Privacy Policy

Display Box Privacy Policy

Who we are

[Display Box Ltd] (Company No. 15597881, VAT No. 466120016) Website: https://displaybox.co.uk Email: [email protected] WhatsApp: +44 7822 014071 Address: Unit H2, Courtyard 3, Eckland Lodge Business Park, Desborough Road, Market Harborough, Leicestershire, LE16 8HB, ICO number - ZC206742

Effective date: [18/10/2026] (last reviewed [18/10/2026])

At Display Box, we are committed to protecting the privacy and security of our customers and website visitors. This Privacy Policy explains how we collect, use, disclose and safeguard your information when you browse our website, place an order, or contact us. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025 (DUAA), and the Privacy and Electronic Communications Regulations (PECR).

Information We Collect

We may collect and process the following types of information:

Identity and contact details: name, billing and delivery addresses, email address and phone number.
Account details: username, password (stored encrypted), order history, saved addresses, loyalty points and referral activity.
Order and payment information: products bought, order value, deposits and payment-plan instalments, refunds and returns. Card and bank details are entered directly with our payment providers; we do not see or store your full card number.
Delivery information: delivery address, phone number and tracking details shared with our couriers.
Communications: messages you send through our contact form, email, WhatsApp, Facebook or Instagram, and records of support requests.
Marketing preferences: whether you have subscribed to our emails, back-in-stock alerts you have requested, and how you interact with our emails.
Basket information: items added to your basket and, where you have entered it at checkout, your email address, even if you do not complete your order.
Technical information: IP address, approximate location derived from your IP address, device and browser type, pages visited, and security logs.
Reviews: if you leave a review through Trustpilot, the review and the name you choose to display.

We collect most of this information directly from you. Some comes from our partners, for example payment confirmations and fraud checks from payment providers, delivery updates from couriers, and analytics from Google.

Our Role as Controller

Display Box is the controller of the personal data described in this policy. This means we decide why and how your data is used, and we are responsible for protecting it. The service providers listed in section 7 process data on our behalf and only on our instructions, except where they act as independent controllers (for example PayPal and card networks for fraud and regulatory purposes).

Lawful Basis for Processing Under UK GDPR

We process personal data on the following lawful grounds:

Contractual necessity: to take and fulfil your order, process payments, deposits and payment plans, arrange delivery, manage your account, and handle returns and warranty claims.
Legal obligation: to keep accounting, tax and VAT records, meet consumer-law obligations, and respond to lawful requests from authorities.
Legitimate interests: to prevent fraud and protect our website, enforce our purchase limits fairly, send abandoned-basket reminders, invite reviews, improve our website and products, and send marketing emails to existing customers about similar products. We balance these interests against your rights and freedoms, and you may object at any time.
Consent: for non-essential cookies (analytics and advertising), marketing emails where you are not an existing customer, and back-in-stock alerts. You can withdraw consent at any time without affecting processing that has already taken place.

How We Use Your Information

We use collected data for the following purposes:

Processing, delivering and tracking your orders
Taking payments, deposits and payment-plan instalments, and issuing refunds
Managing your account, loyalty points and referral rewards
Customer support, returns and warranty claims
Showing prices and delivery options for your country
Sending order confirmations, invoices and delivery updates
Reminding you about items left in your basket
Notifying you when a product you asked about is back in stock
Sending marketing emails about new releases and offers (you can unsubscribe at any time)
Inviting you to review your purchase on Trustpilot
Measuring and improving our website, and measuring our advertising
Preventing fraud, bots and abuse, and keeping our website secure
Complying with legal obligations

Order screening and purchase limits

To keep high-demand releases fair, we limit how many of certain items one customer or household can buy. Our systems automatically check orders against your past purchases, name, billing and delivery addresses, and request patterns to spot bulk or automated buying. If an order appears to break our limits, a member of our team reviews it before we cancel it. If you think an order was cancelled in error, contact us and we will explain the decision, consider your comments, and have a person look at it again.

Marketing

If you buy from us, we may email you about similar products unless you opt out at checkout or later. Otherwise we only send marketing emails with your consent. Every marketing email has an unsubscribe link. We do not sell your personal data.

Cookies and Similar Technologies

We use cookies and similar technologies to run our shop and, with your consent, to understand how it is used and to measure our advertising. Strictly necessary cookies are always on. All other cookies stay off until you accept them in our cookie banner, and you can change your choice at any time through the cookie settings link at the bottom of every page.

Category	What it does	Examples	Consent needed
Strictly necessary	Keeps your basket, login and checkout working, and protects the site from attacks	WooCommerce, Cloudflare, Google reCAPTCHA, payment providers	No
Preferences	Remembers your country, currency and settings	Price Based on Country	No, where essential to the service you ask for
Analytics	Tells us how visitors use the site so we can improve it	Google Analytics via Google Tag Manager, Jetpack Stats	Yes
Marketing and personalisation	Measures our adverts and personalises offers	Google Ads, Salesfire	Yes
Embedded content	Plays product videos	YouTube	Yes

A full list of cookies, with their names and how long they last, is in our [Cookie Policy — add link].

Your Rights Under Data Protection Law (UK GDPR & DUAA)

As a data subject, you have the following rights under the UK GDPR and the Data Protection Act 2018 (as amended by the DUAA 2025):

Right of access: request a copy of the personal data we hold about you.
Right to rectification: ask us to correct inaccurate or incomplete data. You can also update most details yourself in your account.
Right to erasure ("right to be forgotten"): ask us to delete your data, subject to our legal retention obligations, such as keeping order records for tax purposes.
Right to restrict processing: limit how we use your data in certain circumstances.
Right to data portability: receive data you gave us in a structured, machine-readable format.
Right to object: object to processing based on our legitimate interests, and to direct marketing at any time.
Right to withdraw consent: where we rely on consent, for example for cookies or marketing.
Rights regarding automated decision-making: where an automated decision has a significant effect on you, you can ask for an explanation of how it was reached, give your own comments, and ask for a person to review it (see Order screening in section 4).

To use any of these rights, email [email protected]. We will respond within one month, and there is normally no charge.

Data Sharing & Third Parties

We do not sell your personal data. To run our shop, we share information with the trusted providers below. They act on our instructions under data processing agreements, unless marked as independent controllers.

Purpose	Providers	What they receive
Payments and payment plans	WooPayments (Stripe), PayPal (independent controller), Zopa Bank, PaymentNetwork, Partial.ly	Name, billing address, email, order value; card or bank details entered directly with them
Delivery	UPS, DHL Express, Royal Mail, DPD,	Name, delivery address, phone, email, parcel details
Website hosting and security	Dash Media, Cloudflare, Google reCAPTCHA, Jetpack (Automattic)	IP address, device and browser data, security logs
Email	[SMTP provider used by FluentSMTP], WebToffee email marketing tools	Name, email address, order and basket details, email engagement
Analytics and advertising	Google (Tag Manager, Analytics, Ads, Merchant Center), Salesfire	Cookie identifiers, pages viewed, purchase events (with consent only)
Reviews	Trustpilot	Name, email, order reference and product bought
Messaging	WhatsApp, Facebook Messenger and Instagram (Meta), if you choose to contact us there	Your messages and profile name
Business administration	Moore EastMids, HSBC, professional advisers	Order, invoice and payment records

We may also share information with law enforcement, HMRC or regulators where the law requires it, or with a buyer of our business if Display Box is ever sold or restructured.

International Transfers

Some of our providers, including Google, Stripe, PayPal, Cloudflare, Meta and Trustpilot, may process data outside the UK, for example in the United States or the European Economic Area. Where personal data is transferred outside the UK, we make sure it is protected by an appropriate safeguard. This may be UK adequacy regulations (which currently cover the EEA), the UK-US Data Bridge where the recipient is certified, or the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for more information about these safeguards.

Data Security & Retention

We protect your data with encryption in transit (TLS), a web application firewall, access controls with multi-factor authentication for staff accounts, regular software updates and security scans, and regular backups. Card payments are handled by PCI DSS-compliant payment providers, so we never store full card details.

We keep personal data only as long as we need it for the purposes it was collected, or as the law requires.

Data	How long we keep it
Orders, invoices and payment records	6 years from the end of the financial year (HMRC requirement)
Customer account	Until you close it, then order records as above
Warranty and returns records	Length of the warranty plus 1 year
Abandoned-basket data	90 days
Back-in-stock requests	Until the alert is sent or you cancel it
Marketing preferences	Until you unsubscribe, plus a suppression record so we do not email you again
Contact and support messages	2 years after the enquiry is closed
Security and request logs	90 days
Cookies	As set out in our Cookie Policy

Contact & Complaints

If you have concerns about how we handle your data or wish to exercise your rights, please contact us:

Email: [email protected] WhatsApp: +44 7822 014071 Address: Unit H2, Courtyard 3, Eckland Lodge Business Park, Desborough Road, Market Harborough, Leicestershire, LE16 8HB

To make a data protection complaint, please email or write to us at the address above. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.

If you believe we have not adequately addressed your concerns, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Data Breach Response

If a personal data breach occurs, we follow a structured process to limit its impact:

Detect and assess: identify the breach and work out what data and which customers are affected.
Contain: secure our systems, reset credentials and apply fixes to stop further access.
Notify: report the breach to the ICO within 72 hours where it poses a risk to individuals, and tell affected customers without undue delay where the risk is high, with advice on protecting themselves.
Investigate and improve: find the cause, fix it, and update our procedures to prevent it happening again.

Children

Our website is intended for adults. Customers under 18 may only buy from us with the involvement of a parent or guardian, as set out in our Terms & Conditions. We do not knowingly collect data from children for marketing.

Changes to This Policy

We review this Privacy Policy at least once a year and whenever our processing changes. The effective date at the top of this page shows when it was last updated. If we make significant changes, we will tell account holders by email.

Last updated 4 November 2026