Legal
Privacy & Cookies Notice
Last updated: 15 January 2026
This notice explains how ChhanaBox collects, uses and protects personal data. We take this seriously, and we have written it in plain English rather than legalese wherever possible.
1. Who we are
ChhanaBox ("we", "us") operates the website at www.chhanabox.com. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, ChhanaBox is the data controller for personal data collected through this website and our email list.
Contact for all data protection matters: hello@chhanabox.com
2. What personal data we collect
| Data | How we get it |
|---|---|
| Your first name (optional) and email address | You give it to us when you sign up for the free guide or newsletter |
| Email engagement data — whether emails are opened and links clicked | Collected automatically by our email provider when you receive our emails |
| Technical data — IP address, browser type, device type, pages visited | Collected automatically by our hosting provider and any analytics we use |
| Any information you choose to include in a message to us | You provide it when you email or message us |
| Your social media username, if you interact with us there | From the platform when you comment or message us |
We do not knowingly collect special category data (such as health data). Please do not send us sensitive personal information by email — email is not a secure channel.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Sending you the free guide and our newsletter | Consent — you opted in, and you can withdraw at any time |
| Replying to your messages | Legitimate interests — to respond to enquiries we receive |
| Keeping the website secure and working | Legitimate interests — to operate a safe, functional website |
| Understanding which content is useful | Consent (where cookies are used) or legitimate interests for aggregated, non-identifying statistics |
| Meeting legal obligations | Legal obligation |
Our email marketing is also governed by the Privacy and Electronic Communications Regulations (PECR). We only send marketing emails to people who have actively opted in, and every email contains a working unsubscribe link.
4. Who we share your data with
We do not sell your personal data. Ever. We share it only with service providers who process it on our behalf under contract:
- MailerLite — email marketing platform which stores our subscriber list and sends our emails. See the MailerLite privacy policy.
- Netlify — website hosting, which processes server logs including IP addresses. See the Netlify privacy policy.
- ManyChat — used to send automated replies to people who comment on our social media posts. See the ManyChat privacy policy.
- Social media platforms — Instagram (Meta) and TikTok, if you interact with us there. Those platforms are separate data controllers with their own policies.
We may also disclose data where we are legally required to do so.
5. International transfers
Some of our providers are based outside the UK, which may mean your data is transferred internationally. Where that happens, we rely on the safeguards permitted under UK GDPR — such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — so that your data continues to receive an equivalent level of protection.
6. How long we keep it
- Email subscribers: until you unsubscribe or ask us to delete your data. If you have not opened any of our emails for 24 months, we will generally remove you from the list.
- Email correspondence: normally up to 24 months after our last exchange.
- Server logs and technical data: retained by our hosting provider for a short period, typically no more than 30 days.
7. Your rights
Under UK GDPR you have the right to:
- Be informed about how your data is used — that's what this notice is for
- Access a copy of the personal data we hold about you
- Rectification — have inaccurate data corrected
- Erasure — ask us to delete your data ("the right to be forgotten")
- Restrict processing in certain circumstances
- Data portability — receive your data in a portable format
- Object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent at any time, without affecting processing carried out before you withdrew it
- Not be subject to solely automated decision-making with legal or similarly significant effects — we do not carry out any such decision-making
To exercise any of these rights, email hello@chhanabox.com with "Data request" in the subject line. We will respond within one month. There is normally no charge.
You can unsubscribe instantly at any time using the link at the bottom of any email we send.
8. Cookies and similar technologies
A cookie is a small text file stored on your device. We keep our use of them to a minimum.
| Type | Purpose |
|---|---|
| Strictly necessary | Required for the website to function and be secure. These do not require consent under PECR. |
| Functional | Set by our email signup provider (MailerLite) to make forms work correctly and avoid showing you the same form repeatedly. |
| Analytics | If enabled, used only to understand which pages are useful, in aggregate. We do not use cookies for advertising or cross-site tracking. |
You can block or delete cookies through your browser settings — see aboutcookies.org. Blocking some cookies may affect how parts of the site work.
9. Children
This website is intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
10. Security
We use reputable providers with appropriate technical and organisational security measures, including encryption in transit (HTTPS). No system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.
11. How to complain
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the UK supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 ·
ico.org.uk
12. Changes to this notice
We may update this notice from time to time. The "last updated" date at the top will always tell you when it last changed. Material changes affecting how we use your data will be communicated by email where appropriate.