Privacy Policy

Last updated: 1 November 2026

This policy explains what personal data we process when you visit boxesmakers.com, ask us for a quote or place an order, why we process it and for how long, and how you can exercise your rights. It is governed by Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD).

1. Data controller

• Controller: Boxes (boxesmakers.com), Valencia (Spain)
• Email: [email protected]
• Phone and WhatsApp: +34 645 288 831

We are not required to appoint a data protection officer. For any question about your data, write to [email protected].

2. What data we process, why, and on what legal basis

Enquiries and quotes. When you contact us by WhatsApp, email, phone or the contact form, we process your name, contact details, company (if you give it) and the content of your enquiry in order to reply and prepare a quote. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

Box configurator. The configurator calculates an estimated price from the dimensions and options you choose. If you generate the PDF quote, we store on our server the quote number, the configuration, the calculated price, the language and the date, together with the PDF file, so that we can identify it when you contact us. The configurator does not ask for personal data. Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).

Orders. If you place an order, we process the data needed to manufacture, deliver and invoice it and to handle the guarantee: name or company name, tax or VAT number, delivery and billing address, contact person, bank transfer details and the correspondence about the order. Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with accounting and tax obligations (Art. 6(1)(c) GDPR).

Business contacts. If you work for a client or supplier company, we process your business contact details to maintain our relationship with that company. Legal basis: legitimate interest (Art. 6(1)(f) GDPR and Art. 19 LOPDGDD).

Website security. When you visit the site, our server and our network provider log the IP address, date and time, the page requested and the browser. We use these logs only to protect the site against attacks and errors. Legal basis: our legitimate interest in keeping the site secure and available (Art. 6(1)(f) GDPR).

Usage statistics. If you accept analytics cookies, we use Google Analytics to understand how the site is used (pages visited, visit length, device and browser type, approximate location at city level) and to improve it. We do not send your name to Google Analytics. If you send us the contact form, we may pass your email address and phone number to Google in irreversibly encrypted (hashed) form to measure the enquiries we receive; they are not used for advertising. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings”.

Complaints. If you make a complaint, we process the data needed to handle it and reply to you. Legal basis: legal obligation (Art. 6(1)(c) GDPR; Art. 21 of the Spanish consolidated Consumer Protection Act).

We do not send advertising by email or WhatsApp without your consent. We do not make automated decisions or create profiles about you: the configurator only calculates a price.

Providing your data is voluntary, but without contact details we cannot prepare a quote, and without the order details we cannot manufacture or deliver it.

3. How long we keep the data

• PDF quotes that do not become an order: 6 months from creation, after which they are deleted from the server automatically.
• Enquiries that do not lead to an order: up to 12 months from the last contact.
• Orders, invoices and related correspondence: 6 years (Art. 30 of the Spanish Commercial Code) and, for tax purposes, as long as tax obligations can be enforced.
• Google Analytics statistics: up to 14 months.
• Server technical logs: up to 30 days, unless needed to investigate a security incident.

4. Who else processes the data

We do not sell your data. We share it only with those who need it to provide the service:

• Contabo GmbH (Germany): website and email hosting, as a processor. The data is hosted in the EU.
• Cloudflare, Inc.: content delivery and website protection, as a processor. It may process technical data outside the European Economic Area (see section 5).
• Google Ireland Ltd.: website usage statistics with Google Analytics, as a processor, only if you accept analytics cookies.
• WhatsApp Ireland Ltd.: if you choose to contact us via WhatsApp, the conversation goes through the WhatsApp service, which processes your data under its own privacy policy (whatsapp.com/legal).
• Carriers: delivery name, address and phone number, to deliver the order.
• Banks: bank transfer details.
• Our accounting and tax advisers, and public authorities where required by law.

On blog posts, the share buttons are loaded from AddToAny (AddToAny LLC, USA), which receives your IP address when the page loads.

5. Transfers outside the European Economic Area

Cloudflare, Google, Meta (WhatsApp) and AddToAny may process data in the United States. These transfers are based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Decision (EU) 2023/1795) for certified companies and, in any case, on the standard contractual clauses approved by the Commission (Art. 46 GDPR). You can ask us for more information about these safeguards at [email protected].

6. Your rights

You can at any time exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw any consent you have given, without affecting the lawfulness of earlier processing. Write to [email protected] stating which right you want to exercise. We will reply within one month.

If you believe we have not processed your data correctly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence.

7. Children

Our services are not intended for children under 14, and we do not knowingly process their data.

8. Cookies

For the cookies and similar technologies used on this site, see our Cookie policy.

9. Changes to this policy

If we change this policy, we will publish the new version here with its date. If the change is significant, we will also let you know through the contact details we have for you.