Privacy Policy

Last updated: 16 October 2026

This policy explains what personal information we collect through designbox.co.uk and in our work with you, why we collect it, who we share it with, how long we keep it and the rights you have. We have written it in plain English. If anything is unclear, just ask.

Who we are. designbox is a trading name of Design Box Ltd, a company registered in England and Wales (company number 10338371). We are registered with the Information Commissioner’s Office (ICO), registration number ZB106007. Our office is at Gibraltar House, 539-543 London Road, Westcliff-on-Sea, Southend-on-Sea, SS0 9LJ. For the information described here, we are the data controller.

Information you give us

• Enquiry, quote, audit and assessment forms: your name, email address, phone number, company, website and what you tell us about your project, such as goals, timings and budget.
• Booking a call: your name, email address, phone number and any notes you add, through our booking calendar.
• Payments: your name, email address and billing details. Card payments are handled by Stripe, and we never see or store your full card number.
• Job applications: your CV, covering letter and anything else you choose to include.
• Newsletter: your email address.
• Support requests from existing clients: your contact details and details of the issue.
• Calls and emails: your contact details and anything you tell us.
• Feedback: scores and comments you give us, for example on your monthly reports.
• Call and meeting recordings: if we record or transcribe a call or online meeting, we tell you at the start. The recording and transcript hold what was said.

Information from other sources

• Public information about your business: when you send an enquiry, we may look at your website, Companies House records, your Google Business Profile and reviews, and news coverage, so we are prepared when we speak. About you as a person, we only look at your public professional role.
• Our work with you as a client: the services you have with us, the reports we send and whether they are opened, the actions we agree, and notes from our team.

Information collected automatically

• With your consent, analytics and advertising cookies record things like the pages you visit, your device and browser, your approximate location (town or city) and how you found us, for example a search or an advert. You choose this in our cookie banner, and our cookie policy lists every cookie.
• How you found us: if you have accepted cookies and send a quote request, we attach where you first came from (such as a search engine or an advert) and the page you arrived on, so we can see which marketing works.
• Server logs: like every website, our hosting records technical details such as your IP address, browser and the pages requested, to keep the site secure and working.

Data protection law says we need a lawful reason, called a lawful basis, for each way we use your information.

• To reply to your enquiry and prepare a quote. Basis: taking steps you have asked for before a contract, or our legitimate interest in responding to people who contact us.
• To research your business before we speak, using the public sources described above. Basis: our legitimate interest in giving you a useful, well-prepared response.
• To deliver our services, invoice and support you as a client. Basis: our contract with you.
• To look after your account and improve our service. This includes a view, seen only by our team, of how each client relationship is going, based on your feedback, report activity, the actions we have agreed and our own notes. Basis: our contract with you, and our legitimate interest in improving the service we give you.
• To keep accurate notes of calls and meetings, so that what we agree is not missed. Basis: our legitimate interest in recording what was discussed and agreed.
• To take payments. Basis: our contract with you.
• To consider a job application. Basis: our legitimate interest in recruiting, and steps you have asked for before a contract of employment.
• To send our newsletter and marketing emails. Basis: your consent. You can unsubscribe at any time using the link in every email.
• To understand how the site is used and measure our adverts. Basis: your consent, given in our cookie banner, which you can change at any time.
• To keep the site secure and block spam. Basis: our legitimate interest in protecting our site and the people who use it.
• To meet legal and accounting obligations, such as keeping financial records. Basis: legal obligation.

We do not sell your information, and we do not make decisions about you based solely on automated processing. Where AI tools help us summarise notes, research or prepare work, a person always reviews the result.

We only share your information with companies that help us run our business, and only what they need. They act on our instructions and must keep it secure.

• Pressable (Automattic): hosts our website and the details sent through our forms. Their Jetpack and Akismet services help keep the site secure and filter spam from form submissions.
• Nexus CRM (built on HighLevel): our customer database and the booking calendars on app.designbox.co.uk.
• Our client management platform: holds client records, reports, feedback and our notes. It is hosted by Railway, stores files with Amazon Web Services and sends report emails through Resend.
• Anthropic and OpenAI: AI services that help us research enquiries, summarise notes and prepare work. They process information on our instructions and are not allowed to use it for their own purposes.
• Fathom: records and transcribes online meetings, only when we have told you we are recording.
• Postmark: sends the emails our website forms generate.
• Stripe: processes card payments.
• Google (Analytics, Tag Manager and Ads): measures how the site is used and how our adverts perform, only with your consent.
• Microsoft Advertising: measures how our adverts perform, only with your consent.
• Gauges, via Pressable: counts visits for our hosting statistics, only with your consent.
• Professional advisers, such as our accountants and lawyers, when needed.
• Authorities, such as HMRC, the police or the courts, when the law requires it.

Some of the companies above are based in, or store data in, the United States. When information goes outside the UK, we make sure it is protected, for example through the UK-US data bridge where the company is certified, or through contract terms approved for UK transfers, such as the ICO’s International Data Transfer Agreement or the UK addendum to the EU standard contractual clauses.

• Enquiries that do not lead to working together: 6 years from our last contact, then deleted.
• Research about your business for an enquiry that does not go ahead: 12 months, then deleted.
• Clients: for as long as we work together, then 7 years for accounting and legal reasons. This includes your feedback and our notes about our work with you.
• Call and meeting recordings and transcripts: up to 24 months.
• Job applications: up to 12 months after the role is filled, unless you ask us to delete yours sooner.
• Newsletter: until you unsubscribe.
• Analytics data: 14 months in Google Analytics.
• Cookies: see our cookie policy.

When we no longer need information, we delete it or remove anything that identifies you.

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you
• ask us to correct information that is wrong or incomplete
• ask us to delete your information
• ask us to restrict how we use it
• object to us using it for our legitimate interests or for direct marketing
• ask for information you gave us in a format you can take elsewhere
• withdraw your consent at any time, for example by unsubscribing or using Cookie settings

Some rights only apply in certain situations. To use any of them, email info@designbox.co.uk. It is free, and we will reply within one month. We may ask you to confirm who you are first.

We only use analytics and advertising cookies if you say yes in our cookie banner. You can change your choice at any time using the Cookie settings link in our footer. Our cookie policy explains each cookie we use.

We use secure hosting, encrypt information as it travels between your browser and our site, and limit access to the people who need it. No system is completely secure, so if we ever have a breach that puts your information at risk, we will tell you and the ICO where the law requires it.

Our services are for businesses. We do not knowingly collect information from anyone under 16. If you think a child has sent us their details, contact us and we will delete them.

Our site links to other websites, such as social media and client sites. We are not responsible for how they handle your information, so please check their privacy policies.

We will update this page if the way we handle information changes. The date at the top shows when it was last updated, and we will make any significant change clear here.

For questions or requests about your information, email info@designbox.co.uk, call 01702 416431 or write to Design Box Ltd, Gibraltar House, 539-543 London Road, Westcliff-on-Sea, Southend-on-Sea, SS0 9LJ.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.