1. Introduction

BizBoxed ("BizBoxed", "we", "us", "our") is committed to processing personal data responsibly, securely and transparently.

This GDPR Compliance Policy explains our approach to compliance with:

the UK General Data Protection Regulation ("UK GDPR");
the Data Protection Act 2018;
the EU General Data Protection Regulation ("EU GDPR") where it applies to our processing; and
other applicable UK data protection requirements.

It also explains the circumstances in which BizBoxed acts as a Data Controller or Data Processor and sets out our standard data-processing commitments where we process personal data on behalf of a BizBoxed customer.

This policy should be read together with our:

Privacy Policy
Cookie Policy
Terms of Service
Sub-Processor Register, where published or made available by BizBoxed

Our Privacy Policy is the primary customer-facing explanation of how BizBoxed collects and uses personal information.

This GDPR Compliance Policy provides additional information about our compliance framework, controller and processor responsibilities, data-processing arrangements and technical and organisational measures.

2. Who We Are

BizBoxed is a UK-based business platform and service ecosystem providing websites and business tools and services that may include CRM, bookings, invoicing, MTD, payments, business operations, AI-assisted functionality and related support services.

For data protection enquiries:

BizBoxed
Email: andy@bizboxed.uk

The role BizBoxed performs under data protection law depends on the purpose for which personal data is being processed.

3. Our Data Protection Roles

3.1 BizBoxed as Data Controller

BizBoxed generally acts as Data Controller where we determine why and how personal data is processed for our own business and service-delivery purposes.

This may include processing required to:

create and administer BizBoxed accounts;
authenticate users;
administer subscriptions;
provide customer support;
manage our relationship with customers and prospective customers;
operate and secure the BizBoxed platform;
maintain appropriate audit and security records;
communicate with customers and users;
administer billing and subscriptions;
comply with legal obligations; and
operate and improve our business and services.

Information supplied during signup or onboarding may fall within this controller role where BizBoxed determines the purposes for which it is collected and used.

3.2 BizBoxed as Data Processor

BizBoxed may act as Data Processor where a business customer uses BizBoxed to process personal data for purposes determined by that customer.

This may include personal data processed through:

customer websites;
CRM functionality;
booking systems;
website forms;
business-management tools;
invoicing or quoting functionality;
customer communications;
automations; and
other BizBoxed products through which a customer processes information about its own customers, staff, suppliers or other individuals.

In these circumstances, the BizBoxed customer will generally act as Data Controller and BizBoxed will process the relevant personal data on the customer's documented instructions, subject to applicable law and the agreed service.

3.3 Mixed processing roles

The same customer relationship may involve both roles.

For example, BizBoxed may act as Data Controller for the account information needed to authenticate and administer a BizBoxed user while acting as Data Processor for personal data that the customer's business enters into its CRM or booking system.

The role must therefore be assessed by reference to the particular processing purpose rather than simply by who supplied the information.

4. Data Protection Principles

Where applicable, BizBoxed seeks to process personal data in accordance with the principles of:

lawfulness, fairness and transparency;
purpose limitation;
data minimisation;
accuracy;
storage limitation;
integrity and confidentiality; and
accountability.

We review our services, systems and operational practices with these principles in mind.

5. Lawful Bases for Processing

Where BizBoxed acts as Data Controller, the lawful basis depends on the processing purpose.

5.1 Contract

We may rely on contractual necessity where processing is required to:

create or administer an account;
provide a subscribed service;
deliver requested functionality;
manage subscriptions;
provide customer support; or
take steps at an individual's request before entering into a contract.

5.2 Legitimate interests

We may rely on legitimate interests where appropriate, including for:

operating and improving BizBoxed;
maintaining security;
preventing fraud and misuse;
managing customer relationships;
maintaining appropriate operational records;
supporting customers;
protecting BizBoxed, our customers and users; and
relevant business-to-business communications where permitted.

Where we rely on legitimate interests, those interests must be balanced against the rights and interests of affected individuals.

5.3 Consent

We rely on consent where required for particular processing activities.

