivalent measures — to ensure your data continues to be protected.

If you would like a copy of the safeguards we use, please contact us at hello@box3projects.co.uk.

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including any legal, accounting, or reporting requirements. The retention periods we typically apply are:

• General enquiries — 24 months from your last contact with us, after which the record is deleted unless you become a client.
• Client project records — for the duration of the engagement and for 7 years afterwards, to comply with our tax, contractual and professional-indemnity obligations.
• Recruitment data — 12 months from the close of the recruitment round, unless you ask us to keep your details on file.
• Analytics data — aggregated and retained for up to 26 months in line with our analytics provider's defaults.

Under the UK GDPR and the EU GDPR you have the following rights in relation to your personal data:

• Right of access — to ask for a copy of the personal data we hold about you.
• Right to rectification — to ask us to correct any data that is inaccurate or incomplete.
• Right to erasure — to ask us to delete your data in certain circumstances.
• Right to restriction — to ask us to limit how we use your data.
• Right to data portability — to ask us to provide your data in a structured, commonly used and machine-readable format.
• Right to object — to object to our processing of your data where we rely on a legitimate-interests basis, or to direct marketing.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out beforehand.

To exercise any of these rights, please email us at hello@box3projects.co.uk. We will respond within one month, and we will not charge a fee unless your request is manifestly unfounded or excessive.

If you are not satisfied with our response you have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk, or with the supervisory authority in your EU member state of residence.

We take the security of your personal data seriously. We use appropriate technical and organisational measures — including encryption in transit, access controls, and staff training — to protect your data against unauthorised access, accidental loss, alteration or disclosure.

No method of transmission over the internet is 100% secure. Where we have given you (or where you have chosen) a password, you are responsible for keeping it confidential.

We may update this policy from time to time to reflect changes in our practices or in the law. The date at the top of the page shows when it was last updated. Where the changes are significant we will draw them to your attention through the Site or by email.

If you have any questions about this policy, or about how we handle your personal data, please contact:

Box 3 Projects Ltd
Level 5, 55 Broadway, London SW1H 0BD
Email: hello@box3projects.co.uk
Phone: +44 (0)20 8050 7815