GDPR Policy

1. Introduction

Directors Box Events Ltd (“Directors Box”, “we”, “us” or “our”) is committed to protecting and respecting your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Directors Box Events Ltd has its registered office at:

Directors Box Events Ltd
20 Wenlock Road
London
N1 7GU
United Kingdom

Directors Box Events Ltd is the data controller responsible for personal data that we process, except where we are acting as a processor on behalf of another organisation.

This GDPR Policy explains the lawful bases on which we process personal data, your rights as a data subject and how you can exercise those rights.

For further information about the personal data we collect, how we use it and how we protect it, please refer to our Privacy Policy.

2. Lawful Bases for Processing

Under the UK GDPR, we must have a lawful basis for processing your personal data. Depending on the circumstances, Directors Box may rely on one or more of the following lawful bases.

2.1 Contractual Necessity – Article 6(1)(b)

We may process personal data where this is necessary to enter into or perform a contract with you, or to take steps at your request before entering into a contract.

This may include:

  • Processing event and hospitality bookings
  • Managing customer and guest details
  • Processing ticket purchases
  • Processing payments and issuing invoices
  • Managing bookings and attendance
  • Providing services and products purchased from us
  • Communicating with you about your booking
  • Managing changes or cancellations to bookings

2.2 Legitimate Interests – Article 6(1)(f)

We may process personal data where it is necessary for our legitimate business interests, provided that those interests are not overridden by your rights and freedoms.

This may include:

  • Managing and administering our business
  • Maintaining customer and business records
  • Responding to enquiries
  • Improving our website, services and customer experience
  • Website analytics and usage analysis
  • Maintaining website and system security
  • Preventing fraud and misuse
  • Managing relationships with customers, suppliers and business partners
  • Communicating with existing customers about relevant services
  • Establishing, exercising or defending legal claims
  • Managing internal administration and business operations

Where we rely on legitimate interests, we will consider the nature of the processing and its potential impact on your rights.

2.3 Consent – Article 6(1)(a)

Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time.

Consent may be used for purposes including:

  • Sending promotional emails and marketing communications
  • Sending information about events, hospitality packages, offers and promotions
  • Using certain non-essential cookies and tracking technologies
  • Other activities where we specifically request your consent

Withdrawing consent does not affect the lawfulness of processing carried out before your consent was withdrawn.

2.4 Legal Obligation – Article 6(1)(c)

We may process personal data where necessary to comply with a legal or regulatory obligation.

This may include:

  • Tax and accounting requirements
  • Maintaining legally required financial records
  • Responding to lawful requests from government bodies, regulators or law enforcement authorities
  • Complying with applicable legislation
  • Meeting our legal obligations in relation to fraud, financial crime or other regulatory matters

3. Your Rights as a Data Subject

Under the UK GDPR, you have a number of rights in relation to your personal data. These rights are subject to certain conditions and exceptions under applicable law.

Right of Access

You can request a copy of the personal data we hold about you. This is commonly known as a Subject Access Request.

We will normally respond within one month of receiving a valid request and any information reasonably required to verify your identity.

Right to Rectification

You can ask us to correct personal data that you believe is inaccurate or incomplete.

Right to Erasure

You can ask us to delete your personal data in certain circumstances. This is sometimes referred to as the “right to be forgotten”.

This right is not absolute. We may be required to retain certain information to comply with legal obligations or to establish, exercise or defend legal claims.

Right to Restrict Processing

You may ask us to restrict the processing of your personal data in certain circumstances, including where you dispute the accuracy of information or have objected to certain processing.

Right to Data Portability

Where applicable, you may request personal data that you have provided to us in a structured, commonly used and machine-readable format.

Right to Object

You may object to certain processing where we rely on legitimate interests as our lawful basis.

You also have an absolute right to object to direct marketing.

Right to Withdraw Consent

Where we process your personal data based on consent, you can withdraw that consent at any time.

Rights Relating to Automated Decision-Making

You have rights in relation to decisions made solely through automated processing where those decisions produce legal or similarly significant effects.

Directors Box does not currently make decisions about individuals solely through automated processing that produce legal or similarly significant effects.

4. Exercising Your Rights

To exercise any of your data protection rights, please contact us at:

Email: info@directorsboxevents.co.uk

Directors Box Events Ltd
20 Wenlock Road
London
N1 7GU
United Kingdom

We may ask you to provide reasonable information to confirm your identity before releasing personal information or making changes to your records.

We will normally respond to a valid request within one calendar month.

