Privacy Policy

We collect different types of information to provide and improve our packaging services. Here's what we collect and how:

Personal Information You Provide

Information Type	Examples	How We Collect It
Contact Information	Name, email address, phone number, mailing address	Quote forms, account registration, order placement
Business Information	Company name, business type, industry, VAT number	B2B account setup, custom quotes
Payment Information	Billing address, payment method details	Order checkout, payment processing
Project Details	Box specifications, design files, quantity requirements	Custom quote requests, order placement
Communication Data	Messages, feedback, support inquiries	Contact forms, emails, phone calls, live chat

Information We Collect Automatically

• Website Usage Data: Pages visited, time spent on pages, click patterns, navigation paths
• Device Information: IP address, browser type, operating system, device type, screen resolution
• Location Data: General geographic location based on IP address (country/region level)
• Referral Information: Website or source that referred you to our site
• Session Data: Login times, session duration, feature usage patterns

Information from Third Parties

We may receive information about you from:

• Social media platforms (if you choose to connect your accounts)
• Analytics services and advertising networks
• Business partners and referral sources
• Public databases and business directories
• Credit reporting agencies (for business accounts)

We use your personal information for various purposes related to providing our packaging services and improving your experience. Here's how we use your information:

Service Delivery

• Processing and fulfilling your custom packaging orders
• Providing quotes and estimates for packaging projects
• Creating and managing your customer account
• Coordinating design consultations and approvals
• Managing production schedules and delivery logistics
• Processing payments and handling billing

Communication

• Sending order confirmations, updates, and delivery notifications
• Responding to your inquiries and providing customer support
• Sharing important account or service information
• Conducting customer satisfaction surveys (with your consent)
• Providing technical support and troubleshooting assistance

Marketing and Personalization (With Your Consent)

• Sending newsletters with packaging tips and industry insights
• Sharing promotional offers and new product announcements
• Personalizing website content and product recommendations
• Retargeting advertising on other websites and platforms
• Inviting you to participate in case studies or testimonials

Business Operations

• Analyzing website usage to improve user experience
• Monitoring and improving our services and processes
• Conducting market research and trend analysis
• Managing inventory and production planning
• Training staff and improving customer service

Legal and Security

• Complying with legal obligations and regulations
• Protecting against fraud, spam, and security threats
• Enforcing our terms of service and policies
• Responding to legal requests and court orders
• Protecting our intellectual property and business interests

We do not sell, rent, or trade your personal information to third parties. However, we may share your information in certain limited circumstances:

Service Providers

We work with trusted third-party service providers who help us deliver our services. These providers have access to your information only to perform specific tasks on our behalf and are contractually obligated to keep your information confidential.

Service Type	Purpose	Information Shared
Payment Processors	Process payments and handle billing	Payment information, billing address
Shipping Companies	Deliver your orders	Name, delivery address, phone number
Cloud Hosting	Store and process data securely	All data as necessary for service operation
Email Services	Send communications and newsletters	Email address, name, communication preferences
Analytics Providers	Analyze website usage and performance	Usage data, anonymized user behavior
Customer Support	Provide technical and customer support	Contact information, support inquiries

Business Transfers

If Hi Custom Boxes is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or use of your personal information.

Legal Requirements

We may disclose your personal information when required by law or when we believe in good faith that such action is necessary to:

• Comply with legal processes, court orders, or government requests
• Enforce our terms of service or other agreements
• Protect the rights, property, or safety of Hi Custom Boxes, our users, or others
• Investigate or prevent fraud, security breaches, or illegal activities
• Respond to claims that content violates third-party rights

With Your Consent

We may share your information for any other purpose with your explicit consent. For example:

• Featuring your company in case studies or testimonials (with permission)
• Sharing success stories or project showcases (with approval)
• Connecting you with partners or suppliers (upon request)

We use cookies and similar tracking technologies to enhance your browsing experience, analyze site usage, and assist in our marketing efforts. Here's what you need to know:

What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us recognize your browser and remember certain information about your preferences or past actions.

Types of Cookies We Use

Managing Your Cookie Preferences

You have several options for managing cookies:

• Cookie Banner: When you first visit our site, you can choose which types of cookies to accept
• Browser Settings: Configure your browser to block or delete cookies
• Opt-out Tools: Use industry opt-out tools for advertising cookies
• Account Settings: Adjust marketing preferences in your account dashboard

Third-Party Tracking

Our website may include third-party tracking technologies from:

• Google Analytics and Google Ads
• Facebook and Instagram tracking pixels
• LinkedIn Campaign Manager
• Email service providers (Mailchimp, SendGrid)
• Customer support platforms (Intercom, Zendesk)

We take the security of your personal information seriously and implement a variety of security measures to protect your data against unauthorized access, alteration, disclosure, or destruction.

