Privacy Policy

Orchid Box Limited ("Orchid Box", "we", "us") is committed to protecting your personal data. This policy explains what we collect when you use www.orchidbox.com, why we collect it, how long we keep it, who we share it with and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This version is effective from 27 October 2026 and replaces all earlier versions. We review it at least once a year and whenever our processing changes, so please check back from time to time.

Who We Are

Orchid Box Limited is the data controller for the personal data described in this policy. Registered office: 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom. VAT number 945 0673 13. We are a B2B marketing agency and we do not sell products or services to consumers through this website.

What We Collect and Why

We keep data collection to the minimum needed to run the site and respond to you.

• Contact form enquiries. Your name, email address, the service you are asking about and the message you write. We use this to answer your enquiry and, if you become a client, to manage our relationship with you. Lawful basis: our legitimate interest in responding to business enquiries, and, where a contract follows, performance of that contract.
• Website analytics. Pages viewed, approximate location derived from a truncated IP address, device and browser type, referring site and the time of your visit, collected through Google Tag Manager and Google Analytics 4. We use this to understand how the site performs and to improve it. Lawful basis: your consent, given through the cookie notice. Google Analytics 4 does not log or store full IP addresses.
• Server logs. Our web server records IP addresses, requested URLs, timestamps and user-agent strings for security and fault diagnosis. Lawful basis: our legitimate interest in keeping the site secure and available.
• Client and supplier records. If we work together, we hold the business contact details, correspondence and billing information needed to deliver and invoice our services. Lawful basis: performance of a contract and our legal obligations, including UK tax and accounting rules.

We do not use the site to collect special category data, and we do not knowingly collect data from anyone under 18. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

Cookies and Similar Technologies

We use a small number of cookies and local storage entries. Strictly necessary cookies keep the site working and remember your cookie choice. Analytics cookies set by Google Analytics 4 through Google Tag Manager are only placed once you accept them. We do not run advertising or retargeting cookies on this site.

You can withdraw consent at any time by clearing cookies for orchidbox.com in your browser and choosing to decline on your next visit. You can also block cookies through your browser settings or install the Google Analytics opt-out browser add-on. Our Terms and Cookie Policy describes each cookie we set.

Who We Share Data With

We never sell, rent or trade personal data. We share it only with processors who act on our instructions under written contracts, and only where needed to run the site or deliver our services:

• Web3Forms, which transmits contact form submissions to our inbox.
• Google LLC (Google Tag Manager, Google Analytics 4, Google Fonts, Google Maps link) for analytics and site delivery.
• Our hosting provider, which stores the website and its server logs in the European Economic Area or the United Kingdom.
• Professional advisers such as accountants, insurers and lawyers, where required.

We may also disclose personal data where the law requires it, for example to HMRC, a court or a regulator, or where it is necessary to establish, exercise or defend legal claims.

International Transfers

Some of our processors, including Google and Web3Forms, process data in the United States. Where personal data leaves the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on an adequacy decision such as the UK Extension to the EU-US Data Privacy Framework, together with additional safeguards where appropriate.

How Long We Keep Data

• Contact form enquiries that do not lead to work: deleted within 12 months of the last message.
• Client and supplier records: kept for the life of the contract and for 6 years afterwards to meet UK tax, accounting and limitation rules.
• Google Analytics 4 event data: 14 months, after which Google deletes it automatically.
• Server logs: 90 days, unless retained longer to investigate a security incident.

When data is no longer needed we delete it or anonymise it so that it can no longer identify you.

How We Protect Data

The site is served over HTTPS. Access to enquiry data and client records is restricted to the people who need it, protected by strong passwords and multi-factor authentication, and reviewed regularly. Our processors are chosen for their security certifications and contractual commitments. If a personal data breach is likely to put your rights at risk, we will notify the Information Commissioner's Office within 72 hours and tell you without undue delay.

Your Rights

Under UK GDPR you have the right to:

• be told how we use your data (the right to be informed, which this policy fulfils);
• access the personal data we hold about you and receive a copy;
• have inaccurate or incomplete data corrected;
• have your data erased where we no longer have a lawful reason to keep it;
• restrict or object to our processing, including any processing based on legitimate interests;
• receive the data you gave us in a portable, machine-readable format;
• withdraw consent at any time where consent is our lawful basis, without affecting processing carried out before you withdrew it.

To exercise any of these rights, send your request through the contact form or write to Orchid Box Limited, 27 Old Gloucester Street, London, WC1N 3AX. We will respond within one month and will not charge a fee unless a request is clearly unfounded or excessive. We may ask you to confirm your identity before we act.

Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, ico.org.uk.

Links to Other Websites

This site links to third-party sites such as LinkedIn, Google Maps and LLM Scout. Each has its own privacy policy and we are not responsible for how they handle your data.

Changes to This Policy

We will post any changes on this page and update the date at the top. Where a change materially affects how we use your data we will take reasonable steps to bring it to your attention, for example by a notice on the home page.