Privacy Policy

Last updated: 10 September 2026

1. Introduction

BizBoxed ("BizBoxed", "we", "us", "our") is committed to protecting your privacy and handling personal information responsibly, securely and transparently.

This Privacy Policy explains:

  • what personal information we collect and process;
  • why we process it;
  • how we use and share it;
  • the types of service providers that may process it on our behalf;
  • how international transfers are handled;
  • how long information may be retained;
  • the rights available to you under applicable data protection law; and
  • how to contact us about your personal information.

This Privacy Policy should be read together with our:

Where another BizBoxed product, feature or service provides a more specific privacy notice, that notice should be read together with this Privacy Policy.

2. Who We Are

BizBoxed is a UK-based business platform and service ecosystem providing websites and business tools and services that may include CRM, bookings, invoicing, MTD, payments, business operations, AI-assisted functionality and related support services.

For personal information that we collect and use for our own purposes, BizBoxed normally acts as the Data Controller.

This includes information used to:

  • create and administer BizBoxed accounts;
  • authenticate users;
  • manage subscriptions;
  • provide customer support;
  • administer the BizBoxed platform;
  • communicate with customers and users;
  • maintain security;
  • manage our customer relationships; and
  • operate and improve our business and services.

For some information processed through BizBoxed products on behalf of a business customer, BizBoxed may instead act as a Data Processor and the business customer may be the Data Controller.

For example, this may apply where a BizBoxed customer uses CRM, booking, website form, business-management or similar functionality to process information about their own customers, staff, suppliers or other individuals.

More information about these roles is provided in our GDPR Compliance Policy.

Data Controller contact

BizBoxed
Email: andy@bizboxed.uk

3. Who This Policy Applies To

This Privacy Policy may apply to:

  • visitors to BizBoxed websites;
  • prospective customers;
  • BizBoxed customers;
  • users of BizBoxed accounts and dashboards;
  • users completing signup or onboarding;
  • users of BizBoxed free tools;
  • people who contact BizBoxed;
  • people whose information is processed as part of our legitimate business operations; and
  • other individuals whose personal information BizBoxed processes as a Data Controller.

Where you provide personal information about another person, you are responsible for ensuring that you are permitted to provide that information to us where required by law.

Where BizBoxed processes information solely on behalf of one of our business customers, that customer's own privacy notice may also apply.

4. Personal Information We May Process

The information we process depends on which BizBoxed products, services and features you use.

4.1 Account, identity and authentication information

This may include:

  • your name;
  • email address;
  • phone number, where provided or enabled;
  • account and user identifiers;
  • profile information;
  • profile image;
  • account creation information;
  • account activity information;
  • sign-in and session information;
  • authentication and security information;
  • subscription and product-entitlement information; and
  • identifiers used to connect your BizBoxed account with services such as billing systems.

BizBoxed uses a specialist identity and authentication provider to provide account creation, sign-in, account verification, password recovery and related authentication and security functionality.

Authentication credentials such as passwords are handled by our authentication provider. BizBoxed does not store users' passwords within the BizBoxed application database.

4.2 Business and onboarding information

Depending on the service, this may include:

  • business name;
  • business type;
  • trading information;
  • contact information;
  • preferred web address;
  • service areas;
  • opening hours;
  • business descriptions;
  • social media links;
  • brand information;
  • brand colours;
  • onboarding answers;
  • product and service information;
  • subscription choices;
  • information required to configure BizBoxed products; and
  • other information you choose to provide.

4.3 Website, content and file information

Where relevant, we may process:

  • website text;
  • images;
  • logos;
  • photographs;
  • brand assets;
  • documents;
  • uploaded files;
  • form content;
  • website configuration;
  • product or service content; and
  • other materials you provide to us.

You are responsible for ensuring that you have the necessary rights and permissions to provide content and files to BizBoxed.

