Privacy Policy
Last updated: 21 October 2026
This policy explains how White Box Care collects, uses, shares and keeps personal information, and how you can contact us or exercise your rights. It covers our website, orders and customer communications, and our care home and business contact records.
1 Who we are
White Box Care is the trading name of White Box Gift Company Limited, company number 11220254. We are the controller responsible for the personal information described in this policy. It covers visitors to www.whiteboxcare.co.uk, customers, gift recipients, enquirers and contacts at care homes and other businesses.
Our trading and correspondence address is Unit 5, Farrington Enterprise Estate, Hoyle Road, Peacehaven, BN10 8LW. Our registered office is 72 Lenham Avenue, Saltdean, Brighton, East Sussex, BN2 8AG.
For privacy enquiries, requests or complaints, email sales@whiteboxcompany.co.uk, call 01273 009496 or write to our trading address, marking your message for the person responsible for data protection.
2 Information we collect
We collect names, business names, email addresses, telephone numbers, billing and delivery addresses, order details, payment status and correspondence needed to deal with enquiries, orders, deliveries, returns and complaints. Our records may also include your job role or business contact details and your marketing preferences, including opt-outs.
If you buy a gift for another person, we receive the recipient’s name, delivery address and any contact information or delivery instructions you provide. Please give us only what is needed to fulfil the order and make the recipient aware of this policy.
Website and advertising tools may collect technical and usage information, such as IP addresses, device and browser information, pages visited, interactions and cookie identifiers. The information collected depends on the tools used and your choices.
We do not routinely request health information or other sensitive information about care home residents. Please do not include medical details or other unnecessary sensitive information in order notes or messages.
3 Where information comes from
We receive information directly when you order online, by email, by telephone or using an order form, contact us, or manage your preferences. We may receive recipient information from the person or care home placing an order.
For our care home and business directory and marketing, we may obtain business contact information from publicly available sources and mailing-list suppliers. These records may contain names, roles, business addresses, telephone numbers and email addresses. You can ask us where we obtained your personal information. A publicly available address or a supplied mailing list does not itself mean that you have agreed to receive marketing.
4 Why we use information
Orders and enquiries: we use information to answer questions, prepare quotations, accept and fulfil orders, take payments, arrange delivery and deal with returns. For individuals buying personally, the lawful basis is taking steps at your request before a contract or performing our contract with you. For staff representing a business customer, we rely on our legitimate interest in managing that business relationship. For a gift recipient who is not our contracting customer, our legitimate interest is arranging and completing the requested delivery.
Records and legal duties: we use relevant information to keep required tax and accounting records and comply with legal obligations. We also rely on legitimate interests where necessary to resolve disputes, establish or defend claims, prevent misuse and protect our business and customers.
Business directory: we rely on our legitimate interest in maintaining accurate, relevant care home and business contacts and managing potential and existing customer relationships. We consider the purpose, the information needed, your reasonable expectations and the effect on your rights.
Marketing: we use consent or legitimate interests as appropriate, subject to the electronic marketing rules explained below. Consent is also used for advertising tracking and other optional website technologies where required. Essential website operation relies on our legitimate interest in providing a secure, working shop, alongside any applicable contractual obligations.
Where order or delivery information is necessary and you do not provide it, we may be unable to give a quotation, process payment or deliver the order. Providing optional information or agreeing to marketing is not a condition of placing an order.
5 Marketing and your choices
We send promotional emails and postal mailshots about our gifts and toiletries. For relevant contacts at limited companies and other corporate subscribers, we may rely on legitimate interests for business marketing, taking account of your role and reasonable expectations. You can object at any time.
We send marketing emails to individuals, sole traders and partnerships treated as individual subscribers only where we have a record of their explicit agreement to receive them. Buying from us, appearing in a directory or being included on a supplied contact list does not by itself give that agreement. Agreeing to marketing is optional.
To stop marketing, use the unsubscribe option in an email or contact sales@whiteboxcompany.co.uk. You can tell us which channels you want to stop. We will stop using your personal information for direct marketing, including related profiling, when you object. Necessary order confirmations, payment and delivery messages can continue.
We keep a limited suppression record to avoid contacting you again by mistake. Retaining a relevant care home or business contact record does not override your marketing objection. Our campaign procedures require these choices to be checked before messages are sent.
6 Who we share information with
We share the information needed to provide our services with website, store and email-marketing provider Wix; business email provider Microsoft 365; payment processor Stripe; delivery provider DHL; and our CRM database provider Supabase. The information shared depends on the service: for example, a delivery provider needs recipient and address information, while a payment provider needs information to process and reconcile a payment.
We also use specialist business contact-list suppliers and campaign providers. A provider may supply its own business contact lists and send campaigns using those lists on our behalf. We do not send our existing customer records to that list supplier and campaign provider. Our own customer email marketing is handled through Wix. You can ask us to identify the source of your contact details or the provider involved in a particular campaign.
Some providers, including payment and delivery services, also use information for their own security, legal or regulatory responsibilities under their own privacy notices. Where a provider acts on our instructions, its handling of personal information is subject to the relevant data-processing terms.
We may disclose relevant information to professional advisers, regulators, courts or other authorities where necessary to meet legal obligations or establish, exercise or defend legal rights.
7 Payments and telephone card details
Stripe processes card payments and payment links. Our business records include information needed to match payments to orders, but we do not write down or record full card details given over the telephone. If we take a card payment by phone, a member of staff enters the details into the payment system to process that payment. Please do not send card numbers or security codes by email or in order notes.
