Legal
Privacy Policy
Last updated: 10 May 2026
Buy Box Savvy ("we", "our", "us") is committed to protecting your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains what data we collect, why we collect it, how we use it, and your rights as a data subject.
Data Controller
What Data We Collect
We collect the following categories of personal data:
- Contact data — name, email address, phone number, business name, when you submit our contact or free-audit form
- Listing data — Amazon ASINs and listing URLs you voluntarily share for our free appraisal or paid services
- Communication data — records of emails, messages, and call notes between us
- Technical data — IP address, browser type, device type, pages visited, anonymous usage analytics
- Cookies — see our Cookie Policy for details
Lawful Basis for Processing
We rely on the following lawful bases under Article 6 of the UK GDPR:
- Consent — for marketing emails, optional analytics cookies
- Contract — to deliver the services you've purchased
- Legitimate interest — for service improvement, fraud prevention, and responding to enquiries
- Legal obligation — for tax records, accounting, and regulatory compliance
How We Use Your Data
- To respond to your enquiries and provide your free appraisal
- To deliver the services you've commissioned
- To send service-related communications (project updates, invoices)
- With your consent, to send occasional educational content about Amazon UK selling
- To improve our website, service, and security
- To meet legal, accounting, and tax obligations
Third-Party Data Processors
We share personal data with the following processors, each under appropriate data processing agreements:
- Web hosting — Lovable / our hosting provider (UK/EU data centres)
- Email — our email provider for transactional communications
- CRM / form handling — GoHighLevel (where used)
- Analytics — privacy-respecting analytics provider (where consent granted)
We do not sell personal data to third parties.
Data Retention
- Contact form submissions: 24 months from last contact
- Active client data: duration of engagement plus 7 years for accounting compliance
- Marketing subscriber data: until you unsubscribe
- Anonymised analytics: 26 months
Your Rights Under UK GDPR
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure (the "right to be forgotten") subject to legal retention obligations
- Restrict or object to processing
- Data portability — receive your data in a structured format
- Withdraw consent at any time
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk
To exercise any of these rights, email info@buyboxsavvy.com. We respond within one calendar month.
International Transfers
Where data is transferred outside the UK, we ensure adequate safeguards under UK GDPR Article 46, typically via Standard Contractual Clauses or processors with UK adequacy decisions.
Security
We use technical and organisational measures including encrypted transmission (HTTPS), access controls, and regular security review to protect your data.
Changes to This Policy
We may update this policy. Material changes will be communicated via the website, with the "Last updated" date revised at the top.