Privacy Policy

Last updated: February 2026

1. Introduction

This Privacy Policy explains how The Curiosity Box Ltd (“The Curiosity Box”, “we”, “us”, or “our”) collects, uses, stores and protects personal information when you visit www.curiosity-box.com, create an account, purchase a product or subscription, or otherwise interact with us.
The Curiosity Box Ltd is the data controller responsible for the personal information we collect through our website and services. We are committed to protecting the privacy and security of our customers and website users. This policy explains what information we collect, why we collect it, how it is used, and the rights available to you under applicable data protection law.
If you have any questions about this Privacy Policy or how your personal data is handled, you may contact us at: Email: help@curiosity-box.com

2. Personal Information We Collect

We collect personal information in a number of ways depending on how you interact with our website and services.

Information You Provide

When you register for an account or place an order with The Curiosity Box, we may collect the following information:
● name
● email address
● account password
● billing address
● delivery address
● payment details (processed securely by our payment providers)
● the name of the child receiving the box
● the child’s date of birth
● optional information about your relationship to the child

You may also voluntarily provide personal information when you:
● contact our customer support team
● submit product ratings or reviews
● respond to surveys or feedback requests
● participate in promotions or competitions

Where you contact us for support, we may collect your name, email address, phone number (if provided), and the content of your enquiry.

Information Collected Automatically

When you visit our website, certain information is collected automatically through server logs, cookies and analytics tools. This may include:
● IP address
● browser type and version
● device type and operating system
● referring website
● pages viewed and navigation paths
● time and date of visits
● approximate geographic location derived from IP address

This information helps us operate, secure and improve our website and services.

Information From Third Parties

We may receive limited information from third parties where relevant to your use of our services,
including:
● payment providers confirming payment transactions or payment failures
● social media platforms where you interact with our accounts or content
● fraud prevention and security services

3. Children’s Information

The Curiosity Box is designed for children but our products are purchased by adults. We do not knowingly collect personal information directly from children under the age of 16. Parents or guardians may provide a child’s name and date of birth for the sole purpose of personalising the subscription experience. This information is processed only as necessary to provide the service.
Children’s names and ages may be provided by parents or guardians for choosing to feature on social media and in our newsletter for distribution. This information requires explicit parental or guardian consent.
If we become aware that personal information has been collected directly from a child under 16 without appropriate parental involvement, we will delete that information promptly.
Parents or guardians who wish to request deletion of a child’s information may contact us at help@curiosity-box.com.

4. How We Use Personal Information

We process personal information only where we have a lawful basis to do so under applicable data protection law.

Providing Our Services
We use personal information to:
● create and manage customer accounts
● process payments and manage subscriptions
● deliver orders and subscription boxes
● personalise elements of the service
● administer promotions or competitions

The lawful basis for this processing is performance of a contract with you.

Customer Service and Account Management
Personal information may be used to:
● respond to enquiries
● provide customer support
● resolve complaints or technical issues
● manage subscriptions and account settings

The lawful basis for this processing is legitimate interests and contract performance.

Website Operation and Improvement
We analyse website usage and technical data in order to:
● improve website functionality and performance
● monitor security and detect fraudulent or malicious activity
● understand customer behaviour and service usage
● improve our products and services

The lawful basis for this processing is our legitimate interest in operating and improving our business.

Communications and Marketing
We may contact customers by email to provide:
● service-related communications
● account notifications
● subscription updates
● product information
● occasional marketing or promotional offers

Marketing communications are sent either:
● with your consent, or
● where permitted under legitimate interests in accordance with applicable marketing regulations.
You may opt out of marketing communications at any time using the unsubscribe link in our emails or by contacting us.
Please note that certain transactional communications relating to your account or subscription cannot be opted out of while you remain a customer.

5. Cookies and Tracking Technologies

Our website uses cookies and similar technologies such as pixels and web beacons.
These technologies allow us to:
● enable core website functionality
● remember preferences and settings
● analyse website usage
● measure marketing effectiveness
● deliver relevant advertising

Cookies used on our website fall into the following categories:
Strictly Necessary Cookies – Essential for the operation of the website.
Analytics Cookies – Used to understand how visitors interact with the website.
Functional Cookies – Used to remember preferences and settings.
Advertising Cookies – Used by advertising partners to display relevant advertisements.

You may control cookie preferences using our cookie settings tool or your browser settings. Blocking certain cookies may affect the functionality of the website.

6. Advertising and Marketing Partners

We may work with third-party advertising platforms to promote The Curiosity Box online. These partners may use cookies or similar technologies to measure advertising performance and display relevant advertisements.
This may include advertising services operated by companies such as search engines, social media platforms or online advertising networks. We do not sell personal information to advertisers.
Where required by law, we obtain consent before placing advertising cookies on your device.

7. Automated Processing and Profiling

We may use limited automated processing to assist with:
● marketing segmentation
● email personalisation
● fraud prevention
● service optimisation
This processing does not result in decisions producing legal or similarly significant effects for individuals.

8. Sharing Personal Information

We do not sell or rent personal information to third parties.
However, personal data may be shared with trusted service providers who assist us in operating our business and providing our services. These may include providers of:
● website hosting and infrastructure
● payment processing
● order fulfilment and delivery services
● email and communications platforms
● analytics and marketing services
● fraud detection and prevention
These providers are contractually required to process personal data only on our instructions and to implement appropriate security measures.

Business Transfers

If The Curiosity Box Ltd undergoes a merger, acquisition or sale of assets, personal information may be transferred as part of that transaction. Where required, affected users will be notified.

Legal Obligations

We may disclose personal information where required to do so by law, regulation, legal process or government request, or where disclosure is necessary to:
● enforce our legal rights
● protect the rights, safety or property of our customers or business
● prevent fraud or security threats

9. International Transfers

Some of our service providers may process personal data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, including:
● the UK International Data Transfer Agreement (IDTA)
● the UK Addendum to EU Standard Contractual Clauses
● adequacy decisions issued by the UK government
These safeguards ensure personal data receives an appropriate level of protection.

10. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting or reporting requirements. Retention periods may vary depending on the type of data involved. For example:
● account information is retained while the account remains active
● order and payment records may be retained for up to 7 years to comply with financial and tax obligations
● customer support communications may be retained for a limited period to assist with ongoing support and service improvement
Where personal data is no longer required, it will be securely deleted or anonymised.

11. Data Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or disclosure. These measures include:
● encrypted transmission of data using Transport Layer Security (TLS)
● secure infrastructure and controlled access systems
● password hashing and authentication safeguards
● monitoring and security procedures designed to detect potential vulnerabilities
Despite these safeguards, no internet transmission or storage system can be guaranteed to be completely secure. Users are responsible for maintaining the confidentiality of their account credentials.

12. Your Data Protection Rights

Under applicable data protection law, individuals have certain rights regarding their personal data.
These include the right to:
● request access to personal data
● request correction of inaccurate information
● request deletion of personal data in certain circumstances
● request restriction of processing
● object to certain types of processing
● request transfer of personal data to another organisation
● withdraw consent where processing relies on consent
Requests may be submitted by contacting help@curiosity-box.com. You also have the right to lodge a complaint with the UK data protection regulator: Information Commissioner’s Office

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in legal requirements, business practices or our services.
Where material changes are made, we will update the “Last updated” date at the top of this page and may notify customers where appropriate.
Users are encouraged to review this policy periodically.