PRIVACY POLICY

Last updated: 27 July 2026

Box Menswear Limited respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, disclose, retain and protect personal information when you:

• Visit or use www.boxmenswear.com.
• Create or use a Box Menswear customer account.
• Place an order.
• Contact our customer-service team.
• Subscribe to email or SMS marketing.
• Interact with our advertising, social media or other online services.

This Policy applies to our unified Shopify store and the different countries and markets through which we sell.

1. Who We Are

Box Menswear Limited is the controller responsible for the personal information described in this Privacy Policy.

Box Menswear Limited
Company number: 11234601
Registered office: Unit 10 Compass West Industrial Park, Spindus Road, Speke, Liverpool, L24 1YA, United Kingdom
VAT number: GB185973942
Email: support@boxmenswear.com
Telephone: 0151 363 3241

In this Policy, “Box Menswear”, “we”, “us” and “our” refer to Box Menswear Limited.

UK data-protection law includes the UK GDPR and Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. The EU GDPR may also apply when we offer products to customers in the European Economic Area.

European Union representative

Where Article 27 of the EU GDPR requires us to appoint a representative in the European Union, you may contact our representative using the following details:

EU representative: [INSERT REPRESENTATIVE NAME]
Address: [INSERT EU ADDRESS]
Email: [INSERT EMAIL ADDRESS]

These details must be completed before publication if an EU representative is required.

2. What Personal Information We Collect

Depending on how you use our Website and services, we may collect the following information.

Identity and contact information

This may include:

• Your name.
• Billing address.
• Delivery address.
• Email address.
• Telephone number.
• Country or region.
• Any other contact information you provide.

Customer-account information

This may include:

• Your customer-account identifier.
• Login and authentication information.
• Saved addresses.
• Communication preferences.
• Account settings.
• Order history.
• Returns and refund history.

Authentication details may be processed through Shopify. We do not normally have access to your complete password or authentication credentials.

Order and transaction information

This may include:

• Products, sizes, colours and quantities ordered.
• Order number.
• Purchase date.
• Currency and market selected.
• Discounts and promotional codes.
• Delivery service.
• Order value.
• Payment status.
• Returns, exchanges and refunds.
• Previous purchases.

Payment information

Payments are handled by Shopify and our authorised payment providers.

Depending on your payment method, we may receive limited information such as:

• Payment status.
• Payment-provider reference.
• Card type.
• The final digits of a payment card.
• Billing address.
• Fraud or verification results.

We do not normally receive or store your complete payment-card number, card security code or full bank-account credentials.

Delivery and customs information

For international orders, we may process:

• Recipient name and address.
• Telephone number and email address.
• Order contents.
• Product descriptions.
• Product values.
• Country of origin.
• Tariff or commodity codes.
• Customs declarations.
• Tax or customs identifiers where required.
• Delivery tracking and confirmation.
• Information concerning failed, refused or disputed deliveries.

Communications

This may include information you provide when you:

• Contact customer support.
• Send an email or message.
• Submit a complaint.
• Exercise a privacy right.
• Leave a product review.
• Complete a survey.
• Participate in a promotion.
• Communicate with us through social media.

We may retain the content of communications and relevant attachments, photographs or supporting documents.

Marketing information

This may include:

• Email and SMS subscription status.
• Marketing preferences.
• Consent records.
• Unsubscribe requests.
• Messages sent, opened or clicked.
• Products or offers viewed.
• Campaign interactions.
• Advertising audiences to which you may have been assigned.

Technical information

When you access our Website, we and our service providers may collect:

• IP address.
• Device type.
• Browser type and version.
• Operating system.
• Language.
• Time zone.
• Approximate location derived from your IP address.
• Cookie and device identifiers.
• Referral source.
• Website activity.
• Error, performance and security logs.

Website-usage information

This may include:

• Pages and products viewed.
• Searches.
• Links selected.
• Basket activity.
• Checkout activity.
• Session duration.
• Abandoned baskets.
• Responses to website content and promotions.

Fraud and security information

We may process information used to prevent or investigate fraud, including:

• Payment and address verification results.
• IP address and device information.
• Transaction patterns.
• Previous payment or order disputes.
• Delivery information.
• Risk scores generated by Shopify, payment providers or fraud-prevention services.

