HubBox Data Protection Agreement
2. Data Protection
2.1 This Agreement shall apply only to the extent to which Personal Data (as defined in the GDPR) controlled by the Retailer is processed by HubBox for the purpose of providing the Service.
2.2 The parties acknowledge and agree that in respect of any Personal Data collected for the purpose of the Service, that each of HubBox and the Retailer will be acting as a separate controller for the purposes of the GDPR. Each party shall comply with its obligations under the GDPR, all applicable laws, enactments, regulations, orders, standards and other similar instruments.
2.3 HubBox shall process the Personal Data only to the extent, and in such a manner, as is necessary to perform its obligations under the Terms (the Permitted Purpose), except where otherwise required by any applicable law, and shall not process the Personal Data for any other purpose not set out in the Terms.
2.4 HubBox shall not perform its obligations under the Terms in such a way that causes (or is likely to cause) the Retailer to breach any of its obligations under the GDPR.
2.5 HubBox shall promptly comply with any request received from the Retailer requiring HubBox to amend, transfer or delete Personal Data.
2.6 HubBox shall not transfer Personal Data outside of the European Economic Area and/or the United Kingdom unless (i) it has first obtained the Retailer’s prior written consent; and (ii) it takes such measures as are necessary to ensure the transfer is in compliance with the GDPR.
2.7 HubBox shall provide reasonable and timely assistance to the Retailer to enable the Retailer to respond to: (i) any request from a Data Subject (as defined in the GDPR) to exercise any of its rights under the GDPR (including its rights of access, correction, objection, erasure, as applicable); and (ii) any other correspondence, enquiry or complaint received from a Data Subject, regulator or other third party in connection with the processing of the Personal Data or to either party’s compliance with the GDPR. In the event that any such request, correspondence, enquiry or complaint is made directly to HubBox, HubBox shall promptly inform the Retailer providing full details of the same.
2.8 At the Retailer’s request, HubBox shall provide the Retailer with a copy of all Personal Data relating to the Retailer’s Customers held by HubBox in a format and on a media reasonably specified by the Retailer.
2.9 Upon termination or expiry of the Terms, HubBox shall, if requested by the Retailer, destroy or return to the Retailer all Personal Data relating to the Retailer (including all copies of Personal Data) in HubBox’s possession or control (including Personal Data subcontracted to a third party for processing), save in a situation where a Customer has independently registered with HubBox, in which case HubBox shall be entitled to retain the Personal Data relating to that Customer. This requirement shall not apply to the extent that HubBox is required by any EU (or any EU Member State) law to retain some or all of the Personal Data, in which event HubBox shall isolate and protect the Personal Data from any further processing except to the extent required by such law.
2.10 HubBox shall ensure that access to the Personal Data is limited to:
(a) those employees, agents and subcontractors who need access to the Personal Data to meet HubBox’s obligations under the Terms; and
(b) in the case of any access by any employee, agent or subcontractor, such part or parts of the Personal Data as is strictly necessary for performance of that person’s duties.
2.11 Subject to Clause 2.1, HubBox shall ensure that any person that it authorises to process the Personal Data (including HubBox’s employees, agents and subcontractors):
(a) shall be subject to a strict duty of confidentiality (whether a contractual duty or a statutory duty); and
(b) processes the Personal Data only as necessary for the Permitted Purpose.
2.12 HubBox shall take reasonable steps to ensure the reliability of any of HubBox’s employees, agents or subcontractors who have access to the Personal Data.
2.13 The Retailer is entitled, on giving at least 20 Business Days’ notice to HubBox, to inspect or appoint representatives to inspect all facilities, equipment, documents and electronic data relating to the processing of Personal Data by HubBox. HubBox acknowledges that the Retailer (or its appointed representatives) may enter its premises for the purposes of conducting this inspection, providing that the Retailer gives notice in accordance with this Clause 2.13, conducts its inspection during Working Hours, and takes all reasonable measures to prevent unnecessary disruption to HubBox’s operations.
2.14 The Retailer will not exercise its inspection rights under Clause 2.13 more than once in any 12 calendar month period, except if and when required by instruction of a competent data protection authority.
2.15 Subject to Clause 2.1 HubBox warrants that it shall implement appropriate technical and organisational measures to protect the Personal Data (i) from accidental or unlawful destruction, and (ii) loss, alteration, unauthorised disclosure of, or access to Personal Data (a Security Incident). HubBox shall promptly inform the Retailer in the event of any Security Incident and will provide timely information and cooperation to the Retailer in order for the Retailer to fulfil its data breach reporting obligations under (and in accordance with the timescales required by) the GDPR.
HubBox may, in certain circumstances, be required under the GDPR to share Personal Data with other agencies (including governmental agencies) without the Customer’s consent. In such circumstances HubBox will share no more information than is legally required.
4. HubBox's Liability
HubBox’s liability is limited to the extent set out in the Terms.
5. Term and Termination
This Agreement shall be coterminous with the Terms save that HubBox’s obligations to protect and, if requested, delete Personal Data shall continue for as long as Retailer Customers’ Personal Data is processed by HubBox.
6.2 Notice under this Clause 6 must be given to the Retailer in accordance with the notice provisions in the Terms.
7. Applicable law
7.2 The Courts of England and Wales shall have exclusive jurisdiction in relation to any matters arising out of this Agreement.
8. Third parties
A person who is not a party to this Agreement shall have no right to enforce any of its provisions under the Contracts (Rights of Third Parties) Act 1999.
HubBox does not give up its rights by delaying or failing to exercise them at any time.
If any provisions of this Agreement are found by a court to be illegal or not enforceable, all other provisions will still be in effect.
means a day other than a Saturday, Sunday or bank or public holiday in England and Wales
Controller, Processor, Data Subject, Personal Data and Processing (and Process)
shall have the meanings given in the GDPR
means a natural person purchasing goods from the Retailer’s website
means Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), as amended, replaced or updated
means Convenient Collect Limited (Company No. 9271441) t/a HubBox whose registered office is at Unit 3, 6 Morie Street, London SW18 1SL, and includes HubBox’s servants, agents
HubBox Collect Point
means a dry cleaner, pharmacy, convenience store or other entity designated as a Collect Point by HubBox
means the entity contracting with HubBox for provision of the Service as detailed in the Terms
means the agreement between HubBox and the Retailer for the provision of the Service
means 9am to 6pm on Business Days