Where consent is the lawful basis, it may be withdrawn at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

5.4 Legal obligation

We may process personal data where necessary to comply with applicable legal, tax, accounting, regulatory or other obligations.

5.5 Other applicable lawful bases

Where another lawful basis is available under applicable data protection law, we may rely on it where appropriate.

Where BizBoxed acts as Data Processor, the customer acting as Data Controller is generally responsible for identifying the lawful basis for the underlying processing.

6. Categories of Personal Data

The categories processed depend on the BizBoxed products and services involved.

They may include:

6.1 Account and identity data

name;
email address;
phone number where applicable;
account and user identifiers;
profile information;
profile image;
account creation and activity information;
authentication and session information; and
subscription and product-entitlement information.

6.2 Authentication data

BizBoxed uses a specialist identity and authentication provider to operate account creation, sign-in, account verification, password recovery and related security functions.

Authentication credentials such as passwords and authentication factors are handled by the authentication provider.

BizBoxed does not store users' passwords within the BizBoxed application database.

6.3 Business and onboarding data

This may include:

business name;
business contact information;
business type;
trading information;
onboarding answers;
brand information;
service areas;
opening hours;
website requirements;
subscription information; and
other information supplied to configure or provide BizBoxed services.

6.4 Website and content data

This may include:

website pages;
text;
images;
logos;
files;
forms;
documents;
brand assets;
product or service content; and
other materials supplied to BizBoxed.

6.5 Technical and security data

This may include:

IP addresses;
browser and device information;
session identifiers;
authentication events;
timestamps;
application and server logs;
security events;
diagnostic information; and
other technical information required to operate and protect the service.

6.6 Customer-controlled data

Where BizBoxed acts as Data Processor, customers may choose to process personal data through BizBoxed products, including:

customer contact information;
CRM records;
booking information;
website form submissions;
invoice or quote information;
business-user or staff information;
communications;
operational records; and
other information entered into the relevant service.

Customers should avoid entering personal data that is unnecessary for the purpose for which they are using the service.

7. Special Category and Highly Sensitive Data

BizBoxed services are not generally designed on the assumption that customers will process special-category personal data unless a particular product or feature expressly supports that processing.

Customers are responsible for determining whether information they choose to enter into BizBoxed constitutes special-category data, criminal-offence data or other particularly sensitive information and for ensuring that they have an appropriate legal basis and safeguards.

Where a BizBoxed feature is specifically designed to process a category of information requiring additional safeguards, further product-specific terms, documentation or controls may apply.

8. Authentication and Identity Management

BizBoxed uses Clerk as its identity and authentication provider.

Clerk provides functions including:

account creation;
sign-in;
authentication;
account verification;
password recovery;
session management; and
authentication-related security communications.

Depending on account configuration and usage, Clerk may process:

user identifiers;
name;
email address;
phone number where applicable;
profile information;
account lifecycle information;
authentication and session information;
authentication credentials and factors; and
limited account metadata.

BizBoxed uses limited authentication-provider metadata for operational purposes such as subscription and product-entitlement status and billing-system identifiers.

BizBoxed's documented implementation does not use Clerk metadata as the source of BizBoxed roles or permissions.

Authentication data may be processed by Clerk and its authorised subprocessors as necessary to provide the authentication service.

Further information about relevant providers and subprocessors is available through the BizBoxed Sub-Processor Register where applicable.

9. Data Minimisation

BizBoxed seeks to process only personal data reasonably necessary for the relevant purpose.

This includes reviewing:

information collected through forms and onboarding;
account and identity information;
data passed to service providers;
application and security logs;
customer-controlled fields;
retention requirements; and
integrations with third-party services.

Customers using BizBoxed as Data Controllers are responsible for applying equivalent data-minimisation principles to the information they choose to collect and process through their BizBoxed services.

10. Data Accuracy

BizBoxed takes reasonable steps to keep personal data accurate where we are responsible for maintaining it.

Customers and users should keep their account and business information up to date.

Where BizBoxed acts as Data Processor, the relevant customer remains responsible for the accuracy of personal data it controls, while BizBoxed will provide reasonable functionality or assistance for correction where applicable.

