Privacy Policy · Baba Box

1. Who we are

Baba Box Ltd ("Baba Box", "we", "us", "our") is a company registered in England and Wales (registered number [COMPANY NUMBER]). Our registered address is [REGISTERED ADDRESS], London.

We operate the website at baba-box.com (the "Site") and sell curated screen-free audio cards and companion products for children. We are the data controller for the personal information described in this policy.

If you have any questions about how we handle your personal information, please contact us at hello@bababox.co.uk.

We are registered with the Information Commissioner's Office (ICO) as a data controller. Our ICO registration number is [ICO REGISTRATION NUMBER]. You can verify this at ico.org.uk.

2. What we collect

Information you give us

Name and email address, when you place an order, create an account, or sign up for our newsletter.
Delivery address, when you purchase physical products (audio cards, books, accessories).
Payment information, processed directly and securely by our payment provider ([PAYMENT PROVIDER, e.g. Stripe]). We do not store your card details.
Your child's age or age range, when you use our recommendation tool ("Find my cards") or filter products by age. You choose to share this; we use it only to personalise your experience on the Site.
Your child's name, only if you voluntarily include it in correspondence with us. We do not ask for this on our standard forms.
Messages and enquiries, if you contact us by email or via any contact form.

Information we collect automatically

Cart and session data, stored locally in your browser (not on our servers) so your basket persists between visits.
Basic analytics, page visits, referrer, browser type, and approximate location (country/region level) if you consent to analytics cookies. See Cookies below.

Information we do not collect

We do not collect special category data (health, ethnicity, religion, etc.), financial account details, or government-issued identifiers. We do not build advertising profiles or sell personal data to third parties.

3. Children's data

Baba Box is designed for parents and caregivers purchasing on behalf of their children. Our Site is not directed at children, and we do not knowingly collect personal information from children under 13.

We do collect information about children from their parents or guardians. Specifically:

We may ask for a child's age or age range to help recommend appropriate audio cards. This is provided by a parent or carer, not the child themselves.
We may collect a child's name if a parent or carer provides it when contacting us, for example, to help resolve an order query.

We limit our collection of children's data to what is strictly necessary to provide our service. By entering your child's age or other details on our Site, you confirm you are the parent or guardian and consent to that information being used to personalise your experience.

You may request access to, correction of, or deletion of any information we hold about your child at any time by emailing hello@bababox.co.uk.

If you believe a child has provided us with personal information without parental consent, please contact us immediately and we will delete it promptly.

4. How we use your information

To process and fulfil your orders, including sending order confirmation and shipping updates.
To personalise product recommendations based on your child's age.
To respond to your enquiries and provide customer support.
To send you marketing emails about new tokens, products, and promotions, only if you have opted in. You can unsubscribe at any time.
To improve the Site and understand how visitors use it (analytics).
To comply with our legal and regulatory obligations, including tax record-keeping.
To detect and prevent fraud or misuse of our service.

5. Legal basis for processing

Under UK GDPR, we process your personal data on the following legal grounds:

Contract performance, processing your order, delivering products, handling returns.
Legitimate interests, fraud prevention, improving our Site, direct marketing to existing customers (where proportionate and where you have not opted out).
Consent, sending marketing emails to new subscribers; placing non-essential cookies (where applicable). You may withdraw consent at any time.
Legal obligation, retaining financial records for HMRC compliance.

6. Who we share your information with

We do not sell your personal data. We share it only where necessary with trusted service providers who are contractually bound to keep it secure:

Payment processing, [PAYMENT PROVIDER, e.g. Stripe Inc.] processes card payments. Your card details go directly to them; we never see or store them.
Email platform, [EMAIL PROVIDER, e.g. Mailchimp / Klaviyo] sends transactional and marketing emails on our behalf.
Shipping and fulfilment, we share your delivery address with our fulfilment partner to dispatch physical orders.
Analytics, if you consent to analytics cookies, anonymised usage data is processed by [ANALYTICS PROVIDER, e.g. Plausible / Google Analytics].
Legal requirements, we may disclose data if required by law, court order, or to protect the rights and safety of Baba Box or others.

Some of our service providers may process data outside the UK or EEA. Where this happens, we ensure appropriate safeguards are in place (such as UK International Data Transfer Agreements or Standard Contractual Clauses).

7. How long we keep your data

Order and financial records, 7 years from the date of purchase, as required by UK tax law.
Account information, for as long as you have an active account, plus 12 months after closure.
Marketing preferences and email history, until you unsubscribe or ask us to delete your data.
Customer service correspondence, 2 years from the last contact.
Children's age data, held only as long as necessary to provide the recommendation service; not retained beyond your session unless you have an account.

When data is no longer needed, we delete or anonymise it securely.

8. Cookies

Cookies are small files stored by your browser that help websites remember information about your visit.

Essential cookies (no consent required)

We use browser localStorage, a similar technology, to remember your shopping cart contents between pages and visits. This is essential for the site to work and cannot be disabled.

Analytics cookies (consent required)

We may use a privacy-friendly analytics tool to understand how visitors use the Site (e.g. which pages are most visited). These cookies collect anonymised data only. We will ask for your consent before placing them.

Marketing cookies

We currently do not place marketing or advertising cookies on this Site.

Managing cookies

You can disable or delete cookies through your browser settings at any time. Note that disabling essential storage may affect how the Site works. For more information, visit allaboutcookies.org.

9. Your rights under UK GDPR

As a UK resident, you have the following rights over your personal data. To exercise any of them, email us at hello@bababox.co.uk. We will respond within one month.

Right of access

Request a copy of the personal data we hold about you.

Right to rectification

Ask us to correct inaccurate or incomplete data.

Right to erasure

Ask us to delete your data where we no longer have a lawful reason to keep it.

Right to restriction

Ask us to pause processing your data in certain circumstances.

Right to portability

Request your data in a structured, machine-readable format to transfer elsewhere.

Right to object

Object to processing based on our legitimate interests, including direct marketing.

Right to withdraw consent

Where processing is based on consent (e.g. newsletters), withdraw it at any time.

Right to complain

Lodge a complaint with the ICO if you believe your rights have been infringed.

We will not charge you for exercising your rights unless a request is manifestly unfounded or excessive. In those cases, we may charge a reasonable fee or decline the request, and we will tell you why.

If you are based in the EU (not just the UK), EU GDPR also applies to our processing of your data. Your rights are equivalent; however, complaints may be directed to your local EU supervisory authority. A list can be found at edpb.europa.eu.

10. Contact us & how to complain

For any questions about this Privacy Policy or to exercise your rights, please get in touch:

Baba Box Ltd

Email: hello@bababox.co.uk

Post: [REGISTERED ADDRESS], London

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We may update this Privacy Policy from time to time. The "last updated" date at the top of the page will always reflect the most recent version. Significant changes will be communicated by email to registered users.