Inferred information

We may use order and browsing information to make limited inferences about:

• Product interests.
• Likely sizing preferences.
• Preferred country, language and currency.
• Likelihood of responding to a particular promotion.
• Whether an interaction may present a fraud or security risk.

We do not intentionally infer or profile customers according to sensitive characteristics such as sexual orientation, ethnicity, religion, political beliefs, health or biometric information.

3. Information We Do Not Intentionally Collect

We do not intentionally request special-category information such as:

• Race or ethnicity.
• Religious or philosophical beliefs.
• Political opinions.
• Trade-union membership.
• Genetic or biometric information.
• Health information.
• Sexual orientation or information concerning a person’s sex life.

Please avoid sending sensitive information unless it is genuinely necessary for us to deal with your request.

Where sensitive information is voluntarily provided, we will only use it where there is a valid legal basis and it is necessary to handle the relevant communication or legal obligation.

4. How We Collect Information

We collect information:

Directly from you

For example, when you:

• Place an order.
• Create an account.
• Contact us.
• Subscribe to marketing.
• Submit a review.
• Complete a return or withdrawal request.
• Enter a competition.

Automatically

Information may be collected through:

• Cookies.
• Pixels.
• Tags.
• Scripts.
• Local storage.
• Device identifiers.
• Shopify analytics.
• Server and security logs.

From service providers

We may receive information from:

• Shopify.
• Payment providers.
• Delivery companies.
• Customs intermediaries.
• Customer-support platforms.
• Email and SMS providers.
• Advertising platforms.
• Analytics providers.
• Fraud-prevention providers.

From social-media and advertising platforms

Where you interact with our content or advertisements, the relevant platform may provide us with campaign, audience or engagement information in accordance with your settings on that platform.

5. How and Why We Use Personal Information

We must have a valid legal reason for processing personal information. The lawful basis depends on the particular purpose and circumstances. Consent is not generally required where processing is necessary to fulfil an order or comply with the law.

Where we rely on legitimate interests, our interests may include:

• Operating and improving our business.
• Providing customer service.
• Understanding how customers use our Website.
• Preventing fraud and misuse.
• Protecting customers, staff and our systems.
• Maintaining accurate business records.
• Establishing, exercising or defending legal claims.
• Promoting our products where permitted by law.

We consider whether these interests are necessary and balanced against your rights and interests.

Where we rely on consent, you may withdraw it at any time. Withdrawal will not affect processing that took place before consent was withdrawn.

6. Unified Store and Migration of Regional-Store Data

Box Menswear previously operated separate regional stores, including stores serving the United Kingdom, United States, European Union and other international destinations.

As part of our move to one unified Shopify store using Shopify Markets, we may transfer and combine information from our previous regional stores. This may include:

• Customer profiles.
• Contact details.
• Saved addresses.
• Order histories.
• Returns and refunds.
• Customer-support records.
• Fraud and security records.
• Marketing preferences and consent records.

We use this information to:

• Preserve customers’ order histories.
• Provide customer support.
• Operate one customer-account system.
• Fulfil legal, tax and accounting obligations.
• Prevent fraud.
• Avoid creating unnecessary duplicate customer records.
• Respect existing marketing subscriptions and opt-outs.

Moving information into the unified store does not create a new marketing consent. Existing unsubscribe and opt-out preferences should continue to be honoured.

Where duplicate customer profiles are identified, we may combine or remove duplicate records where it is reasonable and lawful to do so.

7. Shopify and Shopify Markets

Our Website and online store are hosted through Shopify.

Shopify processes customer information to provide services including:

• Store hosting.
• Checkout.
• Customer accounts.
• Payment processing.
• Order administration.
• Fraud prevention.
• Analytics.
• Customer privacy controls.
• Market and currency localisation.

Depending on the service, Shopify may act as our processor, service provider or as a separate controller for certain Shopify-operated services.

Shopify may use a visitor’s location and device information to help determine the appropriate country, market, language, currency, tax treatment and Website experience.

