Affiliate Programme Privacy Policy

Last updated: April 2026

1. Who We Are

Buxumbox Bike Boxes ("we", "us", "our") operates the Buxumbox Affiliate Programme. We are the data controller in respect of personal data collected through this Programme.

For any privacy-related queries, contact us at: marketing@buxumbox.com

2. What Data We Collect

When you apply for or participate in the Programme, we may collect and process the following personal data:

• Identity data – your name, username, or social media handle
• Contact data – email address, country of residence
• Payment data – bank account details, PayPal address, Wise account, or other payment information necessary to process your commissions
• Performance data – orders attributed to your affiliate code, commission earned, payout history
• Communications – any correspondence between you and Buxumbox Bike Boxes

We do not collect sensitive personal data (such as health data, ethnicity, or political opinions) through the Programme.

3. How We Use Your Data

We use your personal data for the following purposes:

We will not use your data for purposes incompatible with those listed above without your prior consent.

4. Marketing Communications

If you opt in, we may send you occasional updates about the Programme, new products, or promotional campaigns relevant to your role as an affiliate. You can withdraw consent for marketing communications at any time by contacting us at marketing@buxumbox.com or using the unsubscribe link in any email we send.

Withdrawing consent will not affect the lawfulness of processing carried out prior to withdrawal.

5. Who We Share Your Data With

We do not sell your personal data. We may share it with trusted third parties only where necessary:

• Payment processors (e.g. PayPal, Wise, banking providers) – to facilitate commission payments
• IT and platform providers – who host or support our affiliate tracking systems, subject to data processing agreements
• Legal or regulatory authorities – where we are required to do so by law

All third parties are required to handle your data securely and in accordance with applicable data protection law.

6. International Data Transfers

As the Programme is open globally, your data may be transferred to and processed in countries outside the UK or European Economic Area. Where this occurs, we take appropriate steps to ensure your data remains protected to an equivalent standard, including relying on:

• UK International Data Transfer Agreements (IDTAs), or equivalent adequacy mechanisms
• Standard Contractual Clauses where applicable

If you have questions about the specific safeguards in place for your data, please contact us.

7. How Long We Keep Your Data

We retain your personal data for as long as your participation in the Programme continues, and for a period thereafter as required by our legal and financial obligations — typically 6 years in line with UK tax and accounting requirements.

Where data is no longer required, we will securely delete or anonymise it.

8. Your Rights

Depending on your country of residence, you may have rights in relation to your personal data. Under UK GDPR, these include:

• Access – request a copy of the data we hold about you
• Rectification – ask us to correct inaccurate or incomplete data
• Erasure – ask us to delete your data in certain circumstances
• Restriction – ask us to limit how we process your data
• Portability – request your data in a structured, machine-readable format
• Objection – object to processing based on legitimate interests
• Withdrawal of consent – where processing is based on consent

To exercise any of these rights, contact us at marketing@buxumbox.com. We will respond within 30 days. We may need to verify your identity before processing a request.

If you are based in the UK and are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. If you are based in the EU or elsewhere, you may have the right to complain to your local supervisory authority.

9. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. However, no method of transmission or storage is entirely secure, and we cannot guarantee absolute security.

10. Cookies & Tracking

Our affiliate tracking system may use cookies or similar technologies to attribute orders to your affiliate code. These are functional in nature and strictly necessary for the Programme to operate. Where we use any additional tracking, this will be covered by the main Buxumbox website Privacy Policy.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email. The "last updated" date at the top of this page will always reflect the most recent version.

12. Contact

Buxumbox Bike Boxes marketing@buxumbox.com