Technical Safeguards

• Encryption: All data transmission is protected using SSL/TLS encryption (minimum 256-bit)
• Secure Hosting: Data is stored on secure, ISO 27001 certified cloud infrastructure
• Access Controls: Multi-factor authentication and role-based access for all systems
• Network Security: Firewalls, intrusion detection, and regular security monitoring
• Data Backup: Regular automated backups with encryption and secure storage
• Database Security: Encrypted databases with restricted access and audit logging

Administrative Safeguards

• Staff Training: Regular privacy and security training for all employees
• Background Checks: Security clearance for employees with data access
• Confidentiality Agreements: All staff sign comprehensive confidentiality agreements
• Access Monitoring: Logging and monitoring of all data access activities
• Incident Response: Established procedures for security breach response

Physical Safeguards

• Secure Facilities: Data centers with 24/7 security and restricted access
• Environmental Controls: Climate control and disaster recovery systems
• Equipment Security: Secure disposal of hardware and storage devices

Payment Security

We use industry-standard payment processing with additional security measures:

• PCI DSS compliance for all payment processing
• Tokenization of payment card information
• Fraud detection and prevention systems
• Secure payment gateways (Stripe, PayPal, etc.)
• No storage of complete payment card numbers

Regular Security Assessments

• Annual third-party security audits and penetration testing
• Regular vulnerability assessments and security updates
• Continuous monitoring for emerging security threats
• Compliance reviews for data protection regulations

Data Breach Response

In the unlikely event of a data breach, we have established procedures to:

• Immediately contain and assess the breach
• Notify affected users within 72 hours where required
• Report to relevant authorities as legally mandated
• Implement additional security measures to prevent future incidents
• Provide support and guidance to affected users

You have various rights regarding your personal information. The specific rights available to you may depend on your location and applicable laws.

Universal Rights

Regardless of your location, you have the following rights:

Enhanced Rights (GDPR - EU/UK Users)

If you're located in the EU or UK, you have additional rights under GDPR:

How to Exercise Your Rights

To exercise any of these rights:

• Account Dashboard: Update basic information directly in your account
• Email Request: Send requests to Sales@hicustomboxes.co.uk
• Contact Form: Use our privacy contact form (link below)
• Phone: Call our customer support team
• Mail: Send written requests to our physical address

Response Times and Verification

• We respond to most requests within 30 days
• Complex requests may take up to 90 days
• We may require identity verification for security
• Some requests may incur reasonable administrative fees
• We'll explain any delays or fees in advance

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, and protect our legitimate business interests.

Retention Periods by Data Type

Data Type	Retention Period	Reason for Retention
Account Information	Duration of account + 7 years	Business records, tax compliance
Order and Transaction Data	7 years after last transaction	Financial reporting, warranty claims
Design Files and Project Data	3 years after project completion	Reorders, quality issues, IP protection
Marketing Communications	Until unsubscribe + 2 years	Compliance with unsubscribe requests
Website Analytics	26 months (Google Analytics)	Business analytics and optimization
Customer Support Records	3 years after resolution	Quality improvement, training
Security Logs	1 year	Security monitoring, incident response
CCTV Footage	30 days	Security and safety

Factors Determining Retention

• Legal Requirements: Tax laws, consumer protection regulations, commercial law
• Legitimate Business Interests: Providing ongoing services, preventing fraud
• Contractual Obligations: Terms of service, warranty periods
• User Relationship: Active vs. inactive accounts, ongoing projects
• Data Sensitivity: More sensitive data may be deleted sooner

Automated Deletion Process

We have implemented automated systems to ensure data is deleted according to our retention schedule:

• Regular automated reviews of data retention periods
• Systematic deletion of data that has reached retention limits
• Secure deletion methods that make data unrecoverable
• Logging and monitoring of all deletion activities
• Annual reviews of retention policies and procedures

Early Deletion Requests

You can request early deletion of your data in certain circumstances:

• Account Closure: Request deletion when closing your account
• Consent Withdrawal: Data collected based on consent
• No Longer Necessary: When data is no longer needed for its original purpose
• Legal Right: Under applicable data protection laws

Exceptions to Deletion

Some data may be retained longer if:

• Required by law (tax records, legal compliance)
• Needed for legal proceedings or disputes
• Essential for protecting rights and safety
• Necessary for legitimate business interests
• Anonymized data for research or analytics

As a global business, we may transfer your personal information to countries outside your home country. We ensure all transfers are conducted with appropriate safeguards to protect your privacy rights.