4.4 Customer and operational information

When BizBoxed products are used to manage business operations, information processed through the platform may include:

  • CRM contacts;
  • booking information;
  • enquiries;
  • website form submissions;
  • customer contact information;
  • invoice, quote or receipt information;
  • staff or business-user information;
  • business records;
  • transaction-related information;
  • communications; and
  • other information entered into the relevant BizBoxed product.

For much of this information, BizBoxed may act as Data Processor on behalf of the business customer rather than as Data Controller.

4.5 Subscription and payment information

We may process information required to manage subscriptions and payments, including:

  • subscription status;
  • products and service tiers;
  • billing status;
  • payment-provider customer identifiers;
  • transaction references; and
  • information required to administer billing and subscriptions.

Payment providers may process payment-card and financial information directly under their own terms and privacy arrangements.

BizBoxed does not need to store complete payment-card details in order to administer subscriptions where those details are handled by the payment provider.

4.6 Technical, device and security information

Depending on how you interact with BizBoxed, we may process:

  • IP address;
  • browser type;
  • device type;
  • operating system;
  • session identifiers;
  • authentication events;
  • security events;
  • timestamps;
  • pages or features accessed;
  • diagnostic information;
  • application and server logs;
  • error information;
  • device or browser information used for security purposes; and
  • other technical information required to operate, secure and troubleshoot the service.

We do not use this information for third-party advertising or unrelated behavioural profiling.

4.7 Communications and support information

If you contact us, we may process:

  • your name;
  • contact details;
  • message content;
  • support enquiries;
  • correspondence;
  • attachments;
  • service requests; and
  • records of our response.

4.8 Sales and customer relationship information

Where appropriate, BizBoxed may maintain customer and prospective-customer records in its CRM and related operational systems.

These records may include:

  • contact details;
  • business details;
  • enquiry information;
  • account or signup information;
  • relevant communications;
  • service interests;
  • customer relationship history; and
  • marketing preferences or objections.

5. How We Collect Personal Information

We may collect personal information:

  • directly from you;
  • when you create or use a BizBoxed account;
  • during signup or onboarding;
  • when you use a BizBoxed product or service;
  • when you contact us;
  • when you upload information or files;
  • through forms;
  • through authentication and account-management services;
  • through payment and subscription providers;
  • through integrations you choose to use;
  • from our business customers where they use BizBoxed to process information about other individuals;
  • from publicly available sources where appropriate; and
  • automatically through technical, security and operational systems.

6. How We Use Personal Information

Depending on our relationship with you and the services involved, we may use personal information to:

  • create and manage accounts;
  • authenticate users;
  • provide secure sign-in and account-recovery functionality;
  • provide and operate BizBoxed products and services;
  • configure customer accounts;
  • complete onboarding;
  • build and maintain customer websites;
  • operate CRM, booking, invoicing, MTD and other business functionality;
  • manage subscriptions and billing;
  • provide customer support;
  • respond to enquiries;
  • send transactional and service communications;
  • maintain security and prevent misuse or fraud;
  • investigate technical problems;
  • maintain appropriate audit records;
  • manage our customer and prospective-customer relationships;
  • improve the reliability and operation of our services;
  • comply with legal and regulatory obligations; and
  • establish, exercise or defend legal rights.

We do not sell personal information.

We do not share personal information with third parties for their own unrelated advertising purposes.

7. Lawful Bases for Processing

Where BizBoxed acts as Data Controller, the lawful basis we rely upon depends on the purpose of the processing.

7.1 Contract

We may process personal information where necessary to:

  • provide a service you have requested;
  • create and administer your account;
  • provide subscribed products and features;
  • manage your subscription;
  • provide support; or
  • take steps at your request before entering into a contract.

7.2 Legitimate interests

We may process information where necessary for our legitimate interests or those of another party, provided those interests are not overridden by your rights and interests.

