Privacy Policy

About this policy

Who should read this policy: Everyone who accesses and uses the OnBoard platform (HubBox OnBoard) or downloads our Shopify App including the staff and sub-contractors of our existing customers (Retailers) (in particular, the individuals who integrate our software and services into the Retailers’ websites). Everyone who arranges for a delivery to be collected from a Pickup Point. Everyone who accesses and uses our website (our Website). Other business contacts, such as staff of our Retailers and prospective customers, and the suppliers and service providers to our business (collectively, you / your).

What is covered: This policy sets out what information we collect about you, what we use it for and who we share it with. It also explains your rights and what to do if you have any concerns about your personal data.

Who to contact about this notice: If you have any questions about this privacy policy, how we handle your personal data or you are looking to exercise one of your rights, please contact: privacy@hub-box.com.

Latest updates: We try to review this policy regularly. This policy was last updated in December 2023. We may sometimes need to update this policy to reflect changes to the way we provide our services or to comply with updates to data protection law. Where possible, we will notify you of any substantive changes but please check back regularly to see whether any changes have occurred. 

Who checks this policy is enforced: The Information Commissioner’s Office (ICO) is the UK regulator and is responsible for checking that businesses comply with UK Data Protection Law. 

  1. About us

We are Convenient Collect Limited t/a HubBox, registered in England and Wales with company number 09271441 whose registered address is 50 Liverpool Street, London, England, EC2M 7PY (we / us /our).

If you access our Website or HubBox OnBoard, or download our Shopify App, we are the controller of your information (which means we decide what information we collect and how it is used). We are registered with the Information Commissioner’s Office (ICO), the UK regulator for data protection matters, under number ZA423502.

If you have any questions about this privacy notice or the way that we use information, please get in touch using the following details:

  1. Information we collect about you

Personal data means any information which does (or could be used to) identify a living person. We have grouped together the types of personal data that we collect, where we receive it from, and when we receive it, in the table below. 

Generally, we collect personal data from you when you:

Types of Personal DataThe who, where & when
Identity Data – your first and last name or title. You – when you create an account on HubBox OnBoard or download our Shopify App or fill in the contact form on our Website.
Contact Data – your email address, telephone numbers, home address.You – as above.
Location Data – your device location if you use our Website or log into HubBox OnBoard remotely.You (including via cookies) – when you log into HubBox OnBoard or download our Shopify App.
Feedback – information and responses you provide for market research purposes.You – when we ask you to complete surveys and questionnaires.
Account Data – email address, password, username, chat logs, support requests, audit trail of systems used and documents accessed and downloaded whilst using HubBox OnBoard.You (including via cookies and other technologies) – when you create an account on HubBox OnBoard and use the services on HubBox OnBoard.
Sales and Marketing Data – includes your preferences in receiving marketing from us and our third parties.Other organisations with which we do business (e.g. couriers)
Publicly available sources
You – when you subscribe to our mailing list from our Website.
Technical Data – internet protocol (IP) address, browser type and version, time zone setting and generic location, browser plug-in types and versions, operating system and platform on the devices you use to access our Website and/or HubBox OnBoard.You (via cookies and other similar technologies) – when you access or use our Website, HubBox OnBoard or our Shopify App.
Usage Data – information about how you use our Website and/or HubBox OnBoard and the resources you access. You (via cookies and other similar technologies) – as above.

Keeping your personal data up to date

If your personal details change you may update them by updating your account information in HubBox Onboard or your Shopify account, in which case the update will take effect immediately, or by contacting us using the contact details below, in which case we will endeavour to update your personal data within seven working days of any new or updated personal data being provided to us.

Contact Form

The primary instance where our Website will ask you for personally identifiable information is our contact form. The contact form specifically, is powered by a popular WordPress plugin called Contact Form 7. Upon completing your information, you will be asked to consent to our data processing policy which is outlined within this document. 

Once submitted, your information will be processed and forwarded to us within a single email sent by the Website application. Your information will not be stored within the Website application’s database.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Hotjar

We use Hotjar in order to better understand our users’ needs and to optimise this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies (listed later in this policy) and other technologies to collect data on our users’ behaviour and their devices (in particular device’s IP address (captured and stored only in anonymized form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our Website). 

Hotjar stores this information in a pseudonymized user profile. Neither Hotjar nor we will ever use this information to identify individual users or to match it with further data on an individual user. For further details, please see Hotjar’s privacy policy.

You can opt-out to the creation of a user profile, Hotjar’s storing of data about your usage of our site and Hotjar’s use of tracking cookies on other websites by following this opt-out link.

Hubspot

This Website uses the HubSpot – an inbound marketing and sales platform to customise content to visitors and adapt how we communicate with them.

HubSpot uses cookies (which are detailed below) and pixel tags to analyse your use of our Website. This anonymous information is transferred to and stored in a HubSpot server in the USA. You can learn more about HubSpot’s privacy practices by reading their privacy policy.

  1. How we use your information

Under UK data protection law, we need a legal reason (known as a lawful basis) for holding, collecting and using your personal data. There are 6 main legal reasons which organisations can rely on. The most relevant are:

Please note that, where we need to collect your personal data to perform a contract either with you or with a Retailer, failure to provide us with your personal data may mean that we are not able to provide you or the Retailer with our services. Where we do not have the information required about you, we may have to suspend or cancel the service ordered.

Users of HubBox OnBoard

If you are an employee or subcontractor of a Retailer, and you access and use HubBox OnBoard, we collect and use your personal data for the purposes set out above (in connection with HubBox Onboard, rather than the Website) and for the following additional purposes and in accordance with the following lawful bases: 

Lawful BasisPurpose for using your personal data
Legal ObligationRecording your preferences (e.g. marketing) to ensure that we comply with data protection laws. 
Where we send you information to comply with a legal obligation (e.g. where we send you information about your legal rights). 
Where we retain information to enable us to bring or defend legal claims. 
Legitimate InterestsWhere using your information is necessary to pursue our legitimate business interests to:

improve and optimise HubBox OnBoard;
monitor and make improvements to HubBox OnBoard to enhance security and prevent fraud;
to provide our services to you and ensure the proper functioning of HubBox OnBoard; 
to protect our business and defend ourselves against legal claims;
to administer or perform our contract with the Retailer; and
to send you updates about the services you have accessed via HubBox OnBoard.

Where we use your information for our legitimate interests, we have assessed whether such use is necessary and that such use will not infringe on your other rights and freedoms. 
ConsentWhere you have provided your consent to providing us with information or allowing us to use or share your information whilst using HubBox OnBoard and accessing the services available on that platform.

Users of our Shopify App

If you are an employee or subcontractor of a Retailer, and you access and use our Shopify App, we collect and use your personal data for the purposes set out above, and for the following additional purposes and in accordance with the following lawful bases: 

Lawful BasisPurpose for using your personal data
Legal ObligationRecording your preferences (e.g. marketing) to ensure that we comply with data protection laws. 
Where we send you information to comply with a legal obligation (e.g. where we send you information about your legal rights). 
Where we retain information to enable us to bring or defend legal claims. 
Legitimate InterestsWhere using your information is necessary to pursue our legitimate business interests to:

improve and optimise our Shopify App;
monitor and make improvements to our Shopify App to enhance security and prevent fraud;
to provide our services to you and ensure the proper functioning of our Shopify App; to protect our business and defend ourselves against legal claims;
to administer or perform our contract with the Retailer; and
to send you updates about the services you have accessed via our Shopify App.

Where we use your information for our legitimate interests, we have assessed whether such use is necessary and that such use will not infringe on your other rights and freedoms. 
ConsentWhere you have provided your consent to providing us with information or allowing us to use or share your information whilst using our Shopify App and accessing the services available via the Shopify App store.

Users of Pickup Points

If, when shopping on a Retailer’s website, you select to collect your purchase from a Pickup Point, we collect and use your personal data for the following purposes and in accordance with the following lawful bases:

Lawful BasisPurpose for using your personal data
Legitimate InterestsWhere using your information is necessary to pursue our legitimate business interests but only if those interests are not outweighed by your other rights and freedoms (for example, your right to privacy) to:

provide the Pickup Point service to you;
improve and optimise our technology;
monitor and make improvements to our technology to enhance security and prevent fraud;
to provide our services to you and ensure the proper functioning of our services;to protect our business and defend ourselves against legal claims;
to administer or perform our contract with the Retailer; and
to send you updates about the services you have engaged us to provide.

Website Visitors, Staff of Retailers and Prospects, and Other Business Contacts

If you are a visitor to our Website, we collect and use your personal data for the following purposes and in accordance with the following lawful bases:

Lawful BasisPurpose for using your personal data
Legitimate InterestsWhere using your information is necessary to pursue our legitimate business interests, but only if those interests are not outweighed by your other rights and freedoms (for example, your right to privacy) to:

take steps to enter into and/or fulfil the terms of our contracts with customers or suppliers (where you are engaged by or otherwise involved with one of our customers or suppliers);
respond to communications from you or someone else in your organisation;
improve and optimise our Website;monitor and make improvements to our Website to enhance security and prevent fraud;
ensure the proper functioning of our Website;
protect our business and defend ourselves against legal claims; and
send you updates about the services you have accessed via our Website.
Legal ObligationRecording your preferences (e.g. marketing) to ensure that we comply with data protection laws. 
Where we send you information to comply with a legal obligation (e.g. where we send you information about your legal rights). 
Where we retain information to enable us to bring or defend legal claims. 
  1. When we contact you for sales or marketing purposes

In addition to the above uses, we may use your information to notify you about goods or services which may be of interest to you. You can opt out of receiving marketing information from us at any time. Just use the “unsubscribe” link in the relevant email, or let us know at privacy@hub-box.com.

Opting out of marketing will not affect our processing of your personal data in relation to any order you have with us and where we are required to use your personal data to fulfil that order or provide you with certain information. 

  1. Who we share your information with

We may share your personal data with:

If we were asked to provide personal data in response to a court order or legal request (e.g. from the police), we would seek legal advice before disclosing any information and carefully consider the impact on your rights when providing a response. 

Other than as set out above and save insofar as is necessary in order for us to carry out our obligations arising from any contracts entered into between you and us, we will not share your data with third parties unless we have procured your express consent to do so.

  1. Where your information is located or transferred to

We store information (including your personal data) in servers located in the UK/Ireland for users based in the EEA, and in the USA for users based in the USA. If you have an account with HubBox OnBoard your username will be stored in the USA and UK/Ireland or EEA irrespective of where you are located. We have valid legal mechanisms in place in respect of transfers out of the relevant country to ensure compliance with relevant data protection laws.

  1. How we keep your information safe

We have put in place appropriate security and safety measures to prevent your personal data from being lost or illegally accessed by those who do not have permission. These measures include:

In the event that there is an event or incident affecting your personal data, we will keep you informed. We may also need to notify the regulator (where required under data protection law) and if we make decisions about personal data about your data jointly with another party (for example, if a third party marketing provider), we may need to notify them. 

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our Website, HubBox OnBoard or our Shopify App. Any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

  1. How long we keep your information

Where we are responsible for making decisions about how to collect and use your personal data, we will only keep your personal data for as long as necessary to fulfil the purposes we collected it for or as long as required to fulfil our legal obligations. 

When we consider how long to keep your personal data, we will consider whether it is still necessary to keep it for the purpose we collected it for, or whether the same purpose could be achieved by holding less personal data. We will also consider the volume, nature, and sensitivity of the personal data and the potential harm to you if there was an incident affecting your personal data.

We may keep Identity Data, Contact Data and certain other data (specifically, any exchanges between us by email or any other means) for up to seven years after the end of our contractual relationship with you. 

If you browse our Website, we keep personal data collected through our analytics tools for only as long as necessary to fulfil the purposes we collected it for, (see our Cookie Policy at paragraph 10 below for further information). 

