Privacy Policy

Bboxx Limited, whose contact address is 9b Power Road, Chiswick, London W4 5PY, telephone number +44 (0)20 8987 3195, email info@bboxx.co.uk, (“Bboxx”) controls and processes the following personal data:

1. Employees (including contractors, temporary staff and interns)
   Bboxx holds identification and contact data, including tax, national and insurance details. Bboxx also maintains employee files containing references, performance appraisals and disciplinary records. Where references are held on file, this will include the name and contact details of the individual providing the reference.

Bboxx holds this data:

• to comply with its legal obligations with regard to its pension obligations, employer’s insurance, health and safety at work requirements;
• to comply with its legal obligations in respect of tax and national insurance;
• to comply with its legal obligations in respect of visa, right-to-work and immigration requirements;
• in its own legitimate interests to facilitate effective HR management and administration and foster talent.

Note that, where identification data is held in compliance with immigration and visa obligation, that data may indirectly disclose an employee’s race or ethnic origin, thus categorising it as Special Category Data. This Special Category Data is held so that Bboxx complies with its legal obligations in the UK or other EU member state.

In common with many businesses, Bboxx uses cloud storage platforms. The data stored on these platforms may contain personal data relating to employees as well as other stakeholders. The cloud storage platforms used by Bboxx are provided by well-known respected providers and are private to Bboxx. These storage facilities are located in the EU and consequently are subject to the EU General Data Protection Regulation (GDPR). The provision of this cloud storage is governed by formal legal agreements between Bboxx and the cloud provider.

Bboxx will retain employee personal data for the period of time during which each employee remains an employee of Bboxx. After an employee leaves Bboxx, the personal data will be retained for so long as necessary to provide references and comply with tax and national insurance obligations. Thereafter a former employee’s data will be reviewed and retained for so long as necessary for, e.g. pension administration.

Personal data provided by candidates for jobs at Bboxx will be retained for a minimum of six (6) months up to twelve (12) months, although with the agreement of the candidate that data may be retained for longer in the event that a suitable role becomes available.

An employee of Bboxx may at any time make a data subject request in order to discover what personal data of theirs is controlled or processed by Bboxx. An application may be made for errors in that data to be rectified and where necessary transferred to another person.

The right of an employee or former employee to receive a copy of the personal data they have provided to Bboxx, and the right to have that data transferred to another data controller (the “right to data portability”), applies to that personal data provided by the employee and in circumstances where the request is not manifestly unfounded, excessive or would prejudice the rights of others.

Former employees may exercise their right for their personal data to be erased (the “right to be forgotten”) in certain circumstances, such as where the data is no longer necessary for Bboxx’s legitimate interests or if Bboxx has processed the data unlawfully.
The right of current Bboxx employees to have their personal data deleted is overridden by Bboxx’s own legitimate interests and its statutory and legal obligations.

An employee wishing to have their personal data rectified, deleted or transferred to another person should contact Bboxx’s Data Protection Officer.

Bboxx’s Data Protection Officer is Simon J Cox [s.cox@Bboxx.co.uk]. Employees with queries or concerns about Bboxx’s control and processing of their personal data should contact Simon.

Employees with serious concerns about Bboxx’s control and processing of their personal data, or who are not satisfied with any response from Bboxx may raise the issue with the Information Commissioner’s Office [0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF].

2. Customers, including prospective customers.
   Bboxx holds identification and contact data and financial data on its customers, including details of income. This is in order to assess each customer’s credit-worthiness and whether to enter into or continue supply contracts with each customer. Bboxx also controls and processes data relating to the usage of Bboxx products and services.

Bboxx holds this data in its own legitimate interests. It is necessary for Bboxx to know to whom its products and services are being provided and to make assessments as to whether the original supply, and the continuation of supply, of products and services is economically viable.

In common with many businesses, Bboxx uses cloud storage platforms. The data stored on these platforms may contain personal data relating to customers as well as other stakeholders. The cloud storage platforms used by Bboxx are provided by well-known respected providers and are private to Bboxx. These storage facilities are located in the EU and consequently are subject to the EU General Data Protection Regulation (GDPR). The provision of this cloud storage is governed by formal legal agreements between Bboxx and the cloud provider.

Bboxx will provide its NGU partners with access to commercial data. This may include personal data relating to customers and is accessed in-country by the NGU. As NGUs are located outside the EEA in territories to which no adequacy decision has been made by the EU, and to the extent that this commercial data includes personal data relating to customers, its transfer, processing and access by the NGU is subject to a binding legal agreement between the NGU and Bboxx safeguarding that personal data and giving customers and other data subjects the rights contained within the GDPR.

Bboxx will retain the [name, contact details and payment details] of donors to Bboxx’s “Pay by Diaspora” programme for up to 12 months.

Bboxx will retain customer’s personal data for the period during which the customer remains a customer of Bboxx products and services. A customer’s personal data will be retained by Bboxx for an unspecified period of time after the customer ceases to be a Bboxx customer. This is due to Bboxx having to consider any legal obligations to keep the data for a fixed period of time (for example national labour, tax or anti-fraud laws) requiring Bboxx to keep personal data for a defined period.