This may include:

  • operating and improving BizBoxed;
  • maintaining platform security;
  • preventing fraud or misuse;
  • administering customer relationships;
  • maintaining appropriate business records;
  • understanding how our services are used;
  • communicating with business customers and prospective business customers; and
  • protecting BizBoxed, our customers and users.

7.3 Consent

We rely on consent where required, including for certain optional communications, technologies or processing activities.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7.4 Legal obligation

We may process information where necessary to comply with legal, regulatory, tax, accounting or other obligations.

7.5 Other lawful bases

Where another lawful basis is applicable under data protection law, we may rely upon it where appropriate.

Where BizBoxed acts solely as a Data Processor, the business customer acting as Data Controller is generally responsible for establishing the applicable lawful basis for the underlying processing.

8. Authentication and Account Management

BizBoxed uses Clerk as an identity and authentication provider.

Clerk may process information necessary to provide authentication and user-management functionality, including:

  • user identifiers;
  • name;
  • email address;
  • phone number where enabled or provided;
  • profile information;
  • authentication and session information;
  • account creation and activity information;
  • credentials and authentication factors; and
  • limited account or product metadata used by BizBoxed.

BizBoxed currently uses Clerk metadata for limited operational information such as product or subscription entitlement status and billing-system identifiers.

BizBoxed does not use Clerk metadata to store BizBoxed roles or permissions, and does not store special-category personal information in Clerk metadata as part of the documented implementation.

Clerk may use its own subprocessors to provide elements of the authentication service, including infrastructure and transactional authentication-email delivery.

More information about relevant service providers and subprocessors is available through our Sub-Processor Register.

9. Free Tools and Lead Capture

BizBoxed may provide free tools such as invoice, receipt, quote and calculator tools.

Where a tool operates locally in your browser, information may remain on your device unless you choose a feature that requires information to be transmitted to BizBoxed or another service.

When a free tool asks for your own name, business name, email address or optional phone number, we may use those details to:

  • provide the requested tool or service;
  • support you;
  • maintain an appropriate customer or prospective-customer record; and
  • where permitted, communicate with you about relevant BizBoxed products and services.

Using a free tool does not by itself constitute consent to marketing.

Where consent is required for marketing, we will seek it separately.

Where business-to-business direct marketing is permitted on another lawful basis, we may rely on legitimate interests subject to your right to object.

You can object to direct marketing at any time. Where an objection is recorded, we will respect it in accordance with applicable law.

Information entered about your own customer or document recipient is used for the relevant tool functionality and is not treated as marketing consent from that person.

We do not sell information collected through free tools or share it with third parties for their own marketing.

10. Files and Uploaded Content

When you upload files or content to BizBoxed:

  • you confirm that you have the right to provide and use them;
  • we may store and process them as necessary to provide the requested service;
  • authorised service providers may process them where necessary to provide BizBoxed infrastructure or functionality; and
  • we will not use them for unrelated advertising purposes.

Files may be retained for as long as reasonably necessary to provide the relevant service and meet applicable legal, operational or security requirements.

11. Cookies, Local Storage and Similar Technologies

BizBoxed uses cookies, local storage and similar technologies where necessary to provide functionality, remember appropriate settings, maintain authentication and security, and understand or improve service operation where permitted.

Local storage is information stored within your browser or device. Depending on the feature, information stored locally may subsequently be transmitted when you submit information or interact with an online service.

We do not therefore assume that information is never transmitted merely because local storage is used.

For information about the technologies used, their purposes and available controls, see our Cookie Policy.

12. Email and Service Communications

We may send communications to:

  • verify accounts;
  • support authentication and account recovery;
  • provide security notifications;
  • confirm signup or onboarding;
  • request information needed to provide a service;
  • provide service updates;
  • provide booking, billing, receipt or other product communications;
  • respond to support enquiries; and
  • send important account or operational notices.

Authentication-related communications may be delivered through our authentication provider and its email-delivery subprocessors.

Other BizBoxed transactional or operational email may be delivered using separate email service providers.

Service and security communications may be necessary to operate your account and may not always be optional.

Marketing communications are handled separately and may be stopped or objected to as applicable.

13. How We Share Personal Information

We may share personal information with trusted service providers where reasonably necessary to operate BizBoxed.

Depending on the product or service, these may include:

  • identity and authentication providers;
  • hosting and cloud infrastructure providers;
  • database and storage providers;
  • website and form-processing providers;
  • email delivery providers;
  • payment and billing providers;
  • communications providers;
  • security and monitoring providers;
  • business-management and operational providers;
  • AI service providers where applicable to an enabled feature;
  • analytics providers where applicable;
  • professional advisers; and
  • providers supporting optional integrations selected by customers.

These providers may themselves use approved subprocessors as part of delivering their services.

Where BizBoxed appoints a provider to process personal information on our behalf, we take appropriate steps to ensure that relevant data-protection obligations are addressed.

A Sub-Processor Register containing further information about relevant providers is available from BizBoxed where applicable.

We may also disclose information:

  • where required by law;
  • to regulators, courts or law-enforcement authorities where legally required;
  • where necessary to protect legal rights, safety or security;
  • in connection with a business restructuring, sale, acquisition or similar transaction, subject to appropriate safeguards; or
  • where you have instructed or authorised us to do so.

14. Third-Party Integrations

BizBoxed products may support optional integrations with third-party services such as:

  • booking systems;
  • payment services;
  • CRM services;
  • accounting or business tools;
  • analytics services;
  • communications services; and
  • automation services.

The privacy position depends on the integration.

In some cases, the provider processes information on BizBoxed's behalf.

In other cases, the provider may process information independently under its own privacy policy and terms.

Where you choose to connect an independent third-party service, you should review that provider's applicable privacy information.

15. International Data Transfers

BizBoxed is based in the United Kingdom, but some of the service providers used to operate BizBoxed may process personal information in other countries, including countries outside the United Kingdom and European Economic Area.

Where personal information is subject to a restricted international transfer, we take steps to ensure that an appropriate transfer mechanism and safeguards are used where required.

Depending on the provider, destination and circumstances, these may include:

  • UK or EU adequacy regulations or decisions;
  • recognised international data-transfer frameworks;
  • Standard Contractual Clauses;
  • the UK International Data Transfer Addendum or other UK-approved transfer mechanisms; or
  • other safeguards permitted by applicable data protection law.

The exact mechanism may differ between providers and may change as legal frameworks or provider arrangements change.

Further information about relevant providers may be available through our Sub-Processor Register or by contacting us.

16. Artificial Intelligence

BizBoxed may use artificial intelligence and AI-assisted services as part of certain products, features and internal workflows.

Depending on the feature, AI systems may process information such as:

  • text you provide;
  • business information;
  • website or brand information;
  • support questions;
  • information required to perform an AI-assisted feature; and
  • publicly available information where appropriate.

AI functionality is used to support BizBoxed services and workflows.

BizBoxed does not use AI to make solely automated decisions about individuals that produce legal or similarly significant effects unless this is specifically disclosed and an appropriate lawful basis and safeguards apply.

Where an external AI provider processes personal information on behalf of BizBoxed, it is treated as a service provider and appropriate privacy and data-protection considerations apply.

Where a particular AI-enabled product processes additional or materially different categories of information, BizBoxed may provide additional product-specific information.

17. Data Retention

We retain personal information for no longer than reasonably necessary for the purposes for which it is processed, subject to legal, regulatory, contractual, security and legitimate business requirements.

Different categories of information may therefore have different retention periods.

Factors considered may include:

  • whether your account or subscription remains active;
  • the product or service involved;
  • the nature and sensitivity of the information;
  • legal, accounting and tax obligations;
  • security and fraud-prevention requirements;
  • dispute and legal-claim periods;
  • backup and disaster-recovery requirements;
  • customer instructions where BizBoxed acts as Data Processor; and
  • whether information can be safely deleted or anonymised.