11. Storage and Processing Locations

BizBoxed uses third-party service providers and infrastructure to operate its services.

As a result, personal data may be processed in:

the United Kingdom;
the European Economic Area;
the United States; and
other countries in which an authorised service provider or subprocessor operates.

We do not represent that all BizBoxed personal data is stored exclusively in the United Kingdom or European Economic Area.

Where processing involves a restricted international transfer, appropriate transfer arrangements are considered as described in Section 16.

12. Data Retention

BizBoxed retains personal data for no longer than reasonably necessary for the relevant processing purpose, taking account of applicable legal, regulatory, contractual, security and legitimate business requirements.

Retention may vary according to:

the category of data;
whether an account remains active;
the product or service involved;
customer instructions;
legal, tax and accounting obligations;
fraud and security requirements;
dispute and legal-claim periods;
backup and recovery requirements; and
whether information can appropriately be deleted or anonymised.

Termination or deletion of an account does not necessarily result in the immediate deletion of every related record.

For example, BizBoxed may need to retain certain:

billing records;
audit records;
security records;
transaction records;
support records; or
other information for which continued retention has a lawful basis.

Where BizBoxed acts as Data Processor, deletion and retention are also subject to the customer's documented instructions, the applicable service arrangement and any legal requirement that requires continued retention.

Backups may retain information for a limited period until they are overwritten or deleted through the applicable backup lifecycle.

BizBoxed reviews retention requirements and aims to delete or anonymise personal data when there is no longer a lawful or operational reason to retain it.

13. Data Subject Rights

Subject to applicable law and any relevant exemptions, individuals may have rights including:

access to personal data;
correction of inaccurate or incomplete personal data;
erasure;
restriction of processing;
objection to processing;
data portability;
withdrawal of consent where consent is relied upon; and
objection to direct marketing.

Requests relating to personal data for which BizBoxed is Data Controller can be sent to:

andy@bizboxed.uk

We may take reasonable steps to verify the identity of the requester.

Where BizBoxed acts as Data Processor and receives a request concerning customer-controlled data, we may refer the requester to the relevant Data Controller and provide reasonable assistance to that customer as required by applicable law and the processing arrangement.

Rights are not absolute. Information may sometimes need to be retained or processing continued where an applicable legal basis or exemption permits or requires it.

Further customer-facing information is available in our Privacy Policy.

14. Subprocessors and Service Providers

BizBoxed uses third-party providers to deliver parts of the BizBoxed service.

Depending on the products and features involved, these may include:

identity and authentication providers;
hosting and cloud infrastructure providers;
database and storage providers;
website and form-processing providers;
email delivery providers;
payment and billing providers;
communications providers;
security and monitoring providers;
AI service providers;
analytics providers;
business and operational service providers; and
providers supporting optional customer integrations.

These providers may themselves appoint authorised subprocessors as part of providing their services.

Where BizBoxed appoints a processor or subprocessor, we take appropriate steps to address applicable data-protection requirements, including contractual obligations where required.

Where BizBoxed acts as Data Processor for a customer, our subprocessor arrangements are also subject to the commitments in Section 20.

Further information about relevant service providers, their purposes and processing locations is available through our Sub-Processor Register, where published or made available by BizBoxed.

The providers used by BizBoxed may change as the platform develops. Where applicable law or an agreed processing arrangement requires notice of relevant subprocessor changes, BizBoxed will provide that notice in accordance with the applicable requirements.

15. Third-Party Integrations

Customers may choose to connect BizBoxed with independent third-party services.

Depending on the integration, the third party may:

act as a processor or subprocessor;
act as an independent controller; or
perform another role determined by the particular integration.

Where an independent provider determines its own purposes and means of processing, its own privacy policy and terms apply to that processing.

Customers are responsible for reviewing and configuring optional integrations appropriately for their own data-protection obligations.

16. International Data Transfers

Some BizBoxed service providers and their subprocessors operate outside the United Kingdom and European Economic Area.

Where personal data is subject to a restricted international transfer, BizBoxed takes appropriate steps to ensure that a lawful transfer mechanism and safeguards are used where required.

