1. Who We Are

MaxBox is operated by ESEA INTERNATIONAL LTD, a company registered in England and Wales under company number 13471004.

• Registered office: 71–75 Shelton Street, London WC2H 9JQ, United Kingdom
• Retail shop: 59 Northbrook Street, Newbury RG14 1AN, United Kingdom
• Email: info@maxbox.uk
• Phone: 0330 133 4188
• ICO registration number: ZC213324

ESEA INTERNATIONAL LTD is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Scope

This policy applies to personal data we collect through maxbox.uk, our subscription box builder, our membership programme, our retail shop, and any related customer service, marketing or account activity. We ship and provide services to customers in the United Kingdom, the European Union, and internationally.

3. Personal Data We Collect

3.1 Information you give us

• Account details: name, email address, delivery and billing address, phone number, password.
• Payment information: processed by our payment provider, Square. We do not store full card numbers on our own systems.
• Order and subscription details: items purchased, box type (MAX BOX, Healthy BOX, Happy BOX), delivery frequency, membership status, billing history.
• Pet profile information: your pet's name, age/date of birth, breed, and weight, provided when building a subscription box.
• Health concern questionnaire responses: the health-concern selections you make when building a box (e.g. skin, joint, digestive, urinary), used to generate product recommendations.
• Vet Assistance interactions: questions or information you submit to our in-house AI Vet Assistance feature.
• Customer service communications: emails, phone calls, or chat messages you send us.
• Marketing preferences: whether you have opted in to receive marketing emails.
• Reviews and content you submit, for example through our review platform.

3.2 Information we collect automatically

• Technical data: IP address, browser type and version, device information, operating system.
• Usage data: pages visited, time on site, referral source, interactions with the subscription box builder.
• Cookies and similar technologies, as described in Section 7 below.

4. How We Use Your Personal Data and Our Legal Basis

We only use your personal data where we have a valid legal basis to do so:

• Performance of a contract — to create your account, process orders, manage your subscription and membership, arrange delivery, and provide customer support.
• Legitimate interests — to generate product recommendations from your pet profile and health-concern answers, to prevent fraud, to improve our website and services, and to manage our business relationship with you.
• Consent — to send you marketing emails, to use non-essential cookies and tracking technologies (see Section 7), and where you have separately agreed.
• Legal obligation — to keep financial and tax records as required by UK law, and to respond to lawful requests from regulators or law enforcement.

Pet profile and health-concern data relate to your pet, not to an identifiable individual, and so does not constitute "special category" personal data about you under UK GDPR. We nonetheless treat this information with the same level of care and security as your other personal data.

5. Who We Share Your Data With

We share personal data only where necessary, with the following categories of recipients:

• Shopify — our e-commerce platform, which hosts our store and processes and stores order, account and store data.
• Appstle — our subscription management provider, used to manage recurring billing, pause/skip/swap and membership logic.
• Square — our payment processor, used to process payments securely.
• Rivo / Smile.io — our loyalty and rewards provider, used to track and redeem loyalty points.
• Judge.me — our product review provider.
• Klaviyo / Shopify Email — used to send marketing and transactional emails, where you have consented to marketing.
• Delivery and courier partners — to fulfil and deliver your orders.
• Professional advisers, auditors and regulators, where required by law.

Our AI Vet Assistance feature is developed in-house by MaxBox. Data you submit to it is processed on our own systems and is not shared with an external AI provider.

We do not sell your personal data to third parties.

6. International Data Transfers

Some of the third parties listed in Section 5, including Shopify, operate infrastructure outside the United Kingdom and European Economic Area. Where personal data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses, or the recipient's participation in an approved data protection framework.

7. Cookies and Similar Technologies

We use cookies and similar technologies on maxbox.uk, including:

• Strictly necessary cookies — required for the website, cart and checkout to function; these cannot be switched off.
• Analytics cookies — we use Google Analytics (GA4) to understand how visitors use our site and to improve our services.

Where cookies are not strictly necessary, we ask for your consent before they are set, in line with the Privacy and Electronic Communications Regulations (PECR) and current ICO guidance. Our cookie banner lets you "Accept all" or "Reject all" non-essential cookies with equal prominence, and you can change your preferences at any time via the cookie settings link on our website. Analytics cookies are retained for no longer than 13 months, after which your consent will be requested again.

8. Data Retention

We keep personal data only for as long as necessary for the purposes described in this policy:

• Account and order data: for as long as you hold an account with us, and for 6 years after your last transaction, to meet UK tax and accounting record-keeping requirements.
• Pet profile and health-concern questionnaire data: for as long as your account is active, and for up to 24 months after account closure or inactivity, in case you resubscribe, unless you ask us to delete it sooner.
• Marketing data: until you unsubscribe or withdraw consent.
• Cookie and analytics data: as set out in Section 7.
• Customer service correspondence: for up to 6 years, to handle any follow-up queries or disputes.

9. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your personal data, in certain circumstances.
• Request that we restrict or object to processing of your data.
• Request a portable copy of your data, in certain circumstances.
• Withdraw consent at any time, where processing is based on consent (e.g. marketing emails, non-essential cookies).

To exercise any of these rights, contact us at info@maxbox.uk or 0330 133 4188.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns directly first.

10. Children's Privacy

MaxBox is not directed at, and does not knowingly collect personal data from, individuals under the age of 18. We do not collect age data about account holders as part of registration. If you believe a child has provided us with personal data, please contact us and we will take appropriate steps to remove it.

11. Data Security

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration, including secure hosting through Shopify, encrypted payment processing through Square, and access controls on our internal systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of this page shows when it was last revised. Material changes will be notified via email or a notice on our website.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

• ESEA INTERNATIONAL LTD
• 71–75 Shelton Street, London WC2H 9JQ, United Kingdom
• Email: info@maxbox.uk
• Phone: 0330 133 4188
• ICO registration number: ZC213324