Privacy notice
Last updated: 2 November 2026
This notice explains how we collect and use personal information when you visit boxtick.uk, ask us for a website scan, register interest, or contact us about becoming a founding client or partner.
1. Who we are
BoxTick™ is a trading name of The Programme Group Limited, a company registered in England and Wales under company number 13511776, with its registered office at International House, 10 Churchill Way, Cardiff, CF10 2HE, Wales. Our VAT number is 386883725. We also trade as The Programme Group (TPG). In this notice, we, us and our mean The Programme Group Limited. We are the controller of the personal information described in this notice, which means we decide how and why it is used.
We are registered with the Information Commissioner's Office (ICO) under registration number ZC275135. For any question about this notice or your personal information, email hello@boxtick.uk or write to us at our registered office address above.
We have not appointed a Data Protection Officer, because the law does not require us to. Questions about personal information are handled by James Regan, a director of the company, who can be contacted at hello@boxtick.uk.
2. What information we collect
Information you give us through our forms
- Your work email address.
- For partner enquiries, your name, your organisation, the type of partner you are, the approximate number of business clients or members you have, and anything else you choose to tell us.
- If you ask for a results call, your name and the time that suits you.
- Your answers to our optional questions about how your business uses AI.
- The type of enquiry, such as a website scan, founding client place or partnership.
- The website address you submit for a scan.
- Whether you chose to receive BoxTick news and updates, the wording shown to you, and when you made that choice.
Information you give us when you contact us
If you email us, we keep your name, email address, the content of your message and our replies.
Information collected when you use the website
- Technical records of each request, including the time, page or service requested, whether it succeeded, and a request reference number.
- Your IP address, held briefly in server memory to prevent misuse of the forms. It is not saved with your enquiry or in our application request records.
We do not use advertising, social media or analytics cookies, and we do not track you across other websites. See our cookie notice for more detail.
Information about your organisation's website
When you ask for a website scan, we look only at information that is publicly available on, or about, the web address you submit, including its public pages and public DNS records. If a public web page includes the names or contact details of individuals, we use them only to prepare your scan results.
If you turn on monthly re-scans, we check your website once a month and email you only if something changes. You can stop at any time using the link in any re-scan email.
Do you have to give us this information?
No. You do not have to give us information. We need a work email address to respond to your enquiry and, for a scan, a website address. Without these details, we cannot reply or provide the scan.
3. How we use your information and our lawful bases
Data protection law requires us to have a lawful basis for each way we use personal information. These are the purposes, information and bases we rely on.
| What we use it for | Information used | Lawful basis |
|---|---|---|
| Responding to your scan, founding client or pilot enquiry | Email address, enquiry type, website address and correspondence | Taking steps at your request before entering into a contract |
| Responding to partner and other business enquiries | Email address, enquiry type and correspondence | Legitimate interests in responding to business enquiries |
| Preparing website scan results | Website address and publicly available information about it | Legitimate interests in providing the scan you asked for |
| Monthly re-scans you ask for | Email address and website address | Taking steps at your request |
| Anonymous statistics from scan results, such as how many websites show a privacy link | Website scan results with no personal information | Legitimate interests in understanding and reporting on common compliance gaps |
| Relevant outreach to corporate contacts who have not used our forms | Business contact details | Legitimate interests |
| Sending BoxTick news and updates | Email address and marketing choice | Your consent |
| Keeping the website secure, preventing misuse and fixing faults | Technical request records and IP address held briefly | Legitimate interests in running a secure and reliable website |
| Honouring an unsubscribe or objection | Email address, date and reason | Legal obligation and legitimate interests in not contacting you again |
| Handling complaints, legal claims and our legal duties | Any relevant information | Legal obligation or legitimate interests in defending our position |
Where we rely on legitimate interests, we have considered your rights and expectations and believe our use is reasonable for relevant business contact. You can ask us for more detail and you have the right to object.
Our marketing rules
- Emails about an enquiry you made are service messages, not marketing. We send them whatever your marketing choice.
- If you submit an enquiry, we only send you BoxTick news and updates if you tick the box to receive them. The box is never ticked in advance.
- We may email people at limited companies, limited liability partnerships and similar organisations who have not used our forms with relevant information about BoxTick, without asking first. Every such email identifies us and includes a simple way to unsubscribe. We only email sole traders and partnerships about BoxTick with their consent.
- You can unsubscribe or withdraw consent at any time using the link in any marketing email or by emailing hello@boxtick.uk.
We do not sell personal information or use it to build advertising profiles.
4. Who we share your information with
We share personal information only where needed and require the organisations that process it for us to protect it under written agreements.
