Privacy Policy

1. Who We Are

The Mega Mystery Box Company Ltd (“we”, “us”, “our”) is a company registered in England and Wales. We operate the website megamysteryboxcompany.co.uk and sell licensed merchandise mystery boxes online and at events across the UK.

We are the data controller for the personal information you provide when using our website or purchasing our products. We take our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 seriously.

2. Data We Collect

Information you give us

• Name and contact details — when you place an order or contact us
• Delivery address — to fulfil your order
• Email address — for order confirmations, updates and (with your consent) marketing
• Payment information — processed securely by Stripe, PayPal or Klarna; we do not store card details
• Box builder preferences — fandom choices, personalisation notes and gift messages you enter
• Account information — if you create a customer account

Information collected automatically

• IP address and browser data — via Shopify and our analytics tools
• Pages visited and time spent — to improve our website
• Device type and operating system
• Referring website — how you found us

3. How We Use Your Data

We use your personal data for the following purposes:

• To fulfil your order — processing payment, packing and shipping your mystery box (legal basis: contract performance)
• To communicate about your order — confirmations, dispatch notifications, delivery updates (legal basis: contract performance)
• To handle returns, refunds and complaints (legal basis: legal obligation / contract performance)
• To send marketing emails — only if you have opted in; you can unsubscribe at any time (legal basis: consent)
• To improve our website and products — using anonymised analytics data (legal basis: legitimate interests)
• To comply with legal obligations — tax records, fraud prevention (legal basis: legal obligation)

We will never use your data for purposes incompatible with the above without obtaining your prior consent.

4. Data Sharing

We do not sell your personal data. We share data only where necessary:

• Shopify Inc — our ecommerce platform (data processed under Shopify’s data processing agreement)
• Payment processors — Stripe, PayPal and Klarna process payment data under their own privacy policies
• Delivery carriers — Royal Mail and courier partners receive your name and address to deliver your order
• Analytics providers — Google Analytics (anonymised data only)
• Legal authorities — where required by law, court order or to protect our legal rights

All third parties are required to handle your data securely and in accordance with data protection law.

5. Data Retention

We retain your personal data for as long as necessary:

• Order records — 7 years (HMRC tax compliance requirement)
• Customer accounts — until you request deletion
• Marketing preferences — until you unsubscribe or request deletion
• Contact enquiries — 2 years

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access — request a copy of the data we hold about you
• Right to rectification — request correction of inaccurate data
• Right to erasure — request deletion of your data (“right to be forgotten”)
• Right to restrict processing — request we limit how we use your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent — withdraw marketing consent at any time

To exercise any of these rights, please contact us. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

7. Cookies

We use cookies to operate our website and improve your experience. Please see our Cookie Policy for full details.

8. Contact Us

For any privacy-related questions or to exercise your data rights, please use our contact form. We aim to respond to all data requests within 30 days.