Shopify provides market-specific privacy tools, including regional cookie banners and data-sharing opt-out pages. Merchants remain responsible for ensuring that these settings accurately reflect their store, installed applications and third-party tracking technologies.

8. Email and SMS Marketing

Where you subscribe or where otherwise permitted by applicable law, we may send:

• Product news.
• Promotions.
• Restock alerts.
• Abandoned-basket reminders.
• Personalised offers.
• Invitations to participate in surveys or promotions.

You can unsubscribe from marketing emails by selecting the unsubscribe link in the relevant email.

You can unsubscribe from SMS marketing by replying STOP, using any available unsubscribe link or contacting us.

You may also contact support@boxmenswear.com to update your preferences.

Stopping marketing will not prevent us from sending necessary service messages, including:

• Order confirmations.
• Dispatch and delivery updates.
• Payment notifications.
• Customer-support responses.
• Product-safety notices.
• Changes affecting an existing order.

We may retain a minimal suppression record after you unsubscribe so that we can continue to respect your request.

Electronic marketing is also subject to the Privacy and Electronic Communications Regulations and equivalent rules in other countries.

9. Cookies and Similar Technologies

We use cookies and similar technologies to operate, secure and improve our Website.

These technologies may include:

• Cookies.
• Tracking pixels.
• Scripts and tags.
• Local storage.
• Device identifiers.
• Link tracking.
• Similar storage or access technologies.

They may be used for:

Essential purposes

These include:

• Keeping the Website operational.
• Remembering your basket.
• Processing checkout.
• Authenticating customer accounts.
• Preventing fraud.
• Remembering privacy choices.
• Maintaining security.

Functional purposes

These may include remembering:

• Country.
• Currency.
• Language.
• Display settings.
• Previous selections.

Analytics purposes

These help us understand:

• How the Website is used.
• Which pages and products are viewed.
• Whether Website features are working.
• How customers move through checkout.

Advertising purposes

These may be used to:

• Measure advertising campaigns.
• Limit repeated advertisements.
• Create advertising audiences.
• Show advertising based on Website interactions.
• Understand whether advertisements led to a purchase.

Where consent is required, non-essential cookies and similar technologies will not be used until you have made an appropriate choice through our cookie banner.

You can change your choices using the cookie or privacy-settings link available on the Website.

Some essential and limited low-risk technologies may be used without consent where permitted by applicable law. The UK rules cover cookies, tracking pixels, device fingerprinting, local storage, scripts and similar technologies.

Further information is available in our separate Cookie Policy.

10. Who We Share Personal Information With

We share information only where reasonably necessary for the purposes described in this Policy.

Recipients may include the following.

Shopify and ecommerce providers

This includes Shopify and services integrated with our Shopify store.

Payment providers

Depending on the payment method selected, this may include providers such as:

• Shopify Payments.
• PayPal.
• Klarna.
• Clearpay.
• Apple Pay.
• Card networks and issuing banks.

Delivery and fulfilment providers

This may include:

• Royal Mail.
• DHL.
• USPS and local delivery partners.
• International postal operators.
• Customs brokers.
• Returns providers.
• Warehousing and fulfilment providers.

The provider used will depend on the delivery destination and service.

Customs, tax and regulatory authorities

International orders may require us to provide recipient and order information to:

• Customs authorities.
• Tax authorities.
• Postal authorities.
• Import or export intermediaries.
• Government agencies.

Customer-service providers

We may use customer-service, helpdesk and communication platforms to manage enquiries and support tickets.

Marketing and communication providers

Where used, these may include providers that help us deliver:

• Email.
• SMS.
• Reviews.
• Surveys.
• Loyalty services.
• Customer segmentation.
• Marketing campaigns.

Analytics and advertising providers

Subject to applicable consent requirements, these may include services provided by organisations such as:

• Google.
• Meta.
• TikTok.
• Other advertising, analytics and social-media platforms.

Fraud and security providers

We may share transaction and device information with organisations that help us:

• Detect fraudulent payments.
• Verify transactions.
• Prevent account misuse.
• Protect our Website and customers.

Professional advisers

This may include:

• Accountants.
• Auditors.
• Lawyers.
• Insurers.
• Tax advisers.
• IT and security consultants.

