Privacy Policy

1 Who we are

This policy explains how Option Box Limited, trading as Optionbox (“Optionbox”, “we”, “us”, “our”), collects, uses, shares and protects your personal data. We are a UK managed IT, telecoms and cyber security provider, and we are the “data controller” for the personal data described in this policy — meaning we decide how and why it’s used.

You can check our ICO registration at any time on the ICO’s public register using the reference above.

2 Who this policy covers

This policy applies to personal data we hold about:

• Clients and their staff — the businesses we provide IT, telecoms and cyber security services to, and the individuals at those businesses we deal with (for example, people who raise support tickets or manage the account).
• Website visitors — anyone who visits optionbox.co.uk.
• Marketing contacts — anyone who has asked us for a quote, enquired about our services, attended an event with us, or otherwise given us permission to contact them, and has not since opted out.

It does not cover the personal data of our own employees, which is dealt with separately under our internal HR policies.

3 Data we collect

Clients and prospective clients

• Contact details — name, job title, work email, phone number, business address.
• Account and billing information — company details, invoicing and payment information.
• Support and service data — details of support tickets, service requests, and communications with our helpdesk, including call recordings made through our phone system where applicable.
• Technical data necessary to deliver our services — for example device and account information relating to the IT systems we manage on your behalf. Where this includes personal data belonging to your own staff or customers, you remain the data controller for that information and we act as your data processor under a separate agreement.

Website visitors

• Information you submit through forms on our site — for example your name, email, phone number and the details of your enquiry.
• Technical and usage data collected automatically via cookies — see section 8.

Marketing contacts

• Name, email address, phone number and company details provided when requesting a quote, downloading content, or otherwise engaging with our marketing.
• Records of your marketing preferences and engagement with our communications (for example, whether an email was opened or a link clicked).

We do not knowingly collect special category data (such as health or financial data revealing your circumstances) through our website or marketing activity. If this ever becomes necessary — for example as part of a specific project — we will tell you and ask for your explicit consent where required.

4 How we collect it

• Directly from you — when you contact us, request a quote, sign up to our services, raise a support ticket, or fill in a form on our website.
• Automatically — through cookies and similar technologies when you use our website (see section 8).
• From third parties — for example from a business partner who refers you to us, or from publicly available sources such as Companies House.

5 How we use it & our legal basis

Under UK data protection law, we must have a valid “lawful basis” for every use of personal data. The table below sets out our main purposes.

Where we rely on consent (for example, marketing emails or analytics cookies), you can withdraw it at any time — see section 12 and section 8.

6 Who we share it with

We share personal data with the following categories of third party, only to the extent needed for the purposes above. These providers process data on our behalf under contracts that require them to protect it and only use it as we instruct.

We may also share personal data with:

• Professional advisers such as our accountants, auditors, insurers or solicitors, where necessary.
• Regulators, law enforcement or other authorities, where we are legally required to do so.
• A buyer or prospective buyer, if we sell or reorganise any part of our business.

We do not sell personal data to third parties.

7 International transfers

Some of the providers listed in section 6 — including Google Analytics and Go High Level — may store or process data outside the UK, including in the United States. Where this happens, we only use providers who offer an appropriate level of protection, for example through UK adequacy regulations, Standard Contractual Clauses, or an equivalent approved safeguard. Please contact us using the details in section 15 if you would like more information about a specific transfer.

8 Cookies

optionbox.co.uk uses cookies and similar technologies. These generally fall into two categories:

• Essential cookies — needed for the website to function correctly (for example, remembering your cookie preferences). These can’t be switched off.
• Analytics cookies — set by Google Analytics, used to understand how visitors use our site so we can improve it. These are only set with your consent.

You can manage or withdraw your cookie consent at any time through the cookie banner on our website, or through your browser settings. Blocking essential cookies may affect how the site works.

9 How long we keep it

We keep personal data only for as long as necessary for the purposes it was collected for, including to satisfy any legal, accounting or reporting requirements. In practice, this generally means:

• Client and billing records are kept for the duration of our relationship and for a period afterwards to meet our legal and tax obligations.
• Marketing contact details are kept until you unsubscribe or ask us to delete them, or until we identify that they are no longer active.
• Website enquiry data is kept for as long as needed to deal with your enquiry and any follow-up.

When personal data is no longer needed, we securely delete or anonymise it.

10 How we protect it

As an IT and cyber security provider, we take the security of personal data seriously. We use appropriate technical and organisational measures to protect it, including access controls, encryption where appropriate, regular security reviews and staff training. No system is completely immune to risk, but we work to keep that risk as low as reasonably possible and to respond quickly if anything goes wrong.

11 Your rights

Under UK data protection law, you have the following rights over your personal data:

To exercise any of these rights, contact us using the details in section 15. We’ll respond within one month, as required by law.

12 Marketing preferences

You can opt out of marketing communications from us at any time by clicking the unsubscribe link in any marketing email, or by emailing privacy@optionbox.co.uk. Opting out of marketing won’t affect service communications relating to a contract you have with us, such as support notices or invoices.

13 Children’s data

Our services are aimed at businesses, not consumers, and we do not knowingly collect personal data from children. If you believe we hold data from a child, please contact us and we will remove it.

14 Changes to this policy

We may update this policy from time to time, for example to reflect changes in our services or the law. We’ll update the “last updated” date at the top of this page when we do. We encourage you to review this page periodically.

15 Contact us & complaints

If you have any questions about this policy, or want to exercise any of your rights, please get in touch:

If you’re unhappy with how we’ve handled your data, you also have the right to complain to the UK’s data protection regulator: