Privacy Notice
Boxhall Marketing Ltd
This notice explains how Boxhall Marketing Ltd collects, uses, shares and protects personal data, and the rights you have over the data we hold about you. It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.
Last updated 25 June 2026.
1. Who we are
Boxhall Marketing Ltd ("we", "us", "our") is a company registered in England and Wales under company number 12497129, with its registered office at Office F12, Beverley Enterprise Centre, Beck View Road, Beverley HU17 0JT. Our VAT number is 353 6565 81. We are registered with the Information Commissioner's Office (ICO) under reference ZC030435.
We are the data controller for the personal data described in this notice. That means we decide why and how it is used.
If you have any questions about this notice, or you want to exercise any of your rights, contact us at harry@boxhallmarketing.co.uk or on 07711 782366.
2. Who this notice is for
This notice covers the personal data of our clients and their staff, prospective clients we are in contact with, our suppliers and contractors, and visitors to our website harryboxhall.co.uk.
When we deliver SEO and marketing services we sometimes handle personal data on a client's behalf, for example by logging into their website, analytics or advertising accounts. In those cases the client is the data controller and we act as their processor. That processing is governed by the data processing agreement we put in place with each client, not by this notice.
3. The personal data we collect, why, and how long we keep it
The table below sets out the categories of personal data we hold, why we use each one, the lawful basis we rely on, and how long we keep it.
| Personal data we hold | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|
| Contact and business details (name, job title, employer, work email, work phone) | To respond to enquiries, deliver our services and manage the relationship | Performance of a contract, and our legitimate interests in running and growing the business | For the life of the relationship and six years after it ends |
| Records of our work and correspondence (emails, meeting notes, reports, deliverables) | To deliver the work, keep an account of what was agreed and done, and answer later queries | Performance of a contract, and our legitimate interests in keeping proper records | Six years after the relationship ends |
| Account and login details a client gives us (website, analytics, advertising and similar tools) | To carry out the SEO and marketing work the client has engaged us for | Performance of a contract | Deleted when the engagement ends |
| Billing and payment details | To raise invoices, take payment and keep proper accounts | Legal obligation and performance of a contract | Six years after the end of the relevant accounting period |
| Prospect and marketing contact details | To send relevant marketing to businesses and prospects, with an easy opt out in every message | Our legitimate interests in promoting our services | Until you ask us to stop or the contact goes cold |
| Website and analytics data (cookie identifiers, data derived from your IP address, pages visited, clicks, scrolling, timestamps, device and browser information) | To run, secure and improve our website and understand how it is used | Consent for non-essential analytics cookies, and our legitimate interests in a secure, functioning site | Up to 26 months for analytics data |
We do not seek special category data (such as health, ethnicity, religion or political opinions) and we ask that you do not send it to us.
4. Where we get your data
We collect personal data in the following ways.
Directly from you, when you contact us, enquire about our services, or send us information during a project. From your organisation, when we are engaged to work with you. From publicly available sources, such as Companies House, LinkedIn and company websites, when researching or qualifying prospects. Automatically, through our website and its analytics when you visit.
5. More about our legitimate interests
Where we rely on legitimate interests, we have considered whether our use of your data is fair and whether it could override your own interests or rights. Our legitimate interests are running our business, delivering and improving our services, keeping proper records, securing our website, and promoting our services to other businesses. You can object to any processing we carry out on this basis at any time, and we will stop unless we have compelling grounds to continue.
6. Marketing
We may send marketing about our services to businesses and prospective clients where we have a legitimate interest in doing so. Every marketing message includes a simple way to opt out, and you can also tell us to stop at any time by emailing harry@boxhallmarketing.co.uk. We do not sell your data or share it with third parties for their own marketing.
7. Cookies and our website
Our website is hosted by Squarespace. When you visit, Squarespace collects information about your browser, network and device, the web pages you visited before arriving at our site, and your IP address. Squarespace needs this to run, protect and improve the site and its platform, and analyses it in a de-personalised form.
We use cookies and similar technologies, which are small files that download to your device when you visit. Functional and required cookies are always used so the site can be served to you securely. Analytics and performance cookies are used only after you acknowledge our cookie banner, and help us understand site traffic and activity. You can manage or refuse cookies through your browser settings, and through the cookie banner on our site.
Our website also uses font files from Google Fonts and Adobe Fonts. To display the site correctly, the servers storing these font files may receive information about your browser, network or device, and your IP address.
8. Who we share your data with
We share personal data only with the suppliers and advisers that help us run the business, and only under appropriate contracts. These include Squarespace (our website host and site analytics), Google (Workspace email, file storage and analytics), our accountant, and our professional advisers where needed. We may also disclose data where we are required to by law. We do not sell personal data. A current list of the providers that process personal data on our behalf is available on request.
9. Sending data outside the UK
Some of our providers, such as Google, may process personal data outside the UK. Where they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations, the UK Extension to the EU US Data Privacy Framework, or the International Data Transfer Agreement. You can ask us for more detail on the safeguards that apply.
10. How we keep your data secure
We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include access controls, secure cloud services, and limiting access to data to those who need it to do their work.
11. Automated decision-making
We do not make decisions about you based solely on automated processing, and we do not carry out profiling that produces legal or similarly significant effects.
12. Children
Our services and website are aimed at businesses and are not directed at children. We do not knowingly collect personal data relating to children.
13. Your rights
Under data protection law you have the following rights.
The right to be informed about how we use your data, which this notice provides. The right of access, to ask for a copy of the data we hold about you. The right to rectification, to have inaccurate data corrected. The right to erasure, to ask us to delete your data in certain circumstances. The right to restrict processing, to ask us to limit how we use your data. The right to data portability, to receive certain data in a portable format. The right to object, including to direct marketing at any time and to processing based on legitimate interests. Rights relating to automated decision-making, although as set out above we do not carry this out.
To exercise any of these rights, email harry@boxhallmarketing.co.uk. We will respond within one month. Exercising your rights is free in most cases.
14. Complaints
If you are unhappy with how we have handled your personal data, please contact us first at harry@boxhallmarketing.co.uk and we will acknowledge it within 30 days. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.
15. Changes to this notice
We may update this notice from time to time to reflect changes in how we work or in the law. The date at the top shows when it was last updated. Where changes are significant we will take reasonable steps to bring them to your attention.