Bank transfer and cheque payments involve the payment and reconciliation information needed to administer your order. Relevant records are kept under the retention rules below.
8 Cookies and website tracking
Our website uses Wix cookies and similar technologies for functions such as security, the shopping basket, remembering choices and understanding website use. Essential technologies needed to provide the service you request cannot be switched off through the consent banner. Optional analytics, functional and marketing categories are switched off unless you agree.
The banner offers Accept all, Reject all and Manage settings. Reject all declines the optional categories. You can reopen Cookie settings on the website to change or withdraw your choices for future use. You do not have to accept optional tracking to place an order.
Wix publishes details of its standard cookies, including their purposes and durations, in Cookies and Your Wix Site at https://support.wix.com/en/article/cookies-and-your-wix-site. Examples described by Wix include session security cookies, rendering cookies lasting up to 24 hours and persistent security or stability cookies lasting up to 12 months. The technologies present can depend on the Wix features used and your choices.
We review the cookie information when website features change. Further information about cookies used by a particular feature is available from us on request.
9 Where information is stored
We keep customer records in Wix, business email, our CRM and spreadsheets on company computers. Microsoft 365 provides our email service. The CRM uses a cloud database provided by Supabase as well as local working information. Staff use their own CRM logins and do not have access to email or Wix.
Company computer backups are kept on local external drives. They are updated weekly, replacing the previous copies. Information removed from a working record may therefore remain in a backup until the next successful weekly replacement. If we restore a backup, relevant deletions and marketing objections must be reapplied before the restored information is used.
Our cloud services operate internationally, so personal information may be processed or accessed outside the UK. Wix identifies Israel as its initial processing location and describes onward processing in other countries. Microsoft operates international services, Supabase’s contracting provider is in Singapore, and Stripe’s transfer terms cover processing in the United States. These statements do not mean that all mailbox or CRM records are stored in any one country.
The providers’ published data-protection terms describe the safeguards applicable to their services. Depending on the destination and transfer, these include recognised adequacy arrangements and contractual protections, including standard contractual clauses with the applicable UK terms or addendum. You can contact us for details of relevant transfers and a copy of, or information about, the safeguards, subject to necessary redactions.
10 How long we keep information
Our retention procedure sets the following periods. We review records due for removal monthly, with a separate annual review of the care home and business directory. Different parts of the same customer record may have different retention requirements.
Order, invoice and relevant payment or accounting records: normally six years from the end of the financial year to which they relate. We keep records longer where a specific legal requirement or an unresolved claim requires it.
Unsuccessful enquiries and quotations: normally 12 months after the last meaningful contact, unless the enquiry remains active or there is another documented reason to keep the record.
Care home and business directory contacts: while the information remains current and relevant to our business relationships, with an annual review to correct, reduce or remove records that are no longer needed. There is no automatic right to keep every named contact indefinitely.
Eligible individual and family marketing contacts: removed from active marketing after 24 months without a purchase, enquiry or other substantive interaction. Sending emails does not itself restart that period. Separate records may remain where needed for orders, legal duties or suppression.
Marketing suppression records: the minimum identifier, preference and date needed to prevent unwanted contact, for as long as necessary for that purpose, reviewed annually. We do not keep a full customer history merely to remember an opt-out.
Complaints, privacy requests and other correspondence: for as long as needed to deal with the issue and demonstrate how it was handled, taking account of its nature, legal obligations and any continuing dispute. Cookie and analytics retention depends on the particular technology and settings.
When information is no longer needed, it is deleted or anonymised unless a specific legal requirement or continuing claim justifies restricted retention. These rules cover working copies and exports. Local computer backups follow the weekly replacement cycle described above; cloud providers also operate their own service backup and recovery arrangements. An opt-out does not automatically erase records required for tax or an outstanding order.
11 Looking after information
Staff have individual CRM logins, and their access is limited to their work. They do not have access to our email or Wix accounts. We use the security controls available in the services we use and require staff to handle customer information carefully and confidentially.
If you suspect that information held by us has been lost, disclosed incorrectly or accessed without authority, please contact us promptly using the details above.
12 Your data protection rights
Depending on the circumstances, you can ask for access to your personal information, correction of inaccuracies, deletion, restriction of use, or a portable copy of information you have supplied. You can object to processing based on legitimate interests. Your right to object to direct marketing is absolute. Where we rely on consent, you can withdraw it without affecting earlier lawful use.
Contact us using the details above to exercise your rights. We may need proportionate information to confirm your identity. We normally respond without undue delay and within one calendar month; if a lawful extension or other exception applies, we will explain it. Requests are normally free of charge. Some rights are subject to legal exceptions, such as keeping required accounting records.
13 Decisions about orders and credit
Decisions about accepting orders and granting credit are made by the business owner. We do not use a system that automatically refuses orders or decides who receives credit. Using software to organise records or send permitted marketing does not change that.
14 Privacy complaints
Please tell us if you are unhappy with how we use your information. We aim to send an initial response within five working days. We will acknowledge a data protection complaint within 30 days, make appropriate enquiries, keep you informed and communicate the outcome without undue delay.
You can also complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk/make-a-complaint. You do not have to give up that right by raising the issue with us first.
15 Changes to this policy
We may update this policy when our practices or legal requirements change. The version date will appear at the top of the website policy. Where a change needs further notice or a new consent, we will take the appropriate steps.