Stockbox Privacy Policy

This Privacy Policy explains how StockBox collects and uses personal data when you visit our websites, use our platform, or contact us.

1) Who we are (Data Controller)

Hallmark Marketing Limited (Company No. 03959769) trading as StockBox ("StockBox", "we", "us") is the data controller for personal data described in this Privacy Policy (except where we act as a processor for Customer data — see Section 5).

Contact:

Email: legal@stockbox.tech

Address: 97 Carlton Avenue East, Wembley, Middlesex, United Kingdom, HA9 8LZ

2) What this policy covers

This policy applies to:

visitors to stockbox.tech and related websites/landing pages;
business customers, prospects, and partners contacting StockBox;
authorised users using the StockBox Platform;
analytics and marketing activities on our websites (see Section 6 and our Cookie Policy).

3) Personal data we collect

We may collect the following categories:

A) Website and device data (online identifiers)

IP address (processed for security/anti-fraud and to provide the website; see also analytics notes below)
device type, browser, operating system
pages visited, clicks, session timing, referral source
approximate location (e.g. city/region level derived from technical signals)

B) Contact and account data

name, business name, job title
work email, phone number
billing/contact details
login identifiers and access records

C) Platform usage and support data

user actions within the platform (audit logs, settings changes)
support tickets, messages, recordings/screenshots you share with us
configuration and integration details (e.g. payment gateway IDs, email sending setup)

D) Business/customer data uploaded by our Customers ("Customer Data")

This may include end-customer names, contact details, order history, repair records, valuations, communications, etc. How we handle this depends on whether StockBox is acting as a processor (Section 5).

4) How we use personal data (purposes)

We use personal data to:

Provide and secure the website and platform (account creation, authentication, access control, logging, fraud prevention)
Deliver customer support and maintenance (bug fixes, incident response, service communications)
Run our business operations (billing, contract administration, record keeping)
Improve our products and services (performance monitoring, analytics, trend analysis)
Sales and marketing (B2B) (respond to enquiries, send relevant updates where permitted, manage relationships)

5) Customer Data — controller vs processor

When a business customer uses StockBox to manage its own customers and transactions, the business customer is typically the data controller for that end-customer data, and StockBox acts as a data processor on their instructions.

In those cases, your use of the platform is also governed by our SaaS terms / data processing terms agreed with the Customer.

If you are an end customer of a StockBox customer (e.g. you bought a watch from a dealer using our system), please contact that dealer/shop directly about your privacy rights. StockBox processes your data on their behalf.

5A) Stockbox AI on WhatsApp

If you choose to message Stockbox on WhatsApp, an automated assistant may answer questions about watch references, visible watch attributes, Stockbox products and support. Photo-assisted results are suggestions only: they do not authenticate a watch or confirm its ownership, condition or value. You can ask to speak to a person at any time.

We process your WhatsApp number, messages, message status information and any watch photographs you send. Meta provides the WhatsApp service and Anthropic provides AI processing. Where an authorised member of a Stockbox customer’s staff selects their shop, the question may be routed to that shop’s isolated Stockbox AI service for a read-only answer. The registered WhatsApp number is used to recognise eligible staff; it is not a second-factor authentication method.

WhatsApp conversations and photographs are encrypted in our systems and retained for up to 12 months, unless we must keep them for longer for a legal reason or you validly request earlier erasure. Authorised Stockbox administrators may view the conversation to provide support and take over from the assistant. International processing safeguards and the rights in Sections 9 and 12 also apply.

6) Analytics (Google Analytics)

We use analytics tools (such as Google Analytics 4) to understand how visitors use our website and to improve performance, navigation and content.

What this means in practice:

Analytics data is used to produce aggregated statistics and usage insights (e.g. which pages are most visited, common journeys, time on page, feature adoption).
This information is not intended to directly identify you. We use it to identify usage patterns and trends, not to build personal profiles of named individuals.
GA4 uses first-party cookies (such as _ga and _ga_*) to distinguish users and sessions.
Google states that, for EU-focused data and privacy, Analytics does not log or store IP addresses from EU users and drops IP addresses before logging when collected via EU domains/servers.

Your choices: you can manage analytics preferences via our cookie banner/settings (see our Cookie Policy). UK rules on cookies and similar technologies are governed by PECR alongside the UK GDPR, and the ICO expects clear information and appropriate consent for non-essential cookies.

7) Lawful bases (UK GDPR)

We rely on one or more of the following lawful bases:

Contract – to provide the platform and support to customers and authorised users
Legitimate interests – to run and improve our business, keep systems secure, and understand website usage (balanced against your rights)
Consent – where required for non-essential cookies/trackers or certain direct marketing
Legal obligation – for compliance, accounting, and lawful requests

8) Who we share data with

We may share personal data with:

hosting/infrastructure providers (to host the platform and website);
analytics providers (e.g. Google Analytics) where enabled and permitted;
communication tools (email, support ticketing, incident notifications);
payment/billing providers (for invoicing and payment processing);
professional advisers (legal/accounting) and regulators where required by law.

We only share what is necessary and require appropriate safeguards.

9) International transfers

Some service providers may process data outside the UK. Where international transfers occur, we use appropriate safeguards (such as contractual protections) as required by data protection law.

10) Data retention

We keep personal data only as long as necessary for the purposes described:

account and contract records: for the duration of the relationship plus a reasonable period for legal/accounting needs;
support logs: as needed for troubleshooting, compliance and platform security;
analytics data: retained according to our analytics configuration and operational needs.

11) Security

We use reasonable technical and organisational measures to protect data, including access controls, encryption in transit, and operational monitoring. No method of transmission/storage is 100% secure, but we work to maintain a strong security posture.

12) Your rights

Depending on your role and applicable law, you may have rights to:

access, correct, delete, or restrict processing of your personal data;
object to processing based on legitimate interests;
withdraw consent where we rely on consent;
request portability (in certain cases);
complain to the ICO (UK supervisory authority).

13) Marketing communications (B2B)

We may send business-related communications where permitted. You can opt out at any time by using the unsubscribe link (where provided) or contacting us.

14) Children

Our services are not directed to children and we do not knowingly collect children's data via our websites for marketing purposes.

15) Changes to this policy

We may update this policy from time to time. The "Last updated" date shows the latest version.