Who we are
Box Count Ltd (“we”, “us”, “our”) is a limited company registered in England and Wales. Our registered company number is available on request. Our website is www.boxcount.co. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Box Count Ltd is the data controller.
Contact: rory@boxcount.co
What data we collect
We may collect and process the following personal data:
- Information you provide via our contact form: first name, last name, email address, company name, and the content of your message.
- Information you provide when you book a training course: your name, email address, organisation, job title and any other details you give in the booking form. Card payments are taken by Stripe; we receive confirmation of payment but never see your full card details.
- Information you provide when you complete the Rights Holder Effectiveness Assessment and ask us to contact you: your name, work email, organisation, job title, phone number (optional), your answers and resulting score.
- Information you provide by emailing us directly at rory@boxcount.co, including your name, email address, and the content of your correspondence.
- Technical data collected automatically when you visit our website, including your IP address, browser type, operating system, referring URL, pages visited, and time spent on those pages.
Technical data is collected by our hosting provider, Cloudflare, and, where you allow it, through Google Analytics cookies.
How and why we use your data
Responding to enquiries
When you contact us through our contact form or by email, we use your personal data to respond to your enquiry and, where relevant, to discuss how we might work together. The legal basis for this processing is our legitimate interest in responding to business enquiries (Article 6(1)(f) UK GDPR).
Website analytics
We use Google Analytics to understand how visitors use our site and to improve its content and performance. Analytics cookies are only set with your consent (Article 6(1)(a) UK GDPR and the Privacy and Electronic Communications Regulations).
Course bookings
When you book a course, we use your details to confirm your place, take payment, send joining information and issue an invoice. The legal basis is the performance of a contract with you (Article 6(1)(b) UK GDPR), and our legal obligation to keep financial records (Article 6(1)(c)).
Marketing
We will only send you marketing communications if you have given your explicit consent or if we have an existing business relationship with you and the communications relate to similar services. You can opt out of marketing communications at any time by contacting us at rory@boxcount.co. Where consent is required, the legal basis is Article 6(1)(a) UK GDPR. Where we rely on legitimate interest, the legal basis is Article 6(1)(f).
Cookies
Our website uses a small number of cookies and similar technologies:
- Essential cookies set by Cloudflare, our hosting provider, to keep the site secure and working.
- Google Analytics cookies (such as _ga and _ga_*) that help us understand how visitors use the site. These are only set with your consent.
- Cookies set by Stripe on its own checkout pages when you pay for a course.
When you first visit, we ask whether you accept analytics cookies. You can change your choice at any time with the Cookie settings link at the foot of every page, and manage cookies through your browser settings. Google explains how it uses data from sites that use its services at policies.google.com/technologies/partner-sites.
Third-party services
Our website contains links to third-party services, including:
- Substack (thesponsorshipeffect.substack.com), where we publish a newsletter. If you subscribe, Substack will collect and process your data in accordance with its own privacy policy.
- LinkedIn (linkedin.com/company/box-count), where we maintain a company page. LinkedIn processes data in accordance with its own privacy policy.
We are not responsible for the privacy practices of these third-party services. We encourage you to read their respective privacy policies before providing them with your personal data.
Who we share your data with
We do not sell your personal data to third parties.
We may share your data with:
- Cloudflare, which hosts our website.
- Formspree, which receives the information you submit through our contact, booking and assessment forms and passes it to us by email.
- Stripe, which processes course payments.
- Google, which provides Google Analytics and the web fonts used on the site.
- Professional advisors (such as accountants or legal advisors) where necessary for the operation of our business.
- Law enforcement or regulatory bodies where we are required to do so by law.
International transfers
Some of the providers listed above process data outside the UK, including in the United States. Where this happens, the transfer relies on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. Each provider’s privacy policy gives further details.
How long we keep your data
We retain personal data collected through the contact form and email correspondence for as long as is necessary to fulfil the purpose for which it was collected, or for as long as we have an ongoing business relationship or legitimate reason to retain it.
As a general guide:
- Contact form submissions and email correspondence: retained for up to two years after our last interaction, unless there is a continuing business relationship.
- Course booking and payment records: retained for six years after the end of the financial year they relate to, to meet our tax and accounting obligations.
- Website analytics data: retained for the period set in our Google Analytics account, up to 14 months.
We review retained data periodically and delete data that is no longer necessary.
Your rights
Under the UK GDPR, you have the following rights in relation to your personal data:
- The right to access the personal data we hold about you
- The right to ask us to correct inaccurate or incomplete data
- The right to ask us to delete your data in certain circumstances
- The right to ask us to restrict the processing of your data in certain circumstances
- The right to object to the processing of your data where we rely on legitimate interest
- The right to data portability in certain circumstances.
To exercise any of these rights, please contact us at rory@boxcount.co. We will respond within one month of receiving your request.
If you are not satisfied with how we have handled your request, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.
Changes to this policy
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “last updated” date. We encourage you to review this policy periodically.