# ONEBOX Privacy Notice\nEffective 13 September 2026.\n\nONEBOX processes customer contact details, service addresses and booking/support history; provider business details, service areas and verification evidence; authentication/security data; and payment references. Stripe handles full card details.\n\nWe use information to arrange and perform bookings, process payments/refunds, verify providers, prevent fraud, provide support, secure and improve ONEBOX, comply with accounting/tax/platform-reporting duties and establish or defend legal claims. Lawful bases include contract, steps before contract, legal obligation, legitimate interests and consent where specifically required.\n\nData may be shared with the customer/provider involved in a booking and with service providers including Stripe, Supabase, Netlify and email-delivery providers, plus advisers or authorities where necessary. Customer phone/address details are not released merely because a provider receives an offer; they are made available for an accepted booking and access can be removed after completion.\n\nONEBOX also uses first-party product analytics to understand platform usage and improve the service. Optional Google Analytics is only loaded after you choose Accept analytics. Google Analytics may then use first-party analytics cookies and collect information such as page viewed, approximate location, device/browser information and referral/source data. ONEBOX has disabled Google signals and advertising-personalisation signals in its Google Analytics configuration. We use this optional analytics on the basis of consent.\n\nYour analytics choice is stored in your browser so ONEBOX can remember it. You can change or withdraw that choice at any time using the Privacy choices control shown on the website. If you withdraw analytics consent, ONEBOX stops further Google Analytics collection in that browser and attempts to remove ONEBOX Google Analytics cookies accessible from the site. Essential authentication, security and transaction storage is separate and is not disabled by rejecting analytics.\n\nCore transaction and contractual records may be retained for up to 6 years where needed. Unsuccessful provider evidence will normally be reviewed for deletion after 12 months. Suppression records may be retained to respect marketing objections.\n\nONEBOX uses rule-based matching using factors such as category, area, verification, availability, previous successful provider, rating and completed jobs. Providers remain free to accept or decline and administrators can intervene.\n\nYou may have rights to access, correct, erase, restrict, object and data portability, plus an absolute right to object to direct marketing. Contact oneboxservicesuk@gmail.com. You may also complain to the ICO at ico.org.uk.
Questions: oneboxservicesuk@gmail.com