Privacy Policy

Who should read this policy:

Everyone who accesses and uses the HubBox developer portal (Console) or downloads our Shopify App including the staff and sub-contractors of our existing clients (Retailers) (in particular, the individuals who integrate our software and services into Retailers’ websites)

Everyone who accesses and uses our website (our Website)

Other business contacts, such as staff of our Retailers, the carriers with whom we have an agreement (Carriers), and prospective Retailers and Carriers, and the suppliers and service providers to our business

Individuals that apply for a job at HubBox(collectively, you / your).

What is covered: This policy sets out what information we collect about you, what we use it for and who we share it with. It also explains your rights and what to do if you have any concerns about your personal data.

Who to contact about this notice: If you have any questions about this privacy policy, how we handle your personal data or you are looking to exercise one of your rights, please contact: privacy@hub-box.com.

Latest updates: We try to review this policy regularly. This policy was last updated in March 2026. We may sometimes need to update this policy to reflect changes to the way we provide our services or to comply with updates to data protection law. Where possible, we will notify you of any substantive changes but please check back regularly to see whether any changes have occurred.

Who regulates HubBox’s data protection compliance: The Information Commissioner’s Office (ICO) is the UK regulator and is responsible for checking that businesses comply with UK Data Protection Law.

1. About us

We are Convenient Collect Limited t/a HubBox, registered in England and Wales with company number 09271441 whose registered address is 50 Liverpool Street, London, England, EC2M 7PY (we / us /our).

If you access our Website or Console, or download our Shopify App, or apply for a job at HubBox (usually via our applicant tracking system, HiBob) we are the controller of your information (which means we decide what information we collect and how it is used). We are registered with the ICO under number ZA423502.

If you have any questions about this privacy notice or the way that we use information, please get in touch using the following details:

Email address: privacy@hub-box.com

Postal address: 50 Liverpool Street, London, England, EC2M 7PY

2. Information we collect about you

Personal data means any information which does (or could be used to) identify a living person. We have grouped together the types of personal data that we collect, where we receive it from, and when we receive it, in the table below.

Generally, we process personal data that relates to you when:

• you visit our Website
- • you create a Console account in order to access Console to integrate our software on behalf of a
- • Retailer (as an employee or subcontractor of that Retailer);
• you download our Shopify App;
• we have an existing or prospective contractual relationship with you or an organisation that you are involved with (e.g. where you work for one of our clients or suppliers); or
• you apply for a job at HubBox via HiBob.

Lawful Types of Personal Data	The who, where & when
Identity Data – your first and last name or title.	• You – when you create a Console account or download our Shopify App or fill in the contact form on our Website. • An organisation that you work for – where we collect and process your personal data in connection with a contract with that business. • Other organisations with which we do business (e.g. Carriers). • Publicly available sources – where we collect and process your personal data for marketing. • You – when you apply for a job at HubBox via HiBob.
Contact Data – your email address, telephone numbers, home address.	• You – as above. • An organisation that you work for – as above. • Other organisations with which we do business (e.g. Carriers). • Publicly available sources – as above.
Location Data – your device location if you use our Website or log into Console remotely.	• You – when you log into Console or download our Shopify App. • Via cookies and other similar technologies – as above.
Feedback – information and responses you provide for market research purposes.	• You – when we ask you to complete surveys and questionnaires.
Account Data – email address, password, username, chat logs, support requests, audit trail of systems used and documents accessed and downloaded whilst using Console.	• You – when you create a Console account and use the services via Console. • Via cookies and other similar technologies – as above.
Sales and Marketing Data – includes your preferences in receiving marketing from us and our third parties.	• Other organisations with which we do business (e.g. Carriers) • Publicly available sources • You – when you subscribe to our mailing list from our Website.
Recruitment Data – copies of right to work documents, interview notes, information you provided in your CV or cover letter as part of the application process, result of due diligence checks.	• You – when you apply for a job at HubBox via HiBob. • You – when you provide additional information during the recruitment process • Other organisations with whom we carry out background checks, or from whom we obtain a reference – in each case with your consent • Publicly available sources
Employment and Qualification Data – current and/or previous job titles, work history, working hours, training records, professional memberships.	• You – when you apply for a job at HubBox as above • Other organisations in relation to a job application – as above • Publicly available sources
Photo and Image Data – profile picture, images, videos and audio (e.g. video calls)	• You – when you apply for a job at HubBox as above • Publicly available sources • Recordings taken with your permission
Sensitive Data – information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, sex life or sexual orientation, trade union membership and/or information about criminal convictions and offences	• You – when you apply for a job at HubBox and provide this information as part of our diversity monitoring • Other organisations with whom we carry out background checks, or from whom we obtain a reference – in each case with your consent
Technical Data – internet protocol (IP) address, browser type and version, time zone setting and generic location, browser plug-in types and versions, operating system and platform on the devices you use to access our Website and/or Console.	• Via cookies and other similar technologies – when you access or use our Website, Console or our Shopify App.
Usage Data – information about how you use our Website and/or Console and the resources you access.	• Via cookies and other similar technologies – as above.

Keeping your personal data up to date

If your personal details change you may update them by updating your account information in Console or your Shopify account, in which case the update will take effect immediately, or by contacting us using the contact details below, in which case we will endeavour to update your personal data within seven working days of any new or updated personal data being provided to us.

Contact Form

The primary instance where our Website will ask you for personally identifiable information is our contact form. Upon completing your information, you will be asked to consent to our data processing policy which is outlined within this document.

Once submitted, your information will be processed and forwarded to us within a single email sent by the Website application. Your information will not be stored within the Website application’s database.

If you provide us with your mobile phone/cell number when filling out our contact form, you agree that we may send you text messages at varying frequencies. You will be able to opt-out at any time by replying “STOP”. No information will be shared with third parties/affiliates for marketing/promotional purposes.

Hotjar

We use Hotjar in order to better understand our users’ needs and to optimise this service and experience. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies (listed later in this policy) and other technologies to collect data on our users’ behaviour and their devices (in particular device’s IP address (captured and stored only in anonymized form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our Website).

Hotjar stores this information in a pseudonymized user profile. Neither Hotjar nor we will ever use this information to identify individual users or to match it with further data on an individual user. For further details, please see Hotjar’s privacy policy.

You can opt-out to the creation of a user profile, Hotjar’s storing of data about your usage of our site and Hotjar’s use of tracking cookies on other websites by following this opt-out link.

HubSpot

Our Website uses HubSpot – an inbound marketing and sales platform to customise content to visitors and adapt how we communicate with them.

HubSpot uses cookies (see below) and pixel tags to analyse your use of our Website. This anonymous information is transferred to and stored in a HubSpot server in the USA. You can learn more about HubSpot’s privacy practices by reading their privacy policy.

3. How we use your information

Under UK data protection law, we need a legal reason (known as a lawful basis) for holding, collecting and using your personal data. There are 6 main legal reasons which organisations can rely on. The most relevant are:

to pursue our legitimate interests (our justifiable business aims) but only if those interests are not outweighed by your other rights and freedoms (e.g. your right to privacy);
to perform a contract that we have entered into with you;
to comply with a legal obligation that we have; and
where you have consented to us using your personal data in a certain way.

Please note that, where we need to collect your personal data to perform a contract either with you or with a Retailer, failure to provide us with your personal data may mean that we are not able to provide you or the Retailer with our services. Where we do not have the information required about you, we may have to suspend or cancel the service ordered.

Users of HubBox Console

If you are an employee or subcontractor of a Retailer, and you access and use Console, we collect and use your personal data for the purposes set out above (in connection with Console, rather than the Website) and for the following additional purposes and in accordance with the following lawful bases:

Lawful Basis	Purpose for using your personal data
Legal Obligation	• Recording your preferences (e.g. marketing) to ensure that we comply with data protection laws. • Where we send you information to comply with a legal obligation (e.g. where we send you information about your legal rights). • Where we retain information to enable us to bring or defend legal claims.
Legitimate Interests	Where using your information is necessary to pursue our legitimate business interests to: • improve and optimise Console; • monitor and make improvements to Console to enhance security and prevent fraud; • to provide our services to you and ensure the proper functioning of Console; • to protect our business and defend ourselves against legal claims; • to administer or perform our contract with the Retailer; and • to send you updates about the services you have accessed via Console. Where we use your information for our legitimate interests, we have assessed whether such use is necessary and that such use will not infringe on your other rights and freedoms.
Consent	Where you have provided your consent to providing us with information or allowing us to use or share your information whilst using Console and accessing the services available on that platform.