Law enforcement and public authorities

We may disclose information where required by law or where reasonably necessary to:

• Respond to a valid legal request.
• Prevent or investigate crime.
• Protect legal rights.
• Protect the safety of customers, staff or others.

Business transfers

If our business or assets are sold, transferred, reorganised or merged, relevant personal information may be disclosed to advisers, prospective purchasers and the new owner.

We require service providers handling information on our behalf to protect it and use it only for permitted purposes.

11. International Transfers

Some organisations that process information for us operate outside the United Kingdom or European Economic Area.

For example, Shopify operates globally and may process information through affiliated companies and service providers in countries including Canada, the United States and Singapore. Shopify states that its international transfers are governed by appropriate contractual and organisational safeguards.

When personal information is transferred internationally, we use one or more appropriate safeguards where required, such as:

• A country covered by an applicable adequacy regulation or decision.
• The UK International Data Transfer Agreement.
• The UK Addendum to approved standard contractual clauses.
• European Commission Standard Contractual Clauses.
• Approved binding corporate rules.
• Another legally recognised transfer mechanism.
• A specific legal exception where appropriate.

We may also transfer information to delivery providers or customs authorities in the destination country where necessary to deliver your order.

International-transfer rules apply where personal information is sent or made accessible to a separate organisation outside the relevant territory.

You may contact us for further information about safeguards used for a particular transfer.

12. Fraud Prevention and Automated Processing

We and our payment, ecommerce and fraud-prevention providers may use automated tools to assess whether an order or account presents a potential fraud or security risk.

These tools may consider information such as:

• Payment verification.
• IP address.
• Device information.
• Billing and delivery addresses.
• Order value.
• Previous transactions.
• Transaction patterns.
• Chargeback or dispute history.

A risk assessment may result in:

• Additional verification.
• An order being reviewed.
• A payment being declined by the payment provider.
• An order being delayed or cancelled.
• Restrictions being applied to an account.

We do not intend to make solely automated decisions that have legal or similarly significant effects on you unless the processing is permitted by law and appropriate safeguards are provided.

You may contact us to request further information or human review where you believe a significant decision has been made solely through automated processing.

13. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, tax, customs, fraud-prevention and dispute-resolution requirements.

The retention period depends on:

• The type and sensitivity of the information.
• Why it was collected.
• Whether the purpose can be achieved without retaining it.
• Applicable legal requirements.
• Limitation periods for legal claims.
• Fraud and security risks.

Our general approach is:

Order, financial and tax records

Order, payment-status, invoice, refund, tax and relevant customs records are normally retained for at least six years, or for a longer period where an applicable tax or customs scheme requires it. UK VAT records generally must be retained for at least six years.

Customer accounts

Account information is retained while the account remains active and for a reasonable period afterwards.

Closing an account does not necessarily delete information that we must retain for orders, taxes, fraud prevention or legal claims.

Customer-service communications

Customer-service records are retained for as long as necessary to resolve the enquiry and for a reasonable period afterwards in case of follow-up, complaint or dispute.

Marketing information

Marketing contact information is retained while you remain subscribed.

Where you unsubscribe, we may retain limited information on a suppression list so that we do not contact you again contrary to your preference.

Fraud and security records

Fraud, chargeback and security information may be retained for as long as reasonably required to protect our business and customers, investigate incidents and manage legal claims.

Cookies and analytics

Cookie and analytics retention periods depend on the relevant technology and provider. Further information is available through our cookie settings and Cookie Policy.

When information is no longer needed, we will delete it, anonymise it or securely restrict its use.

14. How We Protect Personal Information

We use reasonable technical and organisational measures designed to protect information against:

• Unauthorised access.
• Accidental loss.
• Misuse.
• Alteration.
• Disclosure.
• Destruction.

Measures may include:

• Restricted staff access.
• Access controls and authentication.
• Encryption where appropriate.
• Secure payment processing.
• Staff confidentiality obligations.
• Security monitoring.
• Backup and recovery procedures.
• Procedures for dealing with suspected personal-data breaches.

