Privacy statement

This is an English translation for your convenience. The Dutch version of this privacy statement is legally binding; in the event of any discrepancy between the two versions, the Dutch text prevails.

Version: August 2026

1. Who is responsible for your data?

City in a Box, trading as Utrecht in a Box, is the data controller for the processing activities described in this statement.

City in a Box
Pieter Calandlaan 359, 1068 NJ Utrecht, the Netherlands
Chamber of Commerce number: 72610387
Email: info@utrechtinabox.nl
Phone: +31 30 237 84 44

2. What data do we process, why and on what legal basis?

Quote and contact requests

If you fill in the contact or quote form, or email or call us, we process your name, company name, email address, phone number and the content of your message.

• Purpose: answering and handling your request and preparing a quote.
• Legal basis: performance of an agreement, or taking steps at your request prior to entering into an agreement (Article 6(1)(b) GDPR).

Orders

If your organisation places an order, we process company and contact details (name and contact details of the contact person), the invoice and delivery address(es), the order details and the payment status.

• Purpose: fulfilling and delivering the order, invoicing and keeping our records.
• Legal basis: performance of the agreement; for the financial records, also a legal obligation (the statutory tax retention duty).

Without the data required for an order, we cannot perform the agreement.

Address lists for home delivery

If you choose home delivery to separate addresses, you provide us with an address list containing the name and address details of your employees or contacts. We process this data solely to deliver the gifts to the addresses provided; we do not use it for other purposes and do not approach the recipients ourselves.

As the supplying party, you guarantee that you are lawfully entitled to provide this data to us and that you have informed the data subjects about this disclosure where required.

• Purpose: delivery of the ordered gifts.
• Legal basis: our legitimate interest in being able to perform the agreement with our customer.

Website visits and statistics

On utrechtinabox.nl we use Google Analytics for statistics on website usage, and Leadinfo to identify, based on IP address, which companies visit our website.

• Purpose: insight into website usage, improving the website and our services to business visitors.
• Legal basis: our legitimate interest in analysing and improving our website and B2B services.

More about the cookies and similar techniques used can be found in our cookie policy.

3. Who do we share personal data with?

We do not sell your data. We only share personal data with parties needed to make our website and services work:

• Supabase - database and hosting of order data;
• Mollie - processing of online payments (including iDEAL);
• Lovable - hosting of the website and sending transactional emails, such as order confirmations;
• CiabOS - our back-office system for order processing and fulfilment; receives order and delivery data, including uploaded address lists;
• Leadinfo - identification of business website visitors;
• Google - Google Analytics (website statistics).

In addition, the carriers who deliver the parcels receive the name and address details needed for delivery, and we may provide data to authorities where we are legally required to do so.

We have entered into data processing agreements with parties that act as processors on our behalf. Where personal data is transferred to countries outside the European Economic Area - for example to Google in the United States - this is done on the basis of an adequacy decision of the European Commission or safeguarded by EU standard contractual clauses.

4. How long do we keep your data?

• Order data and invoices: 7 years, under the statutory tax retention duty.
• Contact and quote requests that do not lead to an order: a maximum of 12 months after handling.
• Uploaded address lists for home delivery: deleted no later than 3 months after delivery.
• Analytics data: in accordance with the retention settings of the relevant service (Google Analytics, Leadinfo).

5. How do we secure your data?

We take appropriate technical and organisational measures to protect personal data against loss and unlawful processing, tailored to the nature of the data. This includes encrypted connections (https), restricted access to systems and payments via a certified payment provider. If you suspect misuse of data or a data breach, please contact us immediately at info@utrechtinabox.nl.

6. Your rights

You have the right to access the personal data we process about you, and the right to rectification, erasure, restriction of processing and data portability. You may also object to processing based on our legitimate interest.

Send a request to info@utrechtinabox.nl, preferably from the email address known to us - this allows us to verify that the request comes from you. We do not ask for a copy of your ID. You will receive a response within one month; for exceptionally complex requests we may extend this period by two months and will let you know within the first month.

If you are not satisfied with how we handle your data or your request, you have the right to lodge a complaint with the Dutch Data Protection Authority.

We do not make decisions based solely on automated processing that have legal effects on you or otherwise significantly affect you.

7. Cookies and similar techniques

Which cookies and similar techniques utrechtinabox.nl uses, and how you can manage them, can be found in our cookie policy.

8. Changes

We may amend this privacy statement, for example when our services or legislation change. The current version is always available at utrechtinabox.nl/privacy; the version date can be found at the top of this statement.

9. Contact

Questions about this privacy statement or your data? Get in touch via info@utrechtinabox.nl or +31 30 237 84 44.