UKBox Ltd (Company No. 15154892, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ) is the data controller for personal data processed through our website and services. Contact: support@ukbox.co.uk or 0330 088 2279.
We use a small number of processors to run our services: Mailgun (EU region) to deliver system email; Stripe to process card payments (we never see or store full card numbers); MaxMind for fraud screening of orders; Google reCAPTCHA to protect forms; and Google Analytics for anonymous usage statistics. Where a provider processes data outside the UK, transfers are protected by recognised safeguards such as the UK Addendum to Standard Contractual Clauses. Marketing processors are listed in section 6.
Content you host with us (websites, mailboxes, databases) lives in our UK data centres in London, Coventry and Maidenhead. For that content we act as a processor on your behalf: it's your data, we store and serve it, and we access it only to provide support you've asked for or to protect the platform.
You may request access to, correction or deletion of your personal data, object to or restrict processing, and request portability. Write to support@ukbox.co.uk; we respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
UKBox is part of a small family of UK businesses run under common ownership: UKBox Ltd (UKBOX), Velvet Rose Box Ltd (Rosebox, Spices2Go and RecipeBox) and Vaulex Group Ltd (Vaulex). Each company is a separate data controller and is responsible for its own marketing.
If you tick the marketing box when you create an account or place an order, you consent to receive offers and news by email from the brands named in the box: Rosebox, Spices2Go, RecipeBox, UKBOX and Vaulex. The wording you agreed to, and the date and time you agreed to it, are recorded against your contact record so we can always evidence your consent. If you buy from us without ticking the box, we do not add you to any cross-brand marketing; at most, UKBox may tell you about its own similar services under the "soft opt-in" rule in PECR, and only where you were given the chance to refuse. Soft opt-in is never shared across the other companies.
Your name, email address, which brands you have consented to hear from, the consent wording version, the date, time and source of your consent, and your engagement with our emails. Our emails contain standard open and click tracking so we can measure what is useful and stop sending what isn't. Every marketing email includes a working unsubscribe link.
Marketing contact records for all three companies are held in a single, self-hosted marketing database operated by us on managed European infrastructure provided by Peakford Ltd (PikaPods), and marketing emails are delivered by Sinch Mailgun from its EU region. Both act as processors under written terms; data stays within the UK/EEA.
You can unsubscribe from any brand, or from all of them, using the link in any marketing email, or by writing to support@ukbox.co.uk. Opting out of marketing never affects the service emails your account needs (invoices, renewal notices, support replies). ICO registrations: UKBox Ltd ZC191675, Velvet Rose Box Ltd ZA896675, Vaulex Group Ltd ZC087196.
Essential cookies keep you logged in and your cart working — the site cannot function without them. Analytics cookies (Google Analytics) help us understand how the site is used, in aggregate. Security cookies support reCAPTCHA. You can control cookies in your browser settings; blocking essential cookies will break login and ordering.