A customer of Bboxx may at any time make a data subject request in order to discover what personal data of theirs is controlled or processed by Bboxx. An application may be made for errors in that data to be rectified. Application may also be made for the data to be transferred to another person or deleted from Bboxx’s databases.

The right of a customer to receive a copy of the personal data they have provided to Bboxx, and the right to have that data transferred to another data controller (the “right to data portability”) applies to that personal data provided by the customer and in circumstances where the request is not manifestly unfounded, excessive or would prejudice the rights of others.

Customers may exercise their right for their personal data to be erased (the “right to be forgotten”) in certain circumstances, such as where the data is no longer necessary for Bboxx’s legitimate interests or if Bboxx has processed the data unlawfully. Customers should, however, be aware that deletion of their personal data from Bboxx’s databases would mean that Bboxx will be unable to provide products and services.

A customer wishing to have their personal data rectified, deleted or transferred to another person should contact Bboxx’s Data Protection Officer.

Bboxx’s Data Protection Officer is Simon J Cox [s.cox@Bboxx.co.uk]. Customers with queries or concerns about Bboxx’s control and processing of their personal data should contact Simon.

Customers with serious concerns about Bboxx’s control and processing of their personal data, or who are not satisfied with any response from Bboxx may raise the issue with the Information Commissioner’s Office [0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF].

3. Recipients of Bboxx marketing information, including investor information.
   Bboxx will retain personal data in order to send marketing and promotional information to those interested. Investors and potential investors will also be sent information.

In each case the personal data held will usually be limited to contact details such as name and email address notified to Bboxx via the contact form on the Bboxx website.

Bboxx holds this personal data in its own legitimate interests because:

• it considers that it is important to communicate Bboxx’s activities to interested parties in order to extend the opportunities which Bboxx’s products and services give to individuals and communities in Africa, and;
• those using the contact form on the Bboxx website have by implication expressed an interest in Bboxx’s activities and will wish to be kept informed of them.

Individuals completing the contact form on the Bboxx website are deemed to have consented to certain data, that is, their name and email address, being held by Bboxx. This is so that Bboxx can respond to the message or request for information. The individual will be contacted to ask for consent to the data being retained for marketing and communications purposes.

Individuals submitting their email address to sign up for Bboxx’s newsletter are deemed to have consented to that email address being held on Bboxx’s mailing systems. Individuals can request that their email be deleted from those systems at any time by ticking the appropriate box on each newsletter. This way Bboxx can continue to send the newsletter. Bboxx will retain that email address provided until the individual chooses to opt-out of receiving the newsletter.

Personal data held for marketing purposes will be retained for up to 26 months.

Any recipient of Bboxx marketing and promotional material may make a data subject request to discover what personal data of theirs is controlled or processed by Bboxx, although in most cases this will be limited to name and email address. Application may be made for any errors to be corrected.

Recipients of Bboxx marketing and promotional material may at any time ask to be removed from lists of those receiving Bboxx marketing and promotional material (in other words, having their personal data deleted from Bboxx databases). Such a request should be emailed to marketing@bboxx.co.uk.

Bboxx’s Data Protection Officer is Simon J Cox [s.cox@Bboxx.co.uk]. Marketing material recipients with queries or concerns about Bboxx’s control and processing of their personal data should contact Simon.

Recipients of marketing or promotional material with serious concerns about Bboxx’s control and processing of their personal data, or who are not satisfied with any response from Bboxx, may raise the issue with the Information Commissioner’s Office [0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF].

4. Investors, potential investors, donors, supporters and other stakeholders.
   Bboxx will retain contact information on business-to-business contacts and in some cases, this will include personal data relating to individuals.

In most cases the personal data retained will be limited to name, email address and telephone numbers or the details included on a particular individual’s business card or e-card.

Bboxx holds this personal data in its own legitimate interests because:

• in common all businesses need to maintain relationships with potential investors and other parties who support Bboxx’s aims;
• Bboxx considers it important to raise awareness of its work and products.

Bboxx will not share personal data held in respect of its stakeholder contacts.

Personal data held in respect of stakeholder contacts will be retained for so long as Bboxx’s relationship with that stakeholder continues.

Personal data is processed by Bboxx using well-known and widely available relationship management, analytic, survey and email distribution software. The data itself is held on Bboxx’s own servers or those of its cloud platform providers within the EU.

A person who is the contact point in any of Bboxx’s stakeholder relationships may make a data subject request to discover what personal data of theirs is controlled or processed by Bboxx, although in almost all cases this will be limited to the information described above. Application may be made for any errors to be corrected.

Investors, potential investors, donors, supporters and other stakeholders may at any time ask to be removed from Bboxx contact lists (in other words, having their contact data deleted from Bboxx databases). Such a request should be emailed to Info@bboxx.com or by ticking the box included in Bboxx communications.

Bboxx’s Data Protection Officer is Simon J Cox [s.cox@Bboxx.co.uk]. Stakeholder contacts with queries or concerns about Bboxx’s control and processing of their personal data should contact Simon.

Stakeholder contacts with serious concerns about Bboxx’s control and processing of their personal data, or who are not satisfied with any response from Bboxx may raise the issue with the Information Commissioner’s Office [0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF].

June 2020