Privacy notice
Last updated: 11 October 2026
1. Who is responsible for your information
Cindel Studio Limited is the controller of personal information used by CroyBox. CroyBox is a trading name of Cindel Studio Limited, company number 12968854, business address Leon House, 233 High Street, Croydon, England, CR0 1FY.
Privacy contact: sales@croybox.co.uk
2. Information we collect
Depending on how you use the site or book a hire, we may collect:
- your name;
- email address and telephone number;
- delivery and collection address and postcode;
- requested crate sizes, quantities and hire dates;
- booking, payment and security-deposit records;
- messages, complaints and customer-service records;
- records of crates delivered, collected, lost or damaged; and
- basic website and cookie information described in our Cookie Notice.
We do not need or intend to collect special-category information through the quote form. Please do not include unnecessary sensitive information in the notes field. We aim to ask only for the delivery postcode at the initial availability stage and collect the full address if you proceed.
3. Why we use information
| Purpose | Lawful basis normally used |
|---|---|
| Answer an enquiry, check availability, prepare a quote and take steps requested before a booking | Contract or steps before a contract |
| Confirm, deliver, manage and collect a hire; take payment; handle and return the deposit | Contract |
| Keep accounting, tax and company records | Legal obligation |
| Prevent fraud, protect our crates, resolve disputes and establish or defend legal claims | Legitimate interests, balanced against your rights |
| Send optional email marketing | Consent where required |
We will not add you to marketing merely because you make an enquiry or booking. Any marketing choice will be separate, optional and easy to withdraw.
4. Who receives information
We disclose personal information only where reasonably necessary. Recipients may include:
- Squarespace, which hosts the website and enquiry form;
- our email and office-service providers;
- our payment provider and bank;
- people delivering or collecting crates on behalf of CroyBox;
- professional advisers, insurers, courts, regulators or law-enforcement bodies where necessary; and
- a buyer or successor if the business is reorganised or sold, subject to appropriate protections.
We do not sell personal information. We do not intend to receive or retain full payment-card details through the general enquiry form.
5. International transfers
Some technology providers may process information outside the United Kingdom. Where this occurs, we will use a lawful transfer mechanism and appropriate safeguards. We periodically review the international-transfer arrangements and safeguards used by Squarespace and any other service providers involved in the website, email, analytics or payments.
6. How long we keep information
Our proposed retention schedule is:
- unsuccessful quote or enquiry: up to 12 months after the last contact;
- booking, invoice, payment and accounting records: six years after the relevant financial year, or longer where lawfully required;
- delivery, collection, deposit and damage records: up to six years after the hire ends where needed for contractual or legal claims;
- marketing choice: until consent is withdrawn, followed by a minimal suppression record where needed to respect the opt-out; and
- cookie and analytics information: for the periods described in the Cookie Notice.
We may retain information longer where reasonably necessary for a live complaint, legal claim, fraud investigation or legal obligation.
7. Your rights
Depending on the circumstances, you may have rights to request access, correction, deletion, restriction, objection or portability, or to withdraw consent. Withdrawing consent does not affect earlier lawful use.
Contact sales@croybox.co.uk to exercise a right. We may need enough information to verify your identity.
You may complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the opportunity to resolve the issue first.
8. Security
We use appropriate organisational and technical measures to protect personal information. No internet service is completely secure. Please do not send payment-card details or unnecessary sensitive information through the general enquiry form.
9. Children
The service is intended for adults. We do not knowingly contract with or collect information from children.
10. Changes
We may update this notice when our services, providers or legal obligations change. The current version and date will appear on this page.