Privacy Policy

1. Information We Collect

We may collect and process the following categories of personal information:

• Contact & Identity Data: Your name, business name, job title, email address, phone number, and postal address submitted via our consultation request forms, enquiry modals, or direct communications.
• Project & Business Information: Contextual notes regarding your operational challenges, current tech stack, revenue bracket, marketing channels, and project objectives shared during Clarity Calls or Strategic Reviews.
• Technical & Usage Data: IP address, browser type, operating system, referral source, pages visited, dwell time, and interaction events collected automatically via security logs and analytics.
• Billing & Transactional Data: Invoicing details, VAT information, and payment records for completed engagements. (We do not store complete debit/credit card numbers on our servers; payments are processed securely by compliant payment gateways).

2. How and Why We Use Your Information

Under the UK GDPR, we rely on the following legal bases to process your personal data:

• Performance of a Contract: To deliver our advisory, systems engineering, strategic review, and web development deliverables requested by you.
• Legitimate Business Interests: To respond to enquiries, schedule Business Clarity Calls, improve our digital platforms, and ensure website security against fraudulent activity.
• Legal Compliance: To maintain statutory accounting and corporate tax records required by UK law (HMRC and Companies House).
• Consent: Where you have explicitly opted in to receive direct marketing communications (you can withdraw consent at any time).

3. Disclosure of Your Information

We do not sell, trade, or rent personal identification information to third parties. We may share information with trusted third-party service providers who assist us in operating our business under strict confidentiality agreements, including:

• Cloud infrastructure and secure hosting providers (e.g., Google Cloud Platform).
• Secure messaging and scheduling tools (e.g., calendar booking systems, WhatsApp Business API).
• Professional advisers including accountants, lawyers, and insurers where necessary.
• Law enforcement or regulatory authorities if mandated by applicable UK statutes.

4. Data Security & Retention

We employ rigorous technical and organizational security measures, including SSL/TLS 256-bit encryption in transit, encrypted storage at rest, and strict principle-of-least-privilege access controls.

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with statutory tax retention periods (typically 6 years for accounting records in the UK), or resolve contractual disputes.

5. Your Statutory Rights Under UK GDPR

You hold substantial rights regarding your personal information, including:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure (“Right to be Forgotten”): Request deletion of your personal data where retention is no longer legally necessary.
• Right to Restriction of Processing: Request temporary pause on processing under specific circumstances.
• Right to Data Portability: Request transmission of your data in a structured, commonly used machine-readable format.
• Right to Object: Object to processing based on legitimate interests or direct marketing.

To exercise any of these rights, please email our Data Controller directly at hello@kaybox.co.uk. We will respond within one calendar month without charge.

6. Questions & Complaints

If you have questions or concerns regarding our privacy practices, please reach out to us directly. You also have the right to lodge a complaint with the UK supervisory authority: