Privacy policy

1. Who we are

The Build Your Business Freedom website and workshop booking service are operated by Verve Creative Solutions (Oxford) Limited, trading as Business Unboxed (“we”, “us” or “our”). We are the controller responsible for our use of the personal information described in this policy.

Registered in England and Wales. Company number: 07450884.

Registered office and contact address: 22 Marchwood, 8 Manor Road, Bournemouth, BH1 3EY, United Kingdom.

Privacy and booking enquiries: [email protected].

This policy covers the workshop website, enquiries, bookings and payments, and the optional Business Unboxed marketing described below. Separate programme purchases may have additional privacy information and their own booking terms.

2. Information we collect

Our checkout asks for your name, email address and phone number. We also process booking references, payment/refund status, correspondence and the information you choose to provide when contacting us.

We record separate email and SMS marketing choices and the information needed to demonstrate and honour those choices.

Through the tracking described in section 6, information may include website visits, page interactions, booking/conversion events, device/browser information, online identifiers and email-open/click activity. The actual event parameters and identifiers depend on the configured tools and permissions.

We use Stripe to process payments and refunds. Stripe handles payment and transaction information, while we receive the booking and transaction records needed to administer the purchase. See Stripe's Privacy Policy for its processing, including payment, fraud-prevention and legal-compliance purposes.

We do not ask for dietary, accessibility or health information through this booking process, and the workshop will not be recorded or streamed. Please do not submit patient records or other people's confidential information. Contact us before sending sensitive information so we can explain appropriate handling if needed.

3. Why we use information and our lawful bases

Enquiries, bookings and service messages

We use your information to respond to enquiries, take payment, manage your booking, provide venue details, deliver the workshop and deal with cancellations, refunds or problems.

Booking confirmations are sent by email and SMS. We also use the appropriate booking contact details for necessary administrative information and event changes. These communications are about delivering your booking, not permission for unrelated marketing.

Where the booking contract is with you personally, our lawful basis is taking steps at your request before entering into a contract and performing that contract. Where you act as a representative of a business making the booking, our lawful basis is our legitimate interest in arranging and delivering business bookings and communicating with the people involved.

Records, security and complaints

We use relevant information to maintain records, protect the service, prevent and investigate misuse, and respond to complaints or disputes. We rely on our legitimate interests in administering and securing the service and dealing fairly with problems. Where information is required for tax, accounting or another legal duty, we rely on the applicable legal obligation.

Optional marketing and tracking

For optional email/SMS marketing, we rely on your separate consent for each channel. For the optional analytics, advertising and email tracking described below, our proposed approach is consent appropriate to the particular processing, rather than treating a booking or general marketing opt-in as permission for every form of tracking.

Before publication: Set up and test the opt-ins and tracking choices described here. A written policy does not itself implement consent controls.

4. Email and SMS marketing choices

You can choose separately whether to receive Business Unboxed marketing by email and by SMS, including information about our workshops, programmes and business support.

These choices are optional. You can book and attend without agreeing to marketing. Supplying your phone number for a booking confirmation does not, by itself, give permission for marketing texts.

We will use only the marketing channels you select. You can unsubscribe from marketing emails, use the opt-out instructions in marketing texts, or contact [email protected]. Withdrawal does not affect earlier lawful processing or necessary booking communications.

You have the right to object to direct marketing at any time. We will stop using your information for that purpose when you object. We retain a minimal opt-out record where needed to prevent further unwanted marketing.

Email tracking is a separate matter, explained in section 6. Permission to receive emails is not automatically permission for tracking pixels.

5. Who receives information

Rachel Foord, Mick Betteridge and authorised Business Unboxed support personnel may access information needed for Business Unboxed workshops and programmes. Mick's use is for Business Unboxed purposes, not an independent personal or unrelated-business marketing list. Promotional contact remains subject to the choices described in this policy.

Our direct booking/CRM and payment providers are HighLevel (GHL) and Stripe. Their services may involve supporting processors, messaging providers, payment networks and other recipients described in their applicable terms and privacy information.

The confirmed tracking tools also involve Google and Meta receiving information. This is a form of data sharing even though they are not being given unrestricted access to the Business Unboxed booking database.

• HighLevel: Website/CRM, contact records, booking-related communications and configured email tracking. See its Data Processing Agreement.
• Stripe: Payments and refunds. Stripe also processes some information for its own purposes, as explained in its Privacy Policy; it does not act solely on our instructions for every use.
• Google: Google Analytics website measurement, subject to the applicable setup and permissions. See Google's Privacy Policy.
• Meta: Meta/Facebook Pixel and Conversions API advertising/conversion measurement, subject to the applicable setup and permissions. See Meta's Privacy Policy.

We may also disclose information where required by law or necessary to establish, exercise or defend legal claims. We have not added an unconfirmed agency, assistant or additional direct software provider to this policy.

6. Cookies, advertising and email tracking

Website analytics and advertising

We use Google Analytics, Meta/Facebook Pixel and Meta Conversions API to understand website activity and measure the relationship between advertising and workshop bookings, subject to the relevant permissions and configuration.

These tools may process online identifiers, device/browser information, page interactions and conversion events. Depending on the Conversions API setup, matching may include hashed contact identifiers such as email addresses or phone numbers. Hashing does not, by itself, make information anonymous.

Our proposed approach is to obtain consent for optional analytics and advertising tracking before using those tools for those purposes. Where storage/access technologies are used for online advertising, prior consent is required. We do not treat browsing, paying, accepting Booking Terms or reading this policy as that consent.

Email-open and click tracking

Our email tools support tracking whether an email was opened and which links were clicked. This can associate interactions with a contact and may involve tracking pixels, identifiers and linked activity.

We will explain the actual tracking and provide the relevant choice before using it where consent is required. A website cookie choice does not automatically cover an email pixel, and an email-marketing opt-in does not automatically cover every tracking use. If the relevant controls cannot be implemented, optional tracking requiring consent must not run without it, including in booking messages.

Your tracking choices

Declining optional tracking does not prevent you from booking or receiving essential booking information. Where consent is used, you can withdraw it using the relevant preference controls or by contacting us.

Complete before publication: Add the actual cookie/tracking notice and working preference controls. The notice must identify the technologies/providers, purposes, relevant data, cookie lifetimes or retention criteria, and how to change choices. Confirm the Pixel/CAPI event parameters, Google Analytics settings and email-tracking behaviour; do not leave this review notice on the public page.

7. Information processed outside the UK

Our providers operate internationally. Information may be processed outside the UK, including in the United States, and in other destinations described in the relevant provider arrangements.

Where UK rules require safeguards for a restricted transfer, an applicable route may be a UK adequacy arrangement, including the UK extension to the EU–US Data Privacy Framework where a certified recipient and the particular transfer are covered, or appropriate contractual safeguards such as approved clauses with the UK Addendum.

HighLevel, Stripe and Google publish information about relevant transfer arrangements in their DPA, transfer addendum and transfer-framework information. Meta explains its international processing in its Privacy Policy; the applicable business-tool transfer arrangements must also be checked.

Contact [email protected] for information about applicable safeguards and how to obtain a copy where available.

Complete before publication: Confirm the actual contracting entities, relevant destinations and applicable safeguards for this account's HighLevel, Stripe, Google Analytics and Meta business-tool processing. The provider-level routes above are not confirmation that every transfer in this setup uses a particular mechanism. Do not state that all data remains in the UK.

8. How long we keep information

Recommended schedule — Rachel's approval and practical implementation are still required. These periods are proposed operating defaults, not a claim that deletion rules are already configured in GHL.

Workshop booking administration: Normally 12 months after the workshop for contact details and routine correspondence, unless there is an ongoing issue or another documented reason to retain particular records. Financial evidence and minimal records needed for claims are treated separately.

Enquiries that do not lead to a booking: Normally six months after the last substantive enquiry or requested follow-up, unless you separately choose marketing or another continuing service.

Marketing contacts: Review at least annually. Remove from active marketing after two years without a meaningful interaction or renewed interest, or earlier if consent is withdrawn. A meaningful interaction can include a reply, new enquiry, booking or renewed permission; a passive email-open signal alone does not automatically restart the period.

Accounting and transaction records: Six years from the end of the company financial year they relate to, or longer where legally required. This does not mean retaining the entire CRM profile for six years.

Evidence of marketing/tracking consent: Keep while relied on and, where proportionately needed to demonstrate compliance or deal with a complaint or claim, retain a minimal restricted record for up to six years after the last use relying on that consent. Review the need annually; do not use this retained evidence to continue marketing.

Opt-out records: Keep the minimum needed to honour the objection for as long as there is a continuing risk of marketing the person again. Review when the relevant marketing activity ends. This is not permission to keep a full contact profile indefinitely.

Technical tracking data: Use the applicable documented cookie lifetimes and platform retention settings, to be specified in the completed tracking notice. Our retention defaults for booking contacts do not control Google, Meta or Stripe's separate processing.

We review records, delete or anonymise information no longer needed, and apply proportionate exceptions for an ongoing complaint, legal claim or obligation. Backup copies must be handled through the applicable secure deletion or beyond-use arrangements. An extension for a particular purpose must not become permission for further marketing.

9. Security and automated decisions

We use proportionate access and security measures to protect personal information and limit access to the people who need it for the stated purposes. No online system can be guaranteed completely secure.

We do not use solely automated decisions with legal or similarly significant effects to decide whether you can attend this workshop. Routine booking messages are not such decisions. Google and Meta may analyse activity under their own applicable notices and terms.

10. Your rights

Depending on the circumstances and lawful basis, you may have rights to access your information, correct inaccuracies, request deletion, restrict processing, object to processing, or receive and transfer certain information.

You can object to processing based on legitimate interests. You can object to direct marketing at any time. Where we rely on consent, you can withdraw it at any time.

Withdrawal does not make earlier lawful processing unlawful. Some records may still be needed for a separate lawful purpose, such as accounting obligations or honouring an opt-out.

To exercise a right, contact [email protected]. We may need proportionate information to verify identity and will respond within the applicable legal time limits, explaining any lawful restriction.

Name, email, phone and relevant payment information are required by our configured booking process to administer the booking and send the stated confirmations. Optional marketing and tracking consent are not a condition of attendance.

11. Complaints

If you are concerned about our use of personal information, contact [email protected] so we can investigate and respond.

You can also raise a concern with the UK data protection regulator, the ICO, at ico.org.uk/make-a-complaint. Contacting us does not remove that right.

12. Changes to this policy

We may update this policy when the service, processing or applicable requirements change. We will identify the current version and provide further information or seek fresh consent before a new use where required.