Users of our Shopify App

If you are an employee or subcontractor of a Retailer, and you access and use our Shopify App, we collect and use your personal data for the purposes set out above, and for the following additional purposes and in accordance with the following lawful bases:

Lawful Basis	Purpose for using your personal data
Legal Obligation	• Recording your preferences (e.g. marketing) to ensure that we comply with data protection laws. • Where we send you information to comply with a legal obligation (e.g. where we send you information about your legal rights). • Where we retain information to enable us to bring or defend legal claims.
Legitimate Interests	Where using your information is necessary to pursue our legitimate business interests to: • improve and optimise our Shopify App; • monitor and make improvements to our Shopify App to enhance security and prevent fraud; • to provide our services to you and ensure the proper functioning of our Shopify App; • to protect our business and defend ourselves against legal claims; • to administer or perform our contract with the Retailer; and • to send you updates about the services you have accessed via our Shopify App. Where we use your information for our legitimate interests, we have assessed whether such use is necessary and that such use will not infringe on your other rights and freedoms.
Consent	Where you have provided your consent to providing us with information or allowing us to use or share your information whilst using our Shopify App and accessing the services available via the Shopify App store.

Website Visitors, Staff of Couriers, Retailers and Prospects, and Other Business Contacts

If you are a visitor to our Website, a member of staff of one of our Carriers, Retailers or prospects, or another business contact, we collect and use your personal data for the following purposes and in accordance with the following lawful bases:

Lawful Basis	Purpose for using your personal data
Legitimate Interests	Where using your information is necessary to pursue our legitimate business interests, but only if those interests are not outweighed by your other rights and freedoms (for example, your right to privacy) to: • take steps to enter into and/or fulfil the terms of our contracts with carriers, clients or suppliers (where you are engaged by or otherwise involved with one of our clients or suppliers); • respond to communications from you or someone else in your organisation; • improve and optimise our Website; • monitor and make improvements to our Website to enhance security and prevent fraud; • ensure the proper functioning of our Website; protect our business and defend ourselves against legal claims; and • send you updates about the services you have accessed via our Website.
Legal Obligation	• Recording your preferences (e.g. marketing) to ensure that we comply with data protection laws. • Where we send you information to comply with a legal obligation (e.g. where we send you information about your legal rights). • Where we retain information to enable us to bring or defend legal claims.

Staff of Carriers, Retailers and Prospects, with whom we communicate via SMS
We occasionally communicate with staff of our Carrier partners, Retailer clients or prospects using SMS text messages – the frequency of such messages varies. These messages are sent in connection with the performance of our obligations under the agreement with the relevant Carrier partner, retailer client or prospect and our lawful basis for processing is Legitimate Interest. The individual may text HELP for further information about this SMS service or STOP to stop receiving such messages from us. Any messages sent by the individual in response to our SMS messages may incur a charge at such individual’s usual rates.

Individuals that apply for a job at HubBox via HiBob
If you apply for a job at HubBox via HiBob, we collect and use your personal data for the following purposes and in accordance with the following lawful bases:

Lawful Basis	Purpose for using your personal data
Legitimate Interests	• To review your CV information, and any information you provide during your interview to ascertain your suitability for the role you have applied for. • To communicate with you and with any other relevant party (e.g. a recruitment consultant) in connection with your application. • To deal with any disputes that arise.
Legal Obligation	• Complying with our legal obligations as your potential employer when carrying out background checks and our recruitment process. For example: – Checking you are legally entitled to work in the UK; – Ascertaining your fitness to work; – Complying with our health and safety obligations; and – Making any required reasonable adjustments.

4. When we contact you for sales or marketing purposes

In addition to the above uses, we may use your information to notify you about goods or services which may be of interest to you or an organisation that you work for. You can opt out of receiving marketing information from us at any time. Just use the “unsubscribe” link in the relevant email, or let us know at privacy@hub-box.com.

Opting out of marketing will not affect our processing of your personal data in relation to contractual discussions and/or services we are providing to, or receiving from, you or an organisation that you work for. We may continue to contact you as necessary to conclude the contract or provide or receive the applicable services.

5. Who we share your information with

We may share your personal data with:

• Our personnel: our employees, (or other types of workers) who have contracts containing confidentiality and data protection obligations in order to provide you with our services.
• Our supply chain: other organisations that help us provide our services, (such as suppliers and subcontractors). We ensure these organisations only have access to the information required to provide the support we use them for and have a contract with them that contains confidentiality and data protection obligations.
• Our website hosting provider: the company who provides website and platform hosting services to us may have access to some information, (e.g. information from cookies and tracking technologies) to ensure that our Website and Console are working correctly.
• Our cloud service provider: we use Amazon Web Services (AWS) to store information about our clients and the users of Console and which enables us to deal with enquiries and provide our services.
Regulatory authorities: such as HM Revenue & Customs.
• Our professional advisers: such as our accountants or legal advisors where we require specialist advice to help us conduct our business.
• Third party marketing providers: such as Campaign Monitor for some of our sales and marketing communications.
• Your referees and/or recruitment consultants: only in connection with any application for employment at HubBox
• Any actual or potential buyer of our business.

If we were asked to provide personal data in response to a court order or legal request (e.g. from the police), we would seek legal advice before disclosing any information and carefully consider the impact on your rights when providing a response.

Other than as set out above and save insofar as is necessary in order for us to carry out our obligations arising from any contracts entered into between you and us, we will not share your data with third parties unless we have procured your express consent to do so.

6. Where your information is located or transferred to

We store information (including your personal data) in AWS servers located in various global locations. HubBox has a data processing agreement with AWS that ensures valid legal mechanisms are in place in respect of transfers out of the relevant country to ensure compliance with relevant data protection laws.

7. How we keep your information safe

We have put in place appropriate security and safety measures to prevent your personal data from being lost or illegally accessed by those who do not have permission. These measures include:

• access controls and user authentication (including multi-factor authentication);
• internal IT and network security;
• regular testing and review of our security measures;
• staff policies and training;
• incident and breach reporting processes; and
• business continuity and disaster recovery processes.

For more information, see the HubBox Trust Centre.

In the event that there is an event or incident affecting your personal data, we will keep you informed. We may also need to notify the regulator (where required under data protection law) and if we make decisions about personal data about your data jointly with another party (for example, if a third party marketing provider), we may need to notify them.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our Website, Console, our Shopify App, or HiBob. Any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

8 . How long we keep your information

Where we are responsible for making decisions about how to collect and use your personal data, we will only keep your personal data for as long as necessary to fulfil the purposes we collected it for or as long as required to fulfil our legal obligations.

When we consider how long to keep your personal data, we will consider whether it is still necessary to keep it for the purpose we collected it for, or whether the same purpose could be achieved by holding less personal data. We will also consider the volume, nature, and sensitivity of the personal data and the potential harm to you if there was an incident affecting your personal data.

We may keep Identity Data, Contact Data and certain other data (specifically, any exchanges between us by email or any other means) for up to seven years after the end of our contractual relationship with you.

If you browse our Website, we keep personal data collected through our analytics tools for only as long as necessary to fulfil the purposes we collected it for, (see our Cookie Policy at paragraph 10 below for further information).

If you access and use Console or our Shopify App, we keep personal data collected through our analytics tools, as well as your account details for only as long as necessary to fulfil the purposes we collected it for.

If you apply for a job at HubBox via HiBob, we will automatically delete your data after 120 days, unless you are a successful applicant, in which case how we deal with your personal data will be detailed in your employment contract and relevant HubBox employee policies.

If you communicate with us, for example asking for information from us, we keep your details until you ask us to stop contacting you.

9. Your legal rights

You have specific legal rights in relation to your personal data.

It is usually free for you to exercise your rights and we aim to respond within one month of any request, (although we may ask you if we can extend this deadline up to a maximum of two months if your request is particularly complex or we receive multiple requests at once).

We can decide not to take any action in relation to a request where we have been unable to confirm your identity (this is one of our security processes to make sure we keep information safe) or if we feel the request is unfounded or excessive. We may charge a fee where we decide to proceed with a request that we believe is unfounded or excessive. If this happens, we will always inform you in writing.

Access: You must be told if your personal data is being used and you can ask for a copy of your personal data as well as information about how we are using it to make sure we are abiding by the law.

Correction: You can ask us to correct your personal data if it is inaccurate or incomplete. We might need to verify the new information before we make any changes.

Deletion: You can ask us to delete or remove your personal data if there is no good reason for us to continue holding it or if you have asked us to stop using it. If we think there is a good reason to keep the information you have asked us to delete (e.g. to comply with regulatory requirements), we will let you know and explain our decision.

Restriction: You can ask us to restrict and/or temporarily limit how we use your personal data (e.g. whilst you check that the personal data we hold for you is correct).

Objection: You can object to us using your personal data if you want us to stop using it. We always comply with your request if you ask us to stop sending you marketing communications but in other cases, we decide whether we will continue. If we think there is a good reason for us to keep using the information, we will let you know and explain our decision.

Portability: You can ask us to send you or another organisation an electronic copy of your personal data.

Complaints: If you are unhappy with the way we collect and use your personal data, you can complain to the Information Commissioner or another relevant supervisory body, but we hope that we can respond to your concerns before it reaches that stage. Please contact us at privacy@hub-box.com.

For further information on each of these rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

If you would like to exercise any of your legal rights, please contact: privacy@hub-box.com and provide the following information:

• Identification (e.g. your name, account username or email address)
• Details of the information to which your request relates (including any account or reference numbers, if you have them)

10. Our Cookie Policy

Our Website and Console use cookies and similar technologies.

Cookies are small text files that are downloaded to your device. Cookies contain uniquely generated references which are used to distinguish you from other users. They allow information gathered on one webpage to be stored until it is needed for use on another, allowing our Website and Console to provide you with a personalised experience (like remembering your favourites or your account details) and provide us with statistics about how you interact with our Website and Console.

Cookies are not harmful to your devices (like a virus or malicious code) but some individuals prefer not to share their information (for example, to avoid targeted advertising).

What is Cookie Consent Management?

You may notice that our Website and Console utilise a third party Cookie preference tool called ‘CookieHub Consent Management’. This is a mechanism for controlling user consent and the use of cookies on our Website and Console application.

When (as the user) you consent to one of the optional cookie categories, CookieHub will place a cookie to remember that decision. The name of the cookie will be the name of the category specified within the CookieHub widget itself. That cookie will be removed when you (the user) revoke consent to that category.

Different types of cookiesDifferent types of cookies

• Session vs. persistent cookies: cookies have a limited lifespan. Cookies which only last a short time or end when you close your browser are called session cookies. Cookies which remain on your device for longer are called persistent cookies (these are the type of cookies that allow websites to remember your details when you log back onto them).

• First party vs third party cookies: cookies placed on your device by the website owner are called first party cookies. When the website owner uses other businesses’ technology to help them manage and monitor their website, the cookies added by the other business are called third party cookies.

• Categories of cookies: cookies can be grouped by what they help the website or website owner do (the Purpose) as follows:

– Necessary cookies are cookies which help a website to run properly (when they are strictly necessary cookies it means their only function is to help the website work).
- – Performance cookies help a website owner understand and analyse how website visitors use their website.
  - – Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics such as the number of visitors, bounce rate, etc.
    
    – Marketing cookies tailor online adverts to reflect the content you have previously browsed and help inform companies about your interests so they can show you relevant adverts.

What do we use cookies for?

We use cookies to:

• to track how visitors use our Website and Console;
• to record whether you have seen specific messages we display on our Website or Console;
• to keep you signed into our Website or Console; and
• where we post content and links to content, we use cookies to capture and analyse information such as number of views and shares.

The cookies we use on our Website are updated in the CookieHub widget, which can be accessed by clicking on the cog icon in the bottom left-hand corner of any page on our Website.

The cookies we use in Console are updated in the CookieHub widget, which can be accessed by clicking on the “Cookie Settings” link in the footer.

We can only use cookies with your permission (you will be prompted by a message when you first visit our Website or Console, also known as a cookie banner, where you can choose to accept or decline our cookies).

You can update your cookie settings on our Website by clicking on the cookie settings icon. In Console, click on the ‘Cookie Settings’ link in the footer.

You can choose to decline cookies but if you turn off necessary cookies, some pages and functions on our Website or Console may not work properly. You can also manage cookies through your browser settings or device settings (your user manual should contain additional information).

You can also delete cookies directly with the relevant third parties (for example, you can disable YouTube cookies when viewing a YouTube video hosted on our Website).
Thank you for taking the time to read our Privacy Policy.

Convenient Collect Ltd T/A HubBox

This Policy was last updated in March 2026.