If you access and use HubBox OnBoard or our Shopify App, we keep personal data collected through our analytics tools, as well as your account details for only as long as necessary to fulfil the purposes we collected it for.

If you communicate with us, for example asking for information from us, we keep your details until you ask us to stop contacting you.

  1. Your legal rights

You have specific legal rights in relation to your personal data. 

It is usually free for you to exercise your rights and we aim to respond within one month of any request, (although we may ask you if we can extend this deadline up to a maximum of two months if your request is particularly complex or we receive multiple requests at once). 

We can decide not to take any action in relation to a request where we have been unable to confirm your identity (this is one of our security processes to make sure we keep information safe) or if we feel the request is unfounded or excessive. We may charge a fee where we decide to proceed with a request that we believe is unfounded or excessive. If this happens, we will always inform you in writing. 

Your legal rights are as follows:


Access: You must be told if your personal data is being used and you can ask for a copy of your personal data as well as information about how we are using it to make sure we are abiding by the law.
Correction: You can ask us to correct your personal data if it is inaccurate or incomplete. We might need to verify the new information before we make any changes.
Deletion: You can ask us to delete or remove your personal data if there is no good reason for us to continue holding it or if you have asked us to stop using it. If we think there is a good reason to keep the information you have asked us to delete (e.g. to comply with regulatory requirements), we will let you know and explain our decision.
Restriction: You can ask us to restrict and/or temporarily limit how we use your personal data (e.g. whilst you check that the personal data we hold for you is correct).
Objection: You can object to us using your personal data if you want us to stop using it. We always comply with your request if you ask us to stop sending you marketing communications but in other cases, we decide whether we will continue. If we think there is a good reason for us to keep using the information, we will let you know and explain our decision.

Portability: You can ask us to send you or another organisation an electronic copy of your personal data.
Complaints: If you are unhappy with the way we collect and use your personal data, you can complain to the Information Commissioner or another relevant supervisory body, but we hope that we can respond to your concerns before it reaches that stage. Please contact us at privacy@hub-box.com.

For further information on each of these rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

If you would like to exercise any of your legal rights, please contact: privacy@hub-box.com and provide the following information:

  1. Our Cookie Policy 

Our Website and HubBox OnBoard use cookies and similar technologies.

Cookies are small text files that are downloaded to your device. Cookies contain uniquely generated references which are used to distinguish you from other users. They allow information gathered on one webpage to be stored until it is needed for use on another, allowing our Website and HubBox OnBoard to provide you with a personalised experience (like remembering your favourites or your account details) and provide us with statistics about how you interact with our Website and HubBox OnBoard.

Cookies are not harmful to your devices (like a virus or malicious code) but some individuals prefer not to share their information (for example, to avoid targeted advertising).

What is Cookie Control?

You may notice that our Website utilises a third party Cookie preference tool called ‘Cookie Control’. Cookie Control is a mechanism for controlling user consent and the use of cookies on this website application.

When (as the user) you consent to one of the optional cookie categories, Cookie Control will place a cookie to remember that decision. The name of the cookie will be the name of the category specified within the Cookie Control widget itself. That cookie will be removed when you (the user) revokes consent to that category.

Different types of cookies

What do we use cookies for?

We use cookies to:

The cookies we use on our Website are:

Cookies set by WordPress

Cookie NameDescriptionDuration
wordpress_<hash> **On login, wordpress uses the wordpress_[hash] cookie to store your authentication details. Its use is limited to the admin console area, /wp-admin/2 years
wordpress_logged_in_<hash>  **After login, wordpress sets the wordpress_logged_in_<hash> cookie, which indicates when you’re logged in, and who you are, for most interface use.Session
wp-settings-<time>-<UID>  **WordPress also sets a few wp-settings-<time>-<UID> cookies. The number on the end is your individual user ID from the users database table. This is used to customize your view of admin interface, and possibly also the main site interface.Session
WordPress_google_apps_login **This cookie is set by the plugin ‘Google Apps Login for WordPress’ and may be present for users who login to WordPress via their Google or GSuite account.Session
wordpress_test_cookieUsed to check whether your web browser is set to allow, or reject cookies.Session
wpe-auth

Cookies set by Google Analytics

Cookie NameDescriptionDuration
_gaUsed to distinguish users.2 years
_gidUsed to distinguish users.24 hours
_gatUsed to throttle request rate. If Google Analytics is deployed via Google Tag Manager, this cookie will be named _dc_gtm_<property-id>.1 minute
AMP_TOKENContains a token that can be used to retrieve a Client ID from AMP Client ID service. Other possible values indicate opt-out, inflight request or an error retrieving a Client ID from AMP Client ID service.30 seconds to 1 year
_gac_<property-id>Contains campaign related information for the user. If you have linked your Google Analytics and AdWords accounts, AdWords website conversion tags will read this cookie unless you opt-out. Learn more.90 days
_gaexpOptimize 360 – Used to determine a user’s inclusion in an experiment and the expiry of experiments a user has been included in.90 days

Cookies set by CloudFlare

Cookie NameDescriptionDuration
__cfduid **The __cfduid cookie is used to identify individual clients behind a shared IP address and apply security settings on a per-client basis.1 years

Cookies set by Hotjar

Cookie NameDescriptionDuration
_hjClosedSurveyInvitesHotjar cookie. This cookie is set once a visitor interacts with a Survey invitation modal popup. It is used to ensure that the same invite does not reappear if it has already been shown.365 days
_hjDonePollsHotjar cookie. This cookie is set once a visitor completes a poll using the Feedback Poll widget. It is used to ensure that the same poll does not reappear if it has already been filled in.365 days
_hjMinimizedPollsHotjar cookie. This cookie is set once a visitor minimizes a Feedback Poll widget. It is used to ensure that the widget stays minimizes when the visitor navigates through your site.365 days
_hjDoneTestersWidgetsHotjar cookie. This cookie is set once a visitor submits their information in the Recruit User Testers widget. It is used to ensure that the same form does not re-appear if it has already been filled in.365 days
_hjMinimizedTestersWidgetsHotjar cookie. This cookie is set once a visitor minimizes a Recruit User Testers widget. It is used to ensure that the widget stays minimizes when the visitor navigates through your site.365 days
_hjIncludedInSampleHotjar cookie. This session cookie is set to let Hotjar know whether that visitor is included in the sample which is used to generate funnels.365 days
_hjShownFeedbackMessageThis cookie is set when a visitor minimizes or completes Incoming Feedback. This is done so that the Incoming Feedback will load as minimized immediately if they navigate to another page where it is set to show.365 days
_hjidHotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.365 days

Cookies set by Optimizely

Cookie NameDescriptionDuration
optimizelyBucketsRecords the Optimizely Classic variation that the visitor has seen for each experiment.  This allows us to deliver a consistent experience on successive page loads.6 months
optimizelyEndUserIdStores a visitor’s unique Optimizely identifier, for both Optimizely Classic and Optimizely X Web. It’s a combination of a timestamp and random number. No other information about you or your visitors is stored inside.6 months
optimizelyPendingLogEventsUsed as a cache for a visitor’s actions between tracking calls. This ensures that all events are efficiently tracked even if a visitor takes many actions in rapid succession. The cookie is wiped once the tracking call has been made.15 seconds
optimizelyRedirectAfter Optimizely Classic has executed a redirect experiment, stores the variation ID of the redirect experiment, so that Optimizely can pass it into integrated technology platforms along with the variation IDs that are active on the new page. This is necessary because the redirect experiment is usually inactive on the new page.5 seconds
optimizelyReferrerAfter Optimizely Classic has executed a redirect experiment, stores the document.referrer property from the original page, so that Optimizely can pass it into integrated technology platforms. This is how we avoid creating “self-referrals” in your third-party analytics.5 seconds
optimizelySegmentsPersists the visitor’s Optimizely Classic segments: browser, campaign, mobile, source type, and any custom dimensions that you may have configured. This allows us to ensure persistence of segment membership, which improves the accuracy of segmented results.6 months

Cookies set by Hubspot

Cookie NameDescriptionDuration
_hs_opt_outThis cookie is used by the opt-in privacy policy to remember not to ask the user to accept cookies again. This cookie is set when you give users the choice to opt out of cookies. 2 years
__hs_do_not_trackThis cookie can be set to prevent the tracking code from sending any information to HubSpot. Setting this cookie is different from opting out of cookies, which still allows anonymized information to be sent to HubSpot.2 years
__hs_testcookieThis cookie is used to test whether the visitor has support for cookies enabled. Session cookie
hs_ab_testThis cookie is used to consistently serve visitors the same version of an A/B test page that they’ve seen before.Session cookie
hs_lang_switcher_choice
This cookie is used to consistently redirect visitors to the language version of a page in the language they’ve selected on this top-level private domain in the past (if such a language version exists).
<id>_keyWhen visiting a password-protected page, this cookie is set so future visits to the page from the same browser do not require login. The cookie name is unique for each password-protected page.   
Hs-messages-is-openhs-messages-hide-welcome-messageThis cookie is used on the visitor UI side so HubSpot can determine/save whether the chat widget is open for future visits. It resets after 30 minutes to re-close the widget after 30 minutes of inactivity(TTL 30 minutes)
__hstcThe main cookie for tracking visitors. It contains the domain, utk (see below), initial timestamp (first visit), last timestamp (last visit), current timestamp (this visit), and session number (increments for each subsequent session).2 years
hubspotutkThis cookie is used for to keep track of a visitor’s identity. This cookie is passed to HubSpot on form submission and used when de-duplicating contacts.10 years
__hsscThis cookie keeps track of sessions. This is used to determine if we should increment the session number and timestamps in the __hstc cookie. It contains the domain, viewCount (increments each pageView in a session), and session start timestamp. 30 min
__hssrcWhenever HubSpot changes the session cookie, this cookie is also set. We set it to 1 and use it to determine if the user has restarted their browser. If this cookie does not exist when we manage cookies, we assume it is a new session.None. Session cookie
messagesUtkThis cookie is used to recognize visitors who chat with you via the messages tool. If the visitor leaves your site before they’re added as a contact, they will have this cookie associated with their browser. If you have a history of chatting with a visitor and they return to your site later in the same cookied browser, the messages tool will load your conversation history with that visitor.

Miscellaneous Cookies

Cookie NameDescriptionDuration
complianceCookieUsed to distinguish your acknowledgement of our website’s Cookie Banner and subsequent policy (this document).14 days

The cookies we use on HubBox OnBoard are:

Cookie Purpose What it does How long it lasts 
wordpress_logged_in_*Necessary CookieWhen the user is logged in and the * is a unique hash of the session. Example wordpress_logged_in_6b61d7620cf132ef3a2485e3ded9543fExpires when the browser session ends
wordpress_sec_*Necessary CookieSecurity check and validation for each connected user. Again, the * is a different hash each time.Expires when the browser session ends
wp_loginasuser_backurl_*Functional CookieUsed to remember the prev url the user was on.
wp_loginasuser_olduser_*Functional CookieUsed to check if the user logged in as another user before logging into the system. Again for security purposes.

We can only use cookies with your permission (you will be prompted by a message when you first visit our Website or HubBox OnBoard, also known as a cookie banner, where you can choose to accept or decline our cookies). 

You can update your cookie settings on our Website by visiting the cookie preferences page.

You can choose to decline cookies but if you turn off necessary cookies, some pages and functions on our Website or HubBox OnBoard may not work properly. You can also manage cookies through your browser settings or device settings (your user manual should contain additional information).

You can also delete cookies directly with the relevant third parties (for example, you can disable Google Analytics on their website).

Thank you for taking the time to read our Privacy Policy.

Convenient Collect Ltd T/A HubBox

This Policy was last updated on 14 December 2023.