Depending on the provider, destination and circumstances, these may include:

UK or EU adequacy regulations or decisions;
recognised data-transfer frameworks;
Standard Contractual Clauses;
the UK International Data Transfer Addendum or other UK-approved transfer mechanisms;
supplementary technical or organisational measures where appropriate; or
another mechanism permitted by applicable data protection law.

The appropriate mechanism may differ between providers and may change where legal frameworks, certifications or provider arrangements change.

BizBoxed reviews relevant provider arrangements as part of its data-protection and supplier-management responsibilities.

Further information may be available through our Sub-Processor Register or by contacting us.

17. Security and Technical and Organisational Measures

BizBoxed uses technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Measures are selected according to the relevant system, processing activity and risk.

17.1 Authentication and access control

Measures may include:

secure authentication;
session controls;
role-based or permission-based access controls;
least-privilege access;
restricted administrative access;
multi-factor authentication where supported or required; and
separation of authentication from application authorisation where appropriate.

17.2 Communications and application security

Measures may include:

HTTPS and encrypted network communications;
input validation;
appropriate request validation;
rate limiting where applicable;
protection against common web-application vulnerabilities;
secure development practices;
dependency and security updates; and
controlled deployment processes.

17.3 Data and infrastructure security

Measures may include:

secure cloud infrastructure;
database access controls;
encryption provided by relevant infrastructure and service providers;
backups and recovery arrangements;
restricted access to production systems; and
appropriate separation of customer and business data.

17.4 Logging and monitoring

BizBoxed may maintain:

authentication records;
audit records;
security logs;
diagnostic logs;
application monitoring; and
operational alerts.

Logging should be proportionate to the relevant operational or security purpose and subject to data-minimisation and retention considerations.

17.5 Organisational measures

Measures may include:

access restrictions;
confidentiality requirements;
incident-response procedures;
supplier review;
data-minimisation practices;
documentation;
security review; and
periodic review of technical and organisational controls.

No technical system can guarantee absolute security.

18. Personal Data Breaches

BizBoxed maintains processes for identifying, investigating and responding to suspected personal-data breaches.

Where BizBoxed acts as Data Controller, we will:

investigate and take reasonable steps to contain the incident;
assess the nature and likely consequences of the breach;
document the incident and response;
notify the Information Commissioner's Office where required by applicable law;
notify affected individuals where required by applicable law; and
take appropriate remedial or preventative action.

Where UK GDPR requires notification to the ICO, the applicable requirement is generally to notify without undue delay and, where feasible, within 72 hours after becoming aware of a notifiable personal-data breach.

Where BizBoxed acts as Data Processor, we will notify the relevant Data Controller without undue delay after becoming aware of a personal-data breach affecting personal data processed on that controller's behalf, in accordance with applicable law and the processing arrangement.

19. Accountability and Privacy Governance

BizBoxed seeks to maintain appropriate accountability measures for its processing activities.

Depending on the processing and associated risk, these may include:

maintaining relevant data-protection documentation;
reviewing service providers;
maintaining processor and subprocessor information;
reviewing security controls;
applying privacy and data-minimisation principles to product development;
reviewing international transfer arrangements;
responding to data-subject requests;
maintaining incident-response procedures;
assessing higher-risk processing where required; and
reviewing policies when products, providers or legal requirements change.

Where applicable law requires a Data Protection Impact Assessment or another formal assessment for particular processing, BizBoxed will undertake the appropriate assessment.

20. Data Processing Agreement

20.1 Application of this section

This Section 20 forms BizBoxed's standard Data Processing Agreement ("DPA") for personal data that BizBoxed processes as Data Processor on behalf of a customer acting as Data Controller.

It should be read together with the applicable Terms of Service, order, subscription or other agreement governing the customer's use of BizBoxed.

If a separately executed data processing agreement applies between BizBoxed and a customer, that agreement will govern to the extent of any conflict with this standard DPA.

This DPA does not apply to processing for which BizBoxed acts as an independent Data Controller.

20.2 Subject matter

BizBoxed processes personal data on behalf of the customer as necessary to provide the BizBoxed products and services selected and configured by that customer.

20.3 Duration

Processing continues for the period during which BizBoxed provides the relevant service and for any subsequent period during which retention is reasonably required under the applicable agreement, documented customer instructions or applicable law.

20.4 Nature and purpose of processing

Depending on the product, processing may include:

collection;
recording;
organisation;
structuring;
storage;
retrieval;
consultation;
use;
transmission;
display;
disclosure to authorised service providers;
modification;
restriction;
deletion; and
other processing reasonably required to provide the service.

The purpose is to provide, operate, secure, support and maintain the BizBoxed services selected by the customer in accordance with the customer's documented instructions and the applicable agreement.

20.5 Types of personal data

The customer determines the personal data entered into or processed through its BizBoxed services.

Depending on the product, this may include:

names;
contact information;
customer records;
CRM information;
booking information;
website form submissions;
communications;
invoice, quote or transaction-related information;
staff or business-user information;
operational records; and
other personal data that the customer chooses to process through supported functionality.

20.6 Categories of data subjects

Depending on the customer's use of BizBoxed, data subjects may include:

the customer's customers;
prospective customers;
website visitors;
booking customers;
contacts;
staff;
contractors;
suppliers;
business users; and
other individuals whose information the customer lawfully processes through BizBoxed.

20.7 Customer instructions

The customer's use and configuration of the BizBoxed service, together with the applicable agreement and any additional documented instructions accepted by BizBoxed, constitute the customer's documented instructions for processing.

BizBoxed will process personal data only on documented instructions from the customer unless processing is required by applicable law.

Where legally permitted, BizBoxed will inform the customer if applicable law requires processing outside those instructions.

If BizBoxed believes a customer instruction infringes applicable data-protection law, BizBoxed may inform the customer and, where appropriate, suspend the affected processing while the issue is resolved.

20.8 Confidentiality

BizBoxed will ensure that persons authorised to process customer personal data are subject to appropriate confidentiality obligations.

Access will be limited to persons and providers requiring access for legitimate service, support, security or operational purposes.

20.9 Security of processing

BizBoxed will implement appropriate technical and organisational measures having regard to the nature of the processing and associated risks.

Relevant measures are described in Section 17 and may evolve as technology, products and risks change.

20.10 Subprocessors

The customer authorises BizBoxed to use subprocessors reasonably necessary to provide the service.

BizBoxed will:

select subprocessors with appropriate regard to data-protection and security considerations;
impose applicable data-protection obligations contractually where required;
remain responsible for its obligations concerning processing delegated to subprocessors to the extent required by applicable law; and
maintain information about relevant subprocessors through the BizBoxed Sub-Processor Register or equivalent customer-accessible process.

Where required by the applicable data-processing arrangement, BizBoxed will provide notice of intended relevant subprocessor additions or replacements and provide an appropriate mechanism for the customer to raise a reasonable data-protection objection.

An objection must relate to genuine data-protection grounds.

Where an objection cannot reasonably be resolved, the parties will work in good faith to identify an appropriate solution, which may include modification or discontinuation of the affected service where necessary.

20.11 International transfers

Where BizBoxed transfers customer personal data internationally as Data Processor, it will ensure that an applicable transfer mechanism is used where required.

Where a subprocessor is responsible for an onward restricted transfer, BizBoxed will require appropriate transfer arrangements through the applicable processing agreement where required.

Section 16 provides further information.

20.12 Assistance with data-subject rights

Taking into account the nature of the processing, BizBoxed will provide reasonable assistance to the customer in responding to requests from data subjects where required by applicable law.

Where possible, customers should use available BizBoxed functionality to access, correct, export or delete customer-controlled data.

If BizBoxed receives a request directly concerning personal data processed solely on behalf of a customer, we may refer the requester to that customer unless legally prohibited from doing so.

20.13 Assistance with compliance obligations

Taking into account the nature of processing and information reasonably available to BizBoxed, we will provide reasonable assistance where required in relation to:

security of processing;
personal-data breach obligations;
data-protection impact assessments; and
prior consultation with supervisory authorities where applicable.