Where Your Data May Be Transferred

Your personal information may be transferred to and processed in:

• United Kingdom: Our primary data processing location
• European Union: EU-based service providers and cloud hosting
• United States: Cloud services, analytics, and customer support tools
• Canada: Backup and disaster recovery services
• Other Countries: As needed for service delivery and support

Legal Basis for Transfers

We rely on various legal mechanisms to ensure lawful international transfers:

Safeguards We Implement

• Contractual Protections: All service providers sign data processing agreements with strict privacy requirements
• Technical Safeguards: Encryption in transit and at rest for all international transfers
• Access Controls: Limiting access to personal data on a need-to-know basis
• Regular Audits: Monitoring compliance with transfer requirements and safeguards
• Data Minimization: Transferring only the minimum data necessary for the specific purpose

Specific Transfer Scenarios

Purpose	Destination	Safeguards
Cloud Hosting and Storage	EU, US, Canada	SCCs, encryption, certified providers
Customer Support	US, Canada	Limited access, encryption, SCCs
Payment Processing	US, EU	PCI DSS compliance, tokenization
Analytics and Marketing	US, EU	Anonymization, limited data sets
Shipping and Delivery	Various (as needed)	Minimal data, delivery purposes only

Your Rights Regarding International Transfers

• Request information about where your data is processed
• Object to transfers that don't have adequate safeguards
• Request that we keep your data within certain geographic regions (where technically feasible)
• Receive copies of the safeguards we use for international transfers

Hi Custom Boxes is committed to protecting the privacy of children and complying with applicable laws regarding children's personal information.

Age Restrictions

Our services are not intended for children, and we have different age requirements based on your location:

• EU/UK Users: Our services are not available to anyone under 16 years of age
• US Users: Our services are not available to anyone under 13 years of age
• Other Regions: Our services are not available to anyone under the age of majority in their jurisdiction

No Intentional Collection

We do not knowingly collect, use, or disclose personal information from children under the applicable age limits. Our website and services are designed for businesses and adults making commercial purchasing decisions.

If We Discover Children's Information

If we become aware that we have collected personal information from a child under the applicable age without proper consent:

• We will delete the information as quickly as possible
• We will not use the information for any purpose
• We will not disclose the information to third parties
• We will notify the child or parents if required by law

Parental Rights

If you are a parent or guardian and believe your child has provided us with personal information:

• Contact us immediately using the information provided in this policy
• We will investigate and respond within 30 days
• We will delete any verified children's information from our systems
• We will provide confirmation of deletion upon request

School and Educational Use

While our primary services target businesses, if educational institutions wish to use our services for educational purposes:

• The educational institution must provide appropriate consent
• Only authorized adult representatives should create accounts
• Student information should not be shared with us
• Special privacy terms may apply for educational use

Compliance with Children's Privacy Laws

We comply with applicable children's privacy laws including:

• Children's Online Privacy Protection Act (COPPA) in the United States
• General Data Protection Regulation (GDPR) provisions for children in the EU/UK
• Similar children's privacy laws in other jurisdictions where we operate

We may update this privacy policy from time to time to reflect changes in our practices, services, legal requirements, or for other operational, legal, or regulatory reasons.

When We Update This Policy

We may update this privacy policy in the following situations:

• Changes to our business practices or services
• New legal or regulatory requirements
• Introduction of new technologies or features
• Changes to our data processing activities
• User feedback or requests for clarification
• Regular policy reviews and improvements

Types of Updates

How We Notify You of Changes

Our notification method depends on the significance of the changes:

For Minor Updates:

• Update the "Last Modified" date at the top of this policy
• Post the updated policy on our website
• No additional notification required

For Material Updates:

• Email notification to registered users at least 30 days before changes take effect
• Prominent notice on our website homepage
• In-app notifications for active users
• Clear summary of key changes provided
• Opportunity to review and ask questions about changes

Your Options When We Update

When we make material changes to this privacy policy, you have several options:

• Continue Using Our Services: By continuing to use our services after the effective date, you accept the updated policy
• Contact Us with Questions: Reach out if you need clarification about any changes
• Update Your Preferences: Adjust your privacy settings or communication preferences
• Exercise Your Rights: Request data deletion, restriction, or other rights under applicable law
• Discontinue Service: If you disagree with changes, you may stop using our services

Version History and Archive

We maintain records of our privacy policy updates:

• Previous versions are archived and can be requested
• Effective dates for all versions are documented
• Summary of changes between versions available upon request
• Legal retention of policy versions as required

Emergency Updates

In rare circumstances (such as security breaches or urgent legal requirements), we may need to update this policy immediately. In such cases:

• We will implement necessary changes immediately
• Notification will be provided as soon as reasonably possible
• Detailed explanation of the urgent circumstances will be provided
• Additional measures may be taken to protect user privacy

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, we encourage you to contact us. We're committed to addressing your privacy concerns promptly and thoroughly.

Primary Contact Information

Postal Address

Types of Privacy Requests

We can help you with various privacy-related requests:

When Contacting Us, Please Include:

• Your full name and the email address associated with your account
• A clear description of your request or concern
• Any relevant account information or order numbers
• Your preferred method of response
• Proof of identity for data requests (we may request additional verification)

Response Times

Request Type	Response Time	Notes
General Inquiries	48 hours	Business days only
Data Subject Requests	30 days	May extend to 90 days for complex requests
Urgent Privacy Concerns	24 hours	Security issues, data breaches
Marketing Opt-out	72 hours	Immediate for email unsubscribe links

Regulatory Contact Information

If you're not satisfied with our response to your privacy concerns, you can contact the relevant data protection authority: