Privacy Policy

We are Box Walks (Box Walks, we, our or us) and we operate the website https://boxwalks.com/ (Site) and the Box Walks App which is an application to facilitate taking part in Box Walks' guided walks (App) (the Site and App together the Platform). Our business address is 71-75 Shelton Street, Covent Garden WC2H 9JQ.

1.1. This privacy policy (Policy) outlines the types of data we collect when you use our Platform, the purposes they serve and how your personal data is protected.

1.2. Your access to, and use of, the Platform implies your binding agreement to and acceptance of this Policy. If you do not agree with the terms of this Policy, please do not use the Platform.

1.3. This Policy, along with the following additional policies, are the rules governing your rights and obligations in respect of the Platform:

• ›Terms of Use

2.1. This Policy outlines the types of data we collect through the use of our Platform, including any data you may provide when you register for an account. This Policy pertains to all users engaging with the Platform; by continuing to use our Platform, you are consenting to the terms of this Policy. We are dedicated to keeping you informed when it comes to your online privacy and focus on promoting transparency between you and us and upholding compliance in respect of privacy laws.

2.2. In addition to this Policy, users are advised to review and be aware of the terms that govern their use of our Platform, including our Terms of Use and any other terms which we may communicate to you from time to time.

3.1. By engaging with and using the Platform, you consent to us collecting, receiving, processing, storing and transferring the following information for the purposes listed below:

In limited circumstances we may process any of the Personal Data we hold to the extent necessary to defend, establish and exercise legal claims or to comply with legal or regulatory obligations.

3.2. Where we need to collect personal data due to a legal or regulatory obligation, or for performance of a contract, and you do not provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. We will notify you of this at the time.

We use various methods to collect data from and about you which includes through:

• ›Your interactions with us: you may provide us with personal data by filling out information on our Platform or corresponding with us, including when you create an account, give us feedback or contact us.
• ›Automated technologies or interactions: through your interaction with our Platform, we will automatically collect Technical Data about your browsing actions and patterns using cookies and other similar technologies, further information of which is available in our Cookie Policy.
• ›Third parties or publicly available information: we may receive personal data from time to time about you from a variety of third parties and public sources of information.

5.1. We may share your data with third parties where necessary to provide access to, and use of the Platform, perform services, comply with our legal obligations or for the purposes set out in this Policy, including:

Volunteers, Employees and Collaborators

We may share your information with our volunteers, employees and collaborators of Box Walks.

Service Providers and Partners

5.2. We may share your information with trusted service providers and partners (including sponsors) who assist in providing and enhancing our services. These entities have limited access to your information, adhere to strict confidentiality and data security standards, and may only use your information to help us operate, provide and advertise the Platform in accordance with our instructions.

Legal Obligations

5.3. We may disclose information in response to requests by courts of a competent jurisdiction, or as a result of other regulatory requirements, government agencies or law enforcement requests, including where disclosure is necessary to comply with applicable laws or regulations or safeguard the rights, privacy, and security of our users and Box Walks.

User Consent

5.4. In circumstances not covered by section 5.3 above, we share information with your consent, allowing you control over the sharing of your information.

6.1. Your personal data will be processed and stored within the European Union, the UK or in countries that are either retained by the European Union or the UK to have an adequate level of protection for your personal data, or for which we have otherwise put in place appropriate safeguards as described in section 6.4 below.

6.2. In certain instances, your information may be transferred across international borders as part of our operations. This includes scenarios where our service providers, partners, or servers are located in different countries.

6.3. To safeguard your information during international transfers, we implement protective measures consistent with data protection standards. These measures may include the use of encryption, contractual agreements with data processors, or reliance on internationally recognised frameworks.

6.4. Should we transfer personal data to countries outside the EEA, including the US, that do not benefit from an adequacy decision, we put in place appropriate safeguards such as the EU standard contractual clauses or the UK Addendum as necessary, unless a relevant exemption applies.

6.5. We are committed to compliance with international data protection laws governing cross-border data transfers, adhering to applicable frameworks, regulations, and mechanisms that ensure the lawful and secure transfer of user information across borders.

7.1. Certain features or services of the Platform may involve third-party applications or services. If you decide to engage with a third-party for the provision of certain applications or services, those third parties may have their own privacy policies and terms of service, and we encourage you to review them to understand how they collect, use, and handle your information.

We prioritise the security of your information by implementing robust security measures including encryption, access controls, and other industry-standard protocols. Measures involve:

• ›Regular security audits: periodic reviews to evaluate and enhance our Platform's security, identify potential vulnerabilities, and ensure our measures align with evolving industry best practices.
• ›Employee training: comprehensive data protection training for our employees to ensure a collective commitment to upholding the highest standards of data privacy and security.
• ›Incident response plans: established procedures for promptly detecting, responding to, and mitigating the impact of any potential data breach or security incident.

10.1. We only store your information for the duration necessary to fulfil its intended purpose. The determination of the retention period is based on the necessity of processing the information for your access to, and use of, the Platform, services provided and other legitimate business purposes.

10.2. The specific timeframes for retaining various data types are established by taking into consideration our legal requirements, contractual obligations, and user consent. These retention periods are periodically reviewed to ensure continued relevance and compliance:

Upon expiration of the data retention period, we employ secure methods for data handling, which may include deletion or anonymisation, ensuring data no longer needed for its original purpose is responsibly managed.

12.1. Data collected via our services may be anonymised, where applicable, and aggregated for statistical analysis or other lawful purposes. This may include collaboration with sponsors and partners if applicable.

12.2. We take all reasonable measures to ensure that, where applicable, once data is anonymised or aggregated, it cannot be used to identify an individual.

13.1. Certain privacy laws (which includes the General Data Protection Regulation) provide users with rights and choices related to their personal information. Subject to applicable law, you may have the following rights:

We try to respond to all legitimate requests within one month of receiving the request. If you wish to exercise any of your rights, please contact us at the address set out in section 17.

13.2. You are entitled to file a complaint with the applicable data protection regulator, which in the United Kingdom is the Information Commissioner's Office (ICO), if you believe that your data protection rights have been violated. You can find out more and submit a complaint at ico.org.uk.

14.1. We emphasise the importance of keeping your personal information current and correct. You are encouraged to regularly review and update your information to ensure its accuracy and relevance.

14.2. You must prioritise the safeguarding of your account credentials and must refrain from sharing your credentials with unauthorised users. You should adopt secure password practices, such as using strong, unique passwords and enabling multi-factor authentication when required by us.

14.3. We urge you to familiarise yourself with the privacy policies and terms of relevant third parties associated with our Platform, including external services, partners, and integrated functionalities.

15.1. Our app is designed for use by individuals aged 18 and over and is not intended for children under the age of 13. We do not knowingly collect or process personal data relating to children.

15.2. If we become aware that we have inadvertently collected personal data from a child under 13, we will take steps to delete that information as soon as possible.

15.3. If you are a parent or guardian and believe that a child has provided us with their personal data, please contact us using the details set out in this Privacy Policy so that we can investigate and take appropriate action.