- Replit hosts the website and the database that stores enquiries in the European Union region selected for BoxTick.
- Resend sends our service and marketing emails.
- Google Workspace provides our email, including the hello@boxtick.uk mailbox.
- Clerk provides secure sign-in for team members who manage enquiries. It does not receive information entered in our forms.
Our sub-processors page lists each provider, what it does, where it processes information and the safeguards in place.
We may also share personal information with:
- professional advisers, such as lawyers, accountants and insurers, where they need it to advise or protect us;
- the police, regulators, courts or other authorities, where the law requires it or to protect our rights; and
- a buyer, investor or successor organisation if all or part of our business is sold, transferred or restructured. They may use your information only in line with this notice.
International transfers
Some providers process information outside the UK, including in the United States. Where this happens, we use a transfer safeguard recognised by UK data protection law, such as the UK Extension to the EU-U.S. Data Privacy Framework where a provider is certified, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in the provider's data processing agreement. The safeguard used for each provider is listed on our sub-processors page. You can ask us for more information by emailing hello@boxtick.uk.
5. How long we keep your information
We keep personal information only for as long as we need it.
| Information | How long we keep it |
|---|---|
| Enquiries that do not lead to an agreement | 24 months from submission, then automatically deleted |
| Website scan results | 30 days, so you can view them online, then deleted. While monthly re-scans are on, we keep the latest results until you stop them. |
| Emails and other correspondence | 24 months from the last message, unless it relates to an agreement or complaint |
| Client and partner information | For the length of the agreement. After the agreement ends, customers can export Client Data for 30 days; TPG deletes it within 90 days after that period, including from backups as they are routinely overwritten, unless the law requires retention. For the future platform, database backups will use a rolling seven-day restore window. This does not extend the 30-day export period or the following 90-day deletion deadline. Contracts and invoices are kept for six years after the end of the financial year they relate to. |
| Unsubscribe and objection records | Kept for as long as we send marketing, so we can make sure we do not contact you again. We delete the rest of your enquiry record when you unsubscribe. |
| Technical request records | 30 days in Replit deployment logs. The application does not keep a separate copy. |
| IP addresses used to prevent form misuse | Up to 15 minutes in temporary server memory only |
| Complaints | 24 months after the complaint is closed |
How we keep your information secure
We use appropriate technical and organisational measures to protect personal information, including:
- encryption when information is sent to and from the website and when it is stored;
- access limited to named members of our team, who sign in securely;
- service providers bound by data processing agreements; and
- a process for identifying, recording and responding to personal data breaches, including notifying the ICO and affected people where the law requires it.
6. Your rights
You have the following rights over your personal information. Some apply only in certain circumstances.
- Access: ask for a copy of the personal information we hold about you.
- Correction: ask us to correct information that is wrong or incomplete.
- Deletion: ask us to delete your information.
- Restriction: ask us to limit how we use your information.
- Objection: object to our use of your information where we rely on legitimate interests. You can object to direct marketing at any time, and we will stop.
- Portability: ask for information you gave us in a reusable format where we rely on your consent or a contract.
- Withdrawing consent: withdraw consent at any time. This does not affect anything we did before you withdrew it.
To use these rights, email hello@boxtick.uk. You do not usually need to pay a fee. We will respond within one month. For a complex or multiple request, we may extend this by up to two more months and will tell you why. If we need information to confirm your identity or find what you are asking for, the time limit starts when we receive it. We will carry out reasonable and proportionate searches.
Automated decisions
We do not make decisions about individuals by automated means that have legal or similarly significant effects on them.
7. Complaints
If you are unhappy with how we have handled your personal information, please tell us first so we can try to put it right. Email hello@boxtick.uk with the subject line “Data protection complaint”, or follow our complaints procedure. We will acknowledge your complaint within 30 days, investigate it, keep you informed and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office:
- ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
8. The BoxTick platform
This notice covers the website, enquiries and marketing. When the BoxTick™ platform opens, client organisations will upload and connect information about their own business. The client will be the controller and we will act as its processor, using that information only on the client's instructions under a data processing agreement. The client's own privacy notice will explain how that information is used.
Our platform terms, data processing agreement and acceptable use policy were approved on 24 October 2026 and are published on this website. Before the platform opens, we will update this notice to cover the information we control when operating it, such as account, sign-in and billing details.
9. Children
This website and our services are for businesses and organisations. They are not aimed at children, and we do not knowingly collect information about children.
10. Changes to this notice
We review this notice regularly and update it when we change how we use personal information. The date at the top shows when it was last updated. If we make a significant change that affects you, we will tell you before it takes effect where we can.