Data Retention and Deletion Policy
Last updated: 5 November 2026
Version: 2.0
1. Scope
This Data Retention and Deletion Policy explains how Mrs Samantha Allonby trading as Boxed Events retains, reviews, deletes or anonymises personal data collected through BOXXED and related services. Please read it with our Privacy Policy.
2. Technology Provider Records
NibbleKit and other service providers may retain platform copies, logs, backups, diagnostics, support records and security records on our behalf or for limited provider purposes. We are responsible for the retention of customer records we control.
3. Retention Principles
We keep personal data only for as long as reasonably needed for the purposes for which it was collected, including order fulfilment, food-safety records, accounting, tax, legal claims, customer support, fraud prevention, security, consent management and compliance. We may delete, anonymise, aggregate, archive or restrict data when it is no longer needed.
4. Standard Retention Schedule
Unless a longer or shorter period is required by law, dispute, investigation, legal hold or documented operational need, our standard approach is:
- customer account and profile data: while the account remains active, then deleted or anonymised after account closure once no longer needed;
- order, refund, chargeback and payment records: normally retained for up to six years for accounting, tax, contract and legal-claims purposes;
- payment card details: not stored by us in full; payment providers may retain tokens, transaction references and compliance records under their own rules;
- saved allergy, dietary or health-related preferences: retained while the feature or account is active and removed on account deletion unless needed for an active order, dispute or legal duty;
- support, complaint and data-request records: retained for as long as needed to respond and then for a reasonable period to evidence handling, usually up to six years for significant disputes;
- marketing consent and suppression records: retained while marketing continues and afterwards as needed to respect opt-outs;
- security, audit, authentication, device, fraud and diagnostic logs: retained for a limited period appropriate to security and abuse prevention, with longer retention where suspicious activity, incidents or legal claims require it;
- backup copies: retained for the normal backup cycle and overwritten or deleted in due course. Firebase says deleted authentication data is removed from its live and backup systems within 180 days of its customer initiating deletion;
- anonymous or aggregated data: may be retained for analytics, service improvement and reporting where it no longer identifies an individual.
We do not apply a blanket seven-year period to closed profiles. Where a record must be kept after an account closes, we limit it to what is needed for the relevant purpose and restrict access. An opt-out record may remain so we can continue to respect your choice.
5. Account Deletion
Account deletion closes ordinary account access and removes or anonymises profile information that is no longer needed. It may not immediately remove records needed for accepted orders, refunds, chargebacks, tax, accounting, fraud prevention, safety, legal holds, regulatory duties, complaints, support history or backups awaiting expiry.
Use Delete Account in the BOXXED app profile or send a data request if you cannot sign in. Withdrawing consent for a saved allergy answer removes it from future orders; it does not rewrite earlier order records. Minimal consent evidence may be retained separately where necessary to show when consent was given or withdrawn. Backups are removed on their normal cycle; retained data is not returned to ordinary use merely because a backup is restored.
6. Privacy Rights
You may request deletion, restriction, correction, access or portability using our Privacy Rights and Data Protection Requests page. Some rights are subject to legal conditions and exemptions.
7. Review and Secure Disposal
We periodically review retained records and dispose of them securely. Electronic records may be deleted, anonymised or overwritten. Paper records, if any, should be shredded or otherwise securely destroyed.
8. Contact
Questions about this Data Retention and Deletion Policy can be sent to:
Mrs Samantha Allonby trading as Boxed Events
128 Midland Road
Royston
Barnsley S71 4QT
United Kingdom
support@boxxedfood.com
07895 986351
You may also want to read: