Data Protection Policy

Effective Date: 14/02/25

Curiosity Box is committed to protecting the personal data of our customers, employees, and partners in accordance with data protection laws, including the UK GDPR and the Data Protection Act 2018.

  1. Scope

This policy applies to all personal data processed by Curiosity Box, whether in electronic or paper form.

  1. Principles of Data Protection

We adhere to the following principles:

  • Lawfulness, Fairness, and Transparency: We process personal data lawfully, fairly, and transparently.
  • Purpose Limitation: Data is collected for specified and legitimate purposes.
  • Data Minimisation: We only collect necessary data.
  • Accuracy: We ensure personal data is accurate and up to date.
  • Storage Limitation: We do not keep data longer than necessary.
  • Integrity and Confidentiality: We use security measures to protect personal data.
  1. Legal Basis for Processing

We process personal data based on:

  • Consent: Where you have provided explicit consent.
  • Contractual Necessity: To fulfill orders and provide services.
  • Legal Obligation: Compliance with regulatory requirements.
  • Legitimate Interests: For business operations, marketing, and fraud prevention.
  1. Data Subject Rights

Individuals have the right to:

  • Access their data
  • Rectify incorrect data
  • Erase their data (right to be forgotten)
  • Restrict or object to processing
  • Request data portability

To exercise these rights, contact us at help@curiosity-box.com.

  1. Data Security

We implement technical and organisational measures to protect personal data, including:

  • Encryption and access controls
  • Regular security audits
  • Secure storage and disposal procedures
  1. Data Breach Response

In case of a data breach, we will:

  • Assess the impact
  • Notify affected individuals (if required)
  • Report to the ICO within 72 hours (if necessary)
  1. Third-Party Processing

Any third-party processing of personal data must comply with our data protection requirements.

  1. Employee Responsibilities

All employees handling personal data must adhere to this policy and undergo regular data protection training.

  1. Policy Updates

This policy is reviewed periodically and updated as necessary.

  1. Contact Information

For questions regarding this policy, contact help@curiosity-box.com