20.14 Personal-data breaches

BizBoxed will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer personal data processed by BizBoxed as Data Processor.

Where reasonably available and applicable, the notification will provide information necessary to assist the customer in meeting its own breach-notification obligations.

20.15 Return and deletion

At the end of the relevant processing services, BizBoxed will, at the customer's choice and subject to available functionality, the applicable agreement and applicable law, delete or return customer personal data for which BizBoxed acts as Data Processor.

This obligation does not require immediate deletion from backup systems where immediate deletion is not reasonably technically practicable, provided the information remains appropriately protected and is removed in accordance with the applicable backup lifecycle.

BizBoxed may retain information where required by applicable law or where BizBoxed processes the information independently as Data Controller under a separate lawful basis.

20.16 Compliance information and audits

BizBoxed will make available information reasonably necessary to demonstrate compliance with its applicable processor obligations.

Where required by applicable data-protection law, BizBoxed will allow for and contribute to reasonable audits or inspections relating to processing carried out on behalf of the customer.

Any audit must:

be relevant to BizBoxed's processing of the customer's personal data;
be conducted with reasonable prior notice unless urgent circumstances legally require otherwise;
minimise disruption to BizBoxed and other customers;
protect confidential information and the security of other customers;
avoid providing access to information the customer is not entitled to receive; and
take account of existing independent reports, certifications or compliance information where these reasonably satisfy the relevant requirement.

20.17 Customer responsibilities

Where the customer acts as Data Controller, the customer is responsible for:

ensuring that its processing has an appropriate lawful basis;
providing required privacy information to data subjects;
ensuring that personal data supplied to BizBoxed has been collected lawfully;
configuring BizBoxed products appropriately;
limiting collection to information necessary for the customer's purposes;
responding to data-subject requests for which it is responsible;
managing marketing and cookie consent where required;
securing its own accounts and access credentials;
assigning appropriate access to its staff and users;
complying with applicable data-retention requirements; and
ensuring its instructions to BizBoxed comply with applicable data-protection law.

20.18 Controller contact

The customer remains responsible for providing its own appropriate privacy contact information to the individuals whose personal data it controls.

BizBoxed's processor role does not replace the customer's responsibilities as Data Controller.

20.19 Precedence

Where there is a conflict concerning processing of customer personal data:

a separately executed DPA between BizBoxed and the customer takes precedence;
this Section 20 applies next;
the applicable Terms of Service and service agreement apply subject to the above.

Nothing in this DPA reduces any mandatory rights or obligations imposed by applicable data-protection law.

21. Customers' Own Compliance Responsibilities

BizBoxed provides technology and business services, but customers remain responsible for their own compliance obligations when acting as Data Controllers.

Depending on their use of BizBoxed, customers may need to:

maintain their own privacy notice;
determine lawful bases;
provide cookie information and obtain consent where required;
maintain appropriate records;
respond to data-subject requests;
determine retention periods;
control staff access;
manage direct marketing lawfully;
assess their own integrations;
determine whether special-category data should be processed; and
meet industry-specific regulatory requirements.

BizBoxed does not automatically become responsible for a customer's controller obligations merely because the customer uses the BizBoxed platform.

22. Complaints and Supervisory Authority

If you have a concern about BizBoxed's handling of personal data, please contact us first so that we can investigate.

Email: andy@bizboxed.uk

Where applicable, individuals also have the right to complain to the Information Commissioner's Office (ICO) or another competent supervisory authority.

23. Changes to This Policy

We may update this GDPR Compliance Policy to reflect:

changes in data-protection law;
regulatory guidance;
changes to BizBoxed products;
changes to processing activities;
changes to service providers;
changes to security or operational arrangements; or
improvements to our compliance framework.

The current version will be published with an updated revision date.

Where a change materially affects applicable customer rights or processing arrangements and notification is required, BizBoxed will take appropriate steps to notify affected customers.

Changes to subprocessor arrangements will be handled in accordance with the applicable processing arrangement and Section 20.10.

24. Contact

For GDPR, data-protection, DPA or data-rights enquiries:

BizBoxed
Email: andy@bizboxed.uk