Where a request is particularly complex or where you have made a number of requests, the response period may be extended by up to a further two months where permitted by the UK GDPR. If this applies, we will explain the reason for the extension.

5. Data Protection Officer

Directors Box Events Ltd has not appointed a formal Data Protection Officer where it is not legally required to do so.

However, all data protection questions, requests and concerns should be directed to:

Directors Box Events Ltd
20 Wenlock Road
London
N1 7GU
United Kingdom

Email: info@directorsboxevents.co.uk

We will ensure that data protection requests are handled appropriately and in accordance with applicable legislation.

6. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, taking into account our legal, accounting, contractual and operational requirements.

Our retention periods may include:

  • Customer and contact information: For the duration of our relationship with you and for an appropriate period afterwards where required for legal, accounting or legitimate business purposes.
  • Booking and transaction information: Normally for at least six years where required for accounting, tax and legal purposes.
  • Marketing information: Until you withdraw consent or otherwise unsubscribe, together with a record of your marketing preference where necessary to demonstrate compliance.
  • Website and analytics information: For periods appropriate to the purpose for which it was collected and in accordance with our relevant cookie and privacy policies.
  • Employment information: For the duration of the recruitment or employment relationship and for an appropriate period afterwards where required for legal or legitimate business purposes.

Retention periods may vary depending on the nature of the information and the circumstances in which it was collected.

When personal data is no longer required, we will take reasonable steps to securely delete, destroy or anonymise it.

7. Personal Data Breaches

Directors Box maintains procedures for identifying, assessing and responding to personal data breaches.

Where a personal data breach occurs, we will:

  • Assess the nature, scope and potential impact of the breach
  • Take reasonable steps to contain and resolve the breach
  • Investigate the circumstances surrounding the breach
  • Record the breach and actions taken
  • Notify the Information Commissioner’s Office where required by law
  • Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms

Where a breach is required to be reported to the ICO, we will normally notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

8. International Data Transfers

Some of the third-party technology, payment, communications, hosting or service providers we use may process personal data outside the United Kingdom.

Where personal data is transferred internationally, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place.

Depending on the circumstances, these safeguards may include:

  • A UK adequacy decision
  • The UK International Data Transfer Agreement
  • The UK Addendum to EU Standard Contractual Clauses
  • Other legally recognised transfer mechanisms or safeguards

9. Data Protection Impact Assessments

Where we introduce new processing activities or technologies that are likely to result in a high risk to individuals’ rights and freedoms, we will consider whether a Data Protection Impact Assessment (DPIA) is required.

Where a DPIA is required, we will assess the potential risks to individuals and identify appropriate measures to reduce or eliminate those risks before the relevant processing begins.

10. Third-Party Processors

Directors Box may use third-party service providers to process personal data on our behalf.

These may include providers of:

  • Website hosting
  • Website development and maintenance
  • Payment processing
  • Customer relationship management systems
  • Email and communications services
  • Marketing platforms
  • Event booking and ticketing systems
  • IT and technical support
  • Data storage and security services

Where a third party processes personal data on our behalf, we will take appropriate steps to ensure that the processor is subject to appropriate contractual obligations and processes information only in accordance with our instructions and applicable data protection law.

Further information about third parties with whom we share personal data is contained within our Privacy Policy.

11. Children’s Data

Our services are primarily intended for adults and businesses.

We do not knowingly collect personal data from children where there is no appropriate lawful basis for doing so.

If we become aware that we have collected personal information from a child in circumstances where it should not have been collected, we will take reasonable steps to investigate and delete the information where appropriate.

12. Complaints

If you believe that Directors Box Events Ltd has not handled your personal data appropriately, please contact us first so that we have an opportunity to investigate and resolve your concerns.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s independent regulator for data protection.

Information Commissioner’s Office (ICO)

Website: ico.org.uk

Telephone: 0303 123 1113

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

You can contact the ICO directly if you believe that your data protection rights have been infringed.

13. Changes to This Policy

We may update this GDPR Policy from time to time to reflect changes in our business, the personal data we process, technology, legislation or regulatory requirements.

The latest version will be published on our website.

Where changes are significant, we may also notify you directly where appropriate.

14. Governing Law

This GDPR Policy is governed by the laws of England and Wales.

Any disputes arising in connection with this policy shall be subject to the applicable jurisdiction of the courts of England and Wales, subject always to any mandatory rights or protections available to you under applicable data protection or consumer legislation.

Directors Box Events Ltd
20 Wenlock Road
London
N1 7GU
United Kingdom

Email: events@directorsboxevents.co.uk

Website: www.directorsboxevents.co.uk

Last updated: 20 August 2026