Privacy Policy

​​

Last updated: 16 June 2026

​

This Privacy Notice (also called a Privacy Policy) explains how your personal data is collected and used when you use the zero.box website and platform (the “Platform”) — whether you are browsing, contacting us, or applying for and taking part in the ZEROBOX Network. The Platform is operated by bdxpq ltd. The ZEROBOX Network is governed by ZEROBOX Association, an independent non-profit company.

​

1. Who is responsible for your data

Who is responsible depends on what you do on the Platform:

1. General website use — for browsing, analytics (Google Analytics), advertising (Google Ads) and any enquiries you send us, bdxpq ltd is the data controller (registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom).

2. Network participation — for data collected when you apply for or take part in the ZEROBOX Network, bdxpq gmbh is the data controller (c/o CONSAVO Legal AG, Tödistrasse 55, 8002 Zürich, Switzerland); bdxpq ltd processes that data on its behalf; and ZEROBOX Association (167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom (to confirm on incorporation)) receives registration and disclosure data for the registry.

For any data protection question, or to exercise your rights, contact circle@zero.box.

​

2. The personal data we collect

1. Website and enquiry data — if you contact us or complete a form, your name, email address and the content of your message.

2. Registration data (Network) — your name, your business or employer name, business contact details (email, address, telephone) and your participation category (Promoter, Partner or Supplier).

3. Disclosure data (Partners and Suppliers) — the number of ZEROBOX-system plates you have commissioned or produced in each period, and the identity of the counterparty involved.

4. Technical data — information collected automatically through cookies (see section 8).

​

3. How we use your data, and our legal basis

Purpose

Legal basis

Responding to enquiries you send us

Performance of a contract; our legitimate interest in responding

Understanding and improving how the Platform is used (analytics)

Your consent (given through the cookie settings)

Measuring and delivering our advertising

Your consent (given through the cookie settings)

Processing your application and administering your participation

Performance of a contract (the Terms & Conditions of Participation)

Maintaining the Participant registry and voting records

Legitimate interests (governing the Network); legal obligation

Reconciling disclosure data with licence records

Legitimate interests (integrity of the Network)

Listing you in the Participants Directory

Performance of a contract; legitimate interests

Keeping the Platform secure and meeting legal duties

Legitimate interests; legal obligation

Where we rely on consent (for example, for analytics, advertising or marketing), you can withdraw it at any time.

​

4. Who we share your data with

1. ZEROBOX Association — receives your registration and disclosure data to maintain the registry and voting records.

2. bdxpq gmbh — receives disclosure data for reconciliation and licence-management purposes.

3. Other Participants — certain information is visible to other Participants, including through the Participants Directory (your name, employer, business contact details and a short description) and business information you share through the Platform. Please share only what you are content for others to see.

4. Service providers — including our website host (Wix) and Google (for analytics and advertising), who process data on our behalf or as described in their own policies.

5. Authorities or advisers — where we are required to by law, or to establish or defend legal claims.

We do not sell your personal data.

​

5. The Participants Directory

If you are a Participant, your name, employer, business contact details and a short description may appear in the Participants Directory, which is visible to other Participants, so that Participants can identify and contact one another. If you do not want certain details shown, contact circle@zero.box.

​

6. International transfers

bdxpq gmbh is based in Switzerland. The United Kingdom recognises Switzerland as providing an adequate level of data protection, so no additional safeguard is required for transfers from the UK to Switzerland. Where your data relates to individuals in the EU and is transferred outside the EU, we put appropriate safeguards in place as required by EU data protection law. Our hosting and analytics providers may also process data outside the UK or EU under appropriate safeguards.

​

7. How long we keep your data

We keep your personal data for as long as you participate in the Network, and afterwards only for as long as needed for the purposes described above or to meet legal obligations. Certain confidentiality obligations relating to disclosure data continue for up to ten years after participation ends.

​

8. Cookies

Cookies are small files stored on your device when you visit the Platform. We use them in three categories:

1. Essential cookies — set by Wix (our website platform) and always active. They keep you logged in to the members area, maintain your session, and keep the Platform secure and working. These do not require your consent.

2. Analytics cookies — we use Google Analytics to understand how visitors use the Platform so we can improve it. These are set only if you accept them.

3. Advertising cookies — we use Google Ads to measure the effectiveness of our advertising and to show relevant ads. These are set only if you accept them.

The analytics and advertising cookies are provided by Google and may involve Google setting its own (third-party) cookies. You can read how Google uses this data at policies.google.com/technologies/partner-sites. We set non-essential (analytics and advertising) cookies only where you have given consent through our cookie banner, and you can change or withdraw your choices at any time through the cookie settings on the Platform.

​

9. Your rights

Under UK data protection law (and EU law where it applies) you have the right to:

1. access the personal data we hold about you;

2. ask us to correct or erase it;

3. restrict or object to how we use it;

4. ask us to transfer it (data portability); and

5. withdraw consent where we rely on it.

To exercise any of these, contact circle@zero.box. We will respond within the time limits set by law. If you are unhappy with how your data is handled, you can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk. If you are in the EU or Switzerland, you may also contact your local data protection supervisory authority.

​

10. Security

We use appropriate technical and organisational measures to protect your data, and our processor is required to report any personal data breach without undue delay so we can meet our legal obligations.

​

11. Changes to this notice

We may update this notice from time to time. The current version is always available on the Platform, and the “last updated” date above shows when it last changed.

​

12. Contact

Questions about this notice or your data: circle@zero.box, or write to bdxpq ltd or bdxpq gmbh at the addresses in section 1.