Privacy Policy

Who we are

Boxwood House Ltd is the data controller responsible for your personal data. We are registered in England and Wales. If you have questions about this policy or how we handle your data, contact us at craig@boxwoodhouse.co.uk.

What data we collect

We keep data collection to a minimum. The personal data we may process includes:

• Contact information you provide when you email us, such as your name, email address, phone number, and the content of your message
• Professional details shared during the course of a consulting engagement, such as your job title, organisation, and business requirements
• Technical data collected automatically by our hosting provider (Vercel), such as IP addresses and basic server logs, which we do not access or analyse for tracking purposes

We do not use cookies, analytics tools, or tracking technologies on this website.

How we use your data

We process personal data only where we have a lawful basis to do so under UK GDPR. The bases we rely on are:

• Legitimate interests — to respond to enquiries, manage client relationships, and operate our business effectively
• Contractual necessity — to deliver consulting services under an agreed engagement
• Legal obligation — to comply with applicable laws, such as tax and accounting requirements

Sharing your data

We do not sell, rent, or trade your personal data. We may share data with:

• Service providers who support our operations, such as email hosting, cloud storage, and accounting services, all of whom process data on our behalf under appropriate safeguards
• Legal or regulatory authorities where required by law

Data retention

We retain personal data only for as long as necessary for the purpose it was collected. Enquiry correspondence is typically retained for up to two years. Client engagement records are retained for the period required by applicable tax and legal obligations.

International transfers

Our hosting provider (Vercel) may process technical data outside the UK. Where this occurs, appropriate safeguards are in place in accordance with UK GDPR requirements.

Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data, where there is no overriding legal basis for retention
• Object to or restrict the processing of your data
• Request a portable copy of your data
• Lodge a complaint with the Information Commissioner's Office (ICO) if you believe your rights have been infringed

To exercise any of these rights, contact us at craig@boxwoodhouse.co.uk.

Changes to this policy

We may update this policy from time to time. Any changes will be published on this page with an updated effective date.

Last updated: April 2026