Privacy Policy

1. Data Controller Information

This Privacy Policy applies to personal data processed by Purple Box (UK) Ltd ("PurpleBox", "we", "us", or "our").

• Company Name: Purple Box (UK) Ltd
• Company Registration Number: 08212295 (Registered in England & Wales)
• Registered Office: 77 Commercial Street, London E1 6BD
• Email: [email protected]
• Telephone: 0207 613 1378
• Supervisory Authority: Information Commissioner's Office (ICO), United Kingdom

2. Scope: Controller vs. Processor Roles

Depending on the nature of our engagement, PurpleBox acts in two distinct capacities under UK data protection law:

• Data Controller: We act as a Data Controller for personal data relating to our prospective and existing clients' administrative contacts, account billing, website inquiries, marketing preferences, and portal login credentials.
• Data Processor: When providing managed IT support, Microsoft 365 tenant administration, data backup, hosted telephony, and disaster recovery services, our clients act as the Data Controller, and PurpleBox acts as a Data Processor. In these cases, we process client data strictly under the instructions set out in our Master Services Agreement and Data Processing Addendum (DPA).

3. Categories of Personal Data We Collect

We may collect and process the following categories of information:

A. Identity and Contact Information

Full name, business address, email address, direct telephone number, mobile number, job title, and employer details provided during inquiries, quotes, or contract setup.

B. Technical & Diagnostic Support Data

When delivering helpdesk or technical support services:

• Hardware identifiers (device serial numbers, MAC addresses, IP addresses).
• Operating system versions and software licensing metadata.
• Diagnostic system logs, crash dumps, and service desk ticket histories.
• Remote assistance session telemetry (recorded only with explicit user permission during active support sessions).

C. Telephony and Communications Records

For clients utilising our hosted VoIP communications systems:

• Call Detail Records (CDRs) including calling number, destination number, call duration, timestamp, and routing path.
• Voicemail audio files and transcripts (where requested by the client organisation).

D. Billing & Transactional Data

Invoicing records, payment transaction references, VAT numbers, purchased hardware serials, and subscription history. We do not store raw credit or debit card numbers on our local servers.

4. Lawful Basis for Processing

Under Article 6 of the UK GDPR, we process personal data under one or more of the following lawful bases:

5. How We Share Information and Sub-Processors

We do not sell, rent, or trade your personal data. We only share data with vetted third-party service providers who assist us in operating our business and delivering our services:

• Cloud & Productivity Infrastructure: Microsoft Corporation (Microsoft 365, Azure UK data centres) for enterprise tenant hosting and email routing.
• Telecommunications Carriers: Ofcom-regulated UK wholesale network carriers providing SIP trunking, number porting, and hosted telephony infrastructure.
• Security & Backup Providers: Accredited cyber security and cloud backup vendors (such as Sophos, Bitdefender, and enterprise backup repositories) operating under strict encryption protocols.
• Professional Advisors: Qualified accountants, auditors, insurers, and legal counsel when required for regulatory compliance or dispute resolution.
• Law Enforcement & Statutory Bodies: Where required by English law, court order, or binding regulatory mandate.

6. International Data Transfers

Our primary cloud infrastructure, servers, and backup repositories are located within the United Kingdom and the European Economic Area (EEA). If any sub-processor processes personal data outside the UK, we ensure adequate safeguards are in place, including:

• UK Adequacy Regulations; or
• The UK International Data Transfer Addendum (IDTA) or standard contractual clauses approved by the Information Commissioner's Office.

7. Data Security and Technical Measures

As a security-first IT provider, PurpleBox enforces rigorous technical and organisational safeguards to prevent accidental loss, unauthorised access, alteration, or disclosure:

• Mandatory Multi-Factor Authentication (MFA) across all internal and administrative systems.
• Full-disk encryption (BitLocker / FileVault) on all workstations and mobile devices.
• AES-256 encryption for data at rest and TLS 1.3 encryption for data in transit.
• Role-based least-privilege access controls audited on a continuous basis.
• Regular patch management, endpoint threat detection, and disaster recovery testing.

8. Data Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or to comply with legal, accounting, and reporting obligations:

• Client Account & Financial Records: Retained for six (6) years following the end of the relevant financial year, in compliance with UK tax law (HMRC).
• Helpdesk Support Tickets: Retained for up to three (3) years after ticket closure to assist in recurrent diagnostics and historical environment tracking.
• VoIP Call Detail Records: Retained for twelve (12) months unless a different duration is agreed in the client SLA.
• Website Inquiries: Retained for up to twelve (12) months if no commercial relationship is formed.

9. Your Legal Rights Under UK GDPR

Subject to certain statutory exemptions under the Data Protection Act 2018, you possess the following rights regarding your personal data:

• Right of Access: You may request a copy of the personal data we hold about you (Subject Access Request).
• Right to Rectification: You may request the correction of inaccurate or incomplete information.
• Right to Erasure: You may request the deletion of your personal data where there is no compelling legal reason for its continued processing.
• Right to Restrict Processing: You may request the suspension of data processing in specific circumstances.
• Right to Data Portability: You may request the transfer of your data to yourself or another service provider in a structured, machine-readable format.
• Right to Object: You may object to data processing based on legitimate interests or direct marketing.

To exercise any of these rights, please email us at [email protected]. We respond to all verified requests within one calendar month in accordance with statutory requirements.

10. Cookies and Website Analytics

Our website uses strictly necessary session cookies required for core navigation, responsive layout state, and secure form submissions. With your prior consent only, we also use Google Analytics 4 to measure how visitors use the site so we can improve it. This sets analytics cookies (_ga and _ga_*) and shares aggregated usage data with Google. You can accept, refuse or change your choice at any time through the cookie preferences panel, and withdrawing consent stops analytics and removes the analytics cookies. We do not use intrusive cross-site behavioural tracking cookies. See our Cookie Policy for the full list. You can also configure your browser to refuse all or some cookies, though some interactive elements of the website may not function as intended.

11. Right to Complain to the Regulator

If you have concerns about our data protection practices, please contact us first so we can resolve the matter promptly. You also retain the right to lodge a complaint directly with the UK supervisory authority:

12. Contact Our Compliance Team

For questions concerning this Privacy Policy, your rights, or data protection practices, please contact:

Data Protection & Compliance Officer
Purple Box (UK) Ltd
77 Commercial Street, London E1 6BD
Email: [email protected]
Telephone: 0207 613 1378