Who is responsible for your data

GiftBox Britain is the data controller for the personal information collected through giftboxbritain.com. You can reach us at contact@giftboxbritain.com or by writing to 4 Embankment Place, London WC2N 5AQ, United Kingdom.

What we collect

When you order	Name, billing and delivery address, email, phone number, order contents and gift message
When you pay	Payment is processed by our provider. We receive confirmation and the last four digits of your card. We never see or store full card details.
When you contact us	Your name, email and the content of your message
When you subscribe	Your email address, and whether you open our emails
When you browse	IP address, browser type, pages viewed and referring site, through cookies

Why we are allowed to use it

• To perform our contract with you. Taking payment, packing and delivering your order, handling returns.
• To meet legal obligations. Keeping accounting and tax records for six years, as HMRC requires.
• For our legitimate interests. Preventing fraud, improving the site, and answering your questions.
• With your consent. Sending marketing emails and setting non-essential cookies. You can withdraw consent at any time.

Who we share it with

We share only what is necessary, and only with organisations that process data on our instructions:

• Our payment provider, to take payment securely
• Royal Mail and any other carrier, to deliver your parcel
• Our email platform, if you have subscribed to marketing
• Our website host and analytics provider
• Our accountant, and HMRC where the law requires it

We never sell, rent or trade your personal information.

Where your data is held

Our data is stored within the United Kingdom and the European Economic Area wherever possible. Where a provider transfers data outside the UK, that transfer is protected by an adequacy decision or by International Data Transfer Agreements approved by the UK government.

How long we keep it

Order and payment records	Six years after the end of the relevant tax year
Email enquiries	Two years from your last message
Marketing list	Until you unsubscribe, then we keep a suppression record so we do not email you again
Analytics data	Fourteen months

Cookies

Essential cookies keep your basket working and let you log in. These cannot be switched off. Analytics cookies tell us which pages people visit, and marketing cookies measure whether our advertising works. Both of these are optional and only set if you accept them in the cookie banner.

You can change your choice at any time through the banner, or block cookies entirely in your browser settings. Blocking essential cookies will stop checkout from working.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you
• correct anything that is wrong
• delete your data, where we have no legal reason to keep it
• restrict how we use it while a concern is investigated
• send your data to another provider in a portable format
• stop using it for our legitimate interests, or for marketing

Email us and we will respond within one calendar month. There is no charge.

Marketing

We only send marketing emails to people who have asked for them or who have bought from us. Every email has an unsubscribe link at the bottom and we act on it immediately.

Children

Our site is not intended for anyone under eighteen and we do not knowingly collect data from children. If you believe a child has given us their information, email us and we will delete it.

Security

The site runs over an encrypted connection. Access to order data is limited to staff who need it. No system is perfectly secure, but if a breach ever affects your rights we will tell you and the Information Commissioner without delay.

Complaints

If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.