Closing or deleting an account does not necessarily result in the immediate deletion of every related record.

For example, some billing, audit, security, transaction or other records may need to be retained where there is a lawful reason to do so.

Where BizBoxed acts as Data Processor, retention and deletion may also be governed by the relevant customer's instructions and applicable agreement.

We periodically review retention requirements and aim to delete or anonymise information when there is no longer a lawful or operational reason to retain it.

18. Your Data Protection Rights

Depending on the circumstances and applicable law, you may have the right to:

  • request access to your personal information;
  • request correction of inaccurate or incomplete information;
  • request deletion of personal information;
  • request restriction of processing;
  • object to certain processing;
  • request data portability;
  • withdraw consent where processing relies on consent;
  • object to direct marketing; and
  • complain to a data-protection supervisory authority.

These rights are not absolute and may be subject to legal conditions, exemptions and retention requirements.

To exercise your rights, contact:

andy@bizboxed.uk

We may need to verify your identity before fulfilling a request.

Where BizBoxed processes information solely on behalf of one of our business customers, we may need to refer the request to that customer or assist them in responding.

For further information, see our GDPR Compliance Policy.

19. Direct Marketing

Where permitted, BizBoxed may communicate with existing or prospective business customers about relevant products and services.

Depending on the circumstances, we may rely on consent or legitimate interests as permitted by applicable law.

You can object to direct marketing at any time.

Where we send electronic marketing communications, appropriate unsubscribe or objection mechanisms will be provided where required.

An objection to direct marketing will be respected in accordance with applicable law.

We do not sell personal information to advertisers.

20. Security

BizBoxed uses technical and organisational measures intended to protect personal information against unauthorised access, disclosure, alteration, loss or misuse.

Depending on the relevant system, these measures may include:

  • encrypted communications;
  • access controls;
  • authentication;
  • role and permission controls;
  • secure infrastructure;
  • logging and monitoring;
  • security updates;
  • vulnerability management;
  • data minimisation;
  • controlled administrative access; and
  • use of reputable service providers.

No internet-based service can guarantee absolute security.

We review security arrangements as the platform and associated risks develop.

For further information about our data-protection and security approach, see our GDPR Compliance Policy.

21. Data Breaches

BizBoxed maintains processes for responding to suspected personal-data breaches.

Where a breach occurs, we will assess the circumstances and take action required under applicable data protection law, which may include notifying the Information Commissioner's Office or affected individuals where the relevant legal thresholds are met.

Where BizBoxed acts as Data Processor, we will notify and assist the relevant Data Controller as required by the applicable processing arrangement.

22. Children's Privacy

BizBoxed is a business-focused service and is not intended for use by children.

We do not knowingly design BizBoxed services for children or intentionally seek to collect children's personal information through ordinary account registration.

If we become aware that children's personal information has been provided in circumstances where it should not have been, we will review the information and take appropriate action.

23. Links and Independent Third-Party Services

BizBoxed websites and products may contain links to websites or services operated independently by third parties.

We are not responsible for the privacy practices of independent third-party services.

You should review the privacy information provided by those services before supplying personal information to them.

This is distinct from service providers that process information on BizBoxed's behalf.

24. Changes to This Privacy Policy

We may update this Privacy Policy where necessary to reflect:

  • changes to BizBoxed products or services;
  • changes to how personal information is processed;
  • changes to service providers;
  • legal or regulatory developments;
  • security or operational improvements; or
  • other relevant changes.

The current version will be published on the BizBoxed website with an updated revision date.

Where a change is significant and applicable law or our relationship with you requires additional notification, we will take appropriate steps to inform affected users.

25. Contact Us

For privacy, data-protection or data-rights enquiries, contact:

BizBoxed
Email: andy@bizboxed.uk

You can also read:

If you are dissatisfied with how we handle your personal information, you may also have the right to complain to the UK Information Commissioner's Office (ICO).