No internet transmission or storage system can be guaranteed to be completely secure. You should protect your customer-account details and contact us if you suspect unauthorised access.

15. Your Privacy Rights

Depending on your location and the applicable law, you may have the right to:

• Be informed about how your information is used.
• Request access to your personal information.
• Request correction of inaccurate or incomplete information.
• Request deletion of your information.
• Request restriction of processing.
• Object to particular processing.
• Withdraw consent.
• Receive certain information in a portable format.
• Object to direct marketing.
• Request safeguards concerning significant automated decisions.
• Complain to a data-protection authority.

Some rights are subject to limitations and exemptions. For example, we may need to retain information to comply with tax law, complete an order, prevent fraud or defend a legal claim.

To exercise a right, contact support@boxmenswear.com.

Please include:

• Your name.
• The email address associated with your account or order.
• Details of the request.
• Any relevant order number.

We may need to request information to verify your identity.

We will normally respond within one month, subject to any extension permitted for complex or numerous requests. Information about individual rights must be provided clearly and access requests are generally free of charge, although the law permits limited exceptions for manifestly unfounded or excessive requests.

16. Data-Protection Complaints

You may complain directly to us if you are unhappy with how we have collected, used, disclosed or otherwise handled your personal information.

Send your complaint to:

Email: support@boxmenswear.com
Subject: Data Protection Complaint

Or write to:

Box Menswear Limited
Unit 10 Compass West Industrial Park
Spindus Road
Speke
Liverpool
L24 1YA
United Kingdom

Please include:

• Your name and contact information.
• Details of your concern.
• Relevant dates.
• Any relevant order or account information.
• The outcome you are seeking.

We will:

• Acknowledge receipt within 30 days.
• Take appropriate steps to investigate without undue delay.
• Keep you reasonably informed.
• Tell you the outcome without undue delay.

These complaint-handling requirements have applied to UK organisations since 19 June 2026 under the Data (Use and Access) Act 2025.

Complaints to a regulator

You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator.

We would appreciate the opportunity to address your concern first, but you are not required to obtain our permission before contacting the regulator.

If you live in the European Economic Area, you may also have the right to complain to the data-protection authority in the country where you live or work, or where you believe an infringement occurred.

17. Additional United States Privacy Rights

Residents of certain US states may have additional rights, depending on the applicable law and whether Box Menswear meets the relevant legal thresholds.

These rights may include:

• Accessing personal information.
• Correcting inaccurate information.
• Deleting personal information.
• Receiving a portable copy.
• Opting out of targeted advertising.
• Opting out of the sale or sharing of personal information.
• Appealing a refusal to act on a request.

We do not sell personal information in exchange for money.

However, the use of some advertising cookies, pixels or audience services may be treated as “selling”, “sharing” or targeted advertising under certain US state laws.

Where applicable, you can submit an opt-out through the “Your Privacy Choices” or “Do Not Sell or Share My Personal Information” link available in the Website footer.

You may also contact support@boxmenswear.com.

Shopify provides a data-sharing opt-out page that can be configured for markets where these rights apply.

18. Children

Our Website and Products are not directed at children under 16.

We do not knowingly collect personal information from children under 16 without appropriate authorisation.

If you believe a child has provided us with personal information, contact us so that we can investigate and take appropriate action.

19. Third-Party Websites and Services

Our Website may contain links to third-party websites, social-media platforms and services.

We do not control how those third parties independently collect and use personal information.

You should review the privacy policies of any third-party website or service before providing information to it.

20. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to:

• Our Website.
• Shopify or installed applications.
• Our markets and delivery services.
• Our business practices.
• Applicable laws.
• The way we collect or use personal information.

The updated version will be published on this page with a revised “last updated” date.

Where a change materially affects how we use personal information, we will take reasonable steps to provide additional notice where required.

Previous versions may be retained for legal and record-keeping purposes.

21. Contact Us

For questions about this Privacy Policy, privacy rights or the handling of your information, contact:

Box Menswear Limited
Unit 10 Compass West Industrial Park
Spindus Road
Speke
Liverpool
L24 1YA
United Kingdom

Email: support@boxmenswear.com
Telephone: 0151 363 3241