Data Protection & Privacy Policy

WHO WE ARE

40 Boxes, Inc. brands which include, but are not limited to, 40boxes.com, shoptamfam.40boxes.com, abcsecretsavings.com, powerhour.40boxes.com, simplistic.com, simplistic2.com, cartcierge.com, and other 40boxes.com subdomains. 40 Boxes, Inc. is committed to respecting your privacy (“collectively, 40 Boxes” , “we”, “us”, “our”) gathers and processes your personal information in accordance with this privacy policy (“Policy”). This Policy provides you with the necessary information regarding your rights and obligations, and explains how, why, and when we collect, process, and use your personal information. 

This Policy is part of 40 Boxes’ Terms and Conditions and applies when you visit or use any of Our 40 Boxes’ websites (e.g. https://40boxes.com/), mobile or tablet apps and any official social media sites, or other domains where this Privacy Policy is posted (collectively the “Site” or "Sites"), your use of emails, text messages or other electronic communications, fixtures or other products, goods, or services from us (collectively, the “Services”). This Privacy Policy does not apply to the data collection practices of any other 40 Boxes websites that are not owned and operated by 40 Boxes. 

Please note that this Privacy Policy does not govern the practices of third parties, including our partners, third party service providers, marketing providers, and/or advertisers, even when those services are branded as or provided on behalf of 40 Boxes.

By visiting our Sites, using our Services and/or making choices when placing a purchase with us, you acknowledge that you have read and accepted the terms of this Privacy Policy and our Terms and Conditions, and you are consenting to our collection, protection, use, retention, and disclosure, subject to the terms and conditions set-forth below in this Policy, of your personal information. If you elect to not provide the information we require, we may not be able to provide all of our Services to you.

If you do not agree to the terms of this Privacy Policy, please do not use our Sites or our other Services. We may make changes to this Privacy Policy from time to time. Your continued use of our Sites and other Services following the posting of any changes to this Privacy Policy will indicate your acceptance to these changes. We will post any Privacy Policy changes on this page. Please check back frequently to see any changes.

INFORMATION WE COLLECT 

We collect your information in several ways, including: information we collect from you; information we collect when you use our Services; and information we collect from third parties. When you use our Services (e.g., purchase a product, use our apps, browse our Sites, complete a survey, etc.), we may request and you may provide your personal information to 40 Boxes. 40 Boxes collects, uses and processes your personal information to provide our Sites and Services to you, and to meet our legal, statutory and contractual obligations. The specific information we collect depends upon your use of the Sites and our other Services, as described below. 

“Personal information” is information that identifies you as an individual or relates to or is reasonably capable of being associated with an identifiable individual, and includes the data sets referred to below.

The personal information that we may collect includes the following categories and specifics within said category:

Identifiers:

• Your name;
• Your phone number;
• Your email;
• Your address;
• Your account username and password;
• Your unique userID; 
• Your IP address.

Customer Records:

• Your billing address;
• Your payment information;
• Your payment card information (collected and processed by our payment processors).

Customer Information:

• Survey responses.

Internet or other electronic information:

• Browser type and browsing history;
• Usage data;
• Device type and other device information;
• Operating system;
• Language preference;
• Referring URLs;
• Pages and screens viewed;
• Links clicked;
• Dates and times of your interactions;
• Your engagement with our advertisements and email communications;
• Cookies, pixels, web beacons, software development kit ("SDK") data, and similar tracking technology data; 
• Information from third parties and other databases.

Audio, Electronic, Visual or Similar Information:

• Recordings of calls to our customer service line where permitted by law and after notice;
• Photographs or videos you submit to us, including through social media tags. 

Professional or Employment Related Information: 

• Your job title;
• Your professional contact information;
• Your resume;
• Your employment history;
• Your references;
• Other application materials you provide when you apply for employment through our careers portal.

Inferences:

Inferences drawn from any of the above to create a profile reflecting your preferences, characteristics, predispositions, behavior, and attitudes (for example, that you are likely to be interested in a particular item or location).

Sensitive Personal Information:

We do not seek to collect sensitive personal information and do not use or disclose it for purposes other than those permitted under California Civil Code §1798.121(a) and analogous provisions of other state laws. To the extent we receive any of the following, we treat it as sensitive personal information: account log-in credentials in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; and the contents of your communications with us where those contents are not directed to us.

We do not knowingly collect or process biometric identifiers or biometric information from guests through the Sites. 

HOW WE COLLECT YOUR INFORMATION

The personal information is collected in several different ways, including: registration and forms to sign up for Services, billing, survey completions, contacting our service center, and other sources. How we collect information includes the following categories and specifics within said category:

1. Information You Provide to Us. This includes the information that you provide to 40 Boxes directly — for instance, when you contact us with a question, purchasing a product, applying for a job through our Sites, filling out pop up forms, responses to surveys for research purposes, QR codes, or otherwise directly interact with us. 
2. Information Gathered During the Use of Our Services. This includes, among others, information automatically gathered through your use of our Sites, such as through cookies, pixels, SDKs, server logs and similar technology.
3. Information Collected after Consent. In some contexts, we may ask for your consent before collecting certain types of information.
4. Data from other sources. We also obtain data from other partners or third parties that help us provide our Services to you.
5. From our Licensees. We may collect data from our licensees in connection with your visits to and transactions with 40 Boxes.
6. From our Advertisers. We may collect data from our advertising and analytics partners, including social media platforms and ad networks, that match us to potential customers or measure the effectiveness of our advertising.

Cookies and Ad-Targeting Technologies

We and our third-party partners (including service providers and advertising partners) may use cookies, web beacons (“pixels”), mobile ad identifiers, and other similar technologies to facilitate our relevant Services to you, and to provide you with a customized online experience. Cookies are files with a small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from a website and stored on your device. Other tracking technologies are also used such as beacons, tags and scripts to collect and track information and to analyze and improve our Service. We use third-party partners to help manage and optimize our Services’ performance and online advertising.

Please be advised that if you choose to reject all cookies, then certain areas of the Site might not function properly.

Examples of cookies we use:

First Party Cookies. We use first party cookies, including session cookies and preference cookies, to remember your selections, choices, and preferences for when you interact with our Sites. Session cookies are temporary and are automatically deleted once you close your Internet browser. Preference cookies are first party cookies that remain on your device until you delete them or they are otherwise removed upon expiration.

Third Party Cookies. We permit certain third-party Service Providers, advertisers, and other companies to use cookies or other similar technologies on our Site. These companies may collect your information, track your behavior on our Site, and gather information about your use of our Sites and other online Services over time and across different Services. Additionally, some companies may use information collected to deliver targeted ads on behalf of us or other companies, including on other websites or online services. We are not responsible for the functioning of cookies and other technologies used and placed by third parties on your device.

The third-party partners we use who may utilize cookies or other tracking technologies include but are not limited to:

• Google: to provide Google Analytics (as Analytics Cookies) to analyze behavior of your use of our Sites, apps, and other Services, in order to improve our Services and provide you and other users with a better experience;
• AMP: to provide AMP Analytics to analyze behavior of your use of our Sites, apps, and other Services, in order to improve our Services and provide you and other users with a better experience;
• AppStore Connect: to analyze backend application store data; 
• Shopify: to process your payment information; 
• Convert A/B Testing: to compare web pages or digital assets to see which one results in more user actions;
• AfterShip: to track your orders;
• Avalara: for tax compliance;
• Gorgias: for customer service and help desk support;
• Loop: for product returns and/or exchanges;
• ShipStation: to import orders, compare carrier rates, and print shipping labels;
• Xporter: to export issue data into customizable formats like Word, Excel, and PDF;
• Klaviyo: to assist with email marketing and SMS messaging;
• Ordoro: to assist with inventory management and shipping; 
• Facebook, X (formerly known as Twitter), YouTube, Instagram, Rumble, LinkedIn, and other Social Media Partners(Social Media Cookies): to enable the sharing of content through social media sites and otherwise allow you to interact or connect with such sites while using our platforms; 
• Other Technologies: We collect many different types of information from other technologies to improve the quality of our Site and the Services we provide. For example, we may collect usage data and other information about the device you use to access our Site, your operating system and/or mobile device type, browser type, domain, and other system settings, as well as the language your system uses and the country and time zone where your device is located. We may record the IP address of the device you use to connect to the Internet. 

These technologies include web beacons and scripts: Web beacons are pieces of code embedded in a website or email to monitor your activity on the website or your opening of the email, and which can pass along information such as the IP address of the computer or device you use to view the website or open the email, the URL page on which the web beacon is located, the type of web browser that was used to access the website, and previously set cookie values. Web beacons are sometimes used to collect advertising data, such as counting page views, promotion views or advertising responses. Disabling your computer’s, device’s or web browser’s cookies may prevent some web beacons from tracking or recording certain information about your activities. Please be advised that if you disable all such cookies, then certain areas of the Site might not function properly.

Scripts are pieces of code embedded in a website to define how the website behaves in response to certain key or click requests sent by the user. Scripts are sometimes used to collect information about the user’s interactions with the website, such as the links the user clicks on. Scripts are often temporarily downloaded to the user’s computer or device from the website server, active only while the user is connected to the Site and deactivated or deleted when the user disconnects from the website. Please be advised that if you disable any scripts through your web browser or other means, then certain areas of the Site might not function properly.

This Privacy Policy applies to any personal information collected through our used Cookies and similar technologies. Personal information collected through the third-party partners’ Cookies and similar technologies is subject to the privacy policy of the third party partners respectively, and not to our privacy policy.

Software Development Kits (“SDKs”): We may use SDKs on our mobile app to collect analytics regarding the use and functionality of our mobile app. Additionally, if you access our mobile app utilizing an iPhone, you may turn off cross-application tracking in the Privacy section of your phone settings.

Your Cookie Choices. When it comes to how you want to use or allow cookies to be used on your devices, you are in control. Most internet browsers are initially set to accept cookies. You can set your browser to block or otherwise control what cookies your browser or mobile device accepts via your browser or mobile device settings in the manage preferences section. Additionally, you can choose to modify your settings and delete cookies that are otherwise stored on your device. Please consult the instructions provided by your browser or your mobile device’s manufacturer to determine how you can limit the placement of and/or remove cookies or other technologies. Please note, however, that limiting or disabling essential cookies and other technologies may impact or adversely affect some portion or functions of our Sites.

Controlling Cookies and Opt-Out Choices. You can visit the following sites for comprehensive information on how to manage cookies and how to opt out of cookies used for advertising and marketing purposes:

For individuals in the United States:

• The Digital Advertising Alliance’s Consumer Choice tool at https://www.aboutads.info/choices
• The Digital Advertising Alliance’s AppChoices program at https://www.aboutads.info/appchoices
• The Network Advertising Initiative’s opt-out program at https://www.optout.networkadvertising.org/

For EU/EEA-based individuals:

• The EDAA opt-out program at https://www.youronlinechoices.eu

We partner with third-party sponsors, affiliates, vendors, and other companies who might have links, content, or applications on the Sites. These third parties might also use tracking tools on our Sites or other Sites to collect information about you when you use the Sites. They may collect information about your online activities over time and across different sites and other online services. We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about such a link, content, or application, you should contact the third-party entity directly. We are not responsible for the content or privacy practices on any websites, applications, tracking tools, or other technology that are not operated by 40 Boxes, even though our Sites might link to them or they might link to our Sites.

HOW WE USE YOUR PERSONAL INFORMATION 

40 Boxes takes your privacy very seriously. The purposes and reasons for collecting, processing, and using your personal information are detailed below:

• to provide you with the products, content, and other Services that you seek from us;
• to manage your account; 
• to improve the contents of the Sites and apps to serve you, and make them more suitable to your needs and increase their usability;
• to analyze how you and other users interact with our Sites;
• to provide customer support;
• to communicate with you about your transactions;
• to make your navigation more pleasant and personalized, with our products (such as contents) and Services personalized to you;
• to facilitate your experience and social sharing;
• to analyze and develop our new products and Services for the interest of users;
• to send you offers or other communications about our products and Services, such as special or promotional events, including services, products, or events, or other materials;
• to provide you with notices about your account, including expiration and renewal notices;
• to resolve disputes, collect fees, or troubleshoot problems;
• to recruit, evaluate, and onboard job applicants who apply through our careers portal;
• to facilitate corporate transactions, including any merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets;
• to detect, investigate, and prevent activities that may violate our Terms and Conditions or other policies, or which may be fraudulent or illegal; and 
• in specific cases we will be contractually obligated to share your data with one of our third party partners explained above.

In these instances, we will make it clear that the third party partners, in which the data you share will be transferred to, must follow applicable privacy and data protection regulations.

We may disclose the following categories of personal information for various business purposes:

• Identifiers;
• Customer Records;
• Customer Information;
• Internet or Other Electronic Information;
• Audio, Electronic, Visual, or Similar Information;
• Professional or Employment Related Information; and
• Inferences

SHARING YOUR PERSONAL INFORMATION

We may share or disclose your personal information to help provide our Services to you. For instance, we may share your information with our affiliated companies and service providers (including, but not limited to The Walt Disney Company and American Broadcasting Companies, Inc.) to respond to your requests or process your purchases. We may also provide your personal information to third party service providers who assist us in providing certain Services. 

We may also disclose or share your information for the following purposes:

1. To facilitate and improve the quality of our Services.
2. To protect our users and network against fraud and security threats.
3. To comply with a legal obligation.
4. To protect and defend our rights or property.
5. To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of 40 Boxes’ assets, whether as a going concern or as a part of bankruptcy, liquidation, or similar proceeding, in which personal information held by 40 Boxes about our Website users is among the assets transferred. 
6. To prevent or investigate possible wrongdoing in connection with the Services.
7. To protect the personal safety of individuals or the public.
8. To protect against legal liability.
9. When there is a good faith belief that such action is necessary to investigate or protect against harmful activities to our guests, visitors, associates, or property (including the Site), or to others. This may include disclosures to law enforcement to investigate potential criminal activity or other civil violations.

We may share your information with the following types of entities and third parties:

1. Our affiliated companies; 
2. Our third-party service providers to assist us in our provision of the Services;
3. Our third-party service providers to analyze how users use our websites and apps, track user interests, trends and patterns in order to serve you personalized content which is relevant to your interests;
4. Advertising and social media partners that help us promote our brand, including through cross-context behavioral advertising, where you have not opted out;
5. Professional advisors, including lawyers, accountants, auditors, and insurers;
6. Government authorities and law enforcement, in response to lawful requests or where we believe in good faith that disclosure is necessary to comply with law, protect rights, or address fraud, security, or safety issues;
7. Counterparties and their advisors in connection with a merger, acquisition, financing, reorganization, bankruptcy, dissolution, or other transfer of some or all of our assets; and
8. Any other party with your consent or at your direction.

40 Boxes uses third-party service providers and business partners to provide certain Services and business functions as detailed throughout this Privacy Policy. In those instances, the applicable third-party partners collect and process your data governed by their privacy policy.

In certain situations, we will only share your information with your consent, as noted below. We may from time to time be required to provide information to law enforcement or other governmental authorities pursuant to a warrant, court order, or other lawful process.

Sharing your Personal Information with Our Advertising and Marketing Partners

Some of the above sharing and use of your information is only done where we have obtained your consent to do so. For example, we may provide your personal information, including IP address information, interest data, unique IDs and other information to certain third parties that help us advertise and market our Services. You can withdraw your consent at any time by contacting us using the contact information listed in the “Exercising your Privacy Rights” section below.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties for their own marketing purposes.

Sale of Personal Information

40 Boxes has not sold and does not sell any personal information of consumers as it is commonly understood. However, several state privacy laws define "sale" and "share" broadly to include certain disclosures of personal information to third-party advertising networks and analytics providers in exchange for cross-context behavioral advertising or other consideration. Consistent with that broad statutory definition, we may "sell" or "share" the following categories of personal information for purposes of cross-context behavioral advertising: identifiers; internet or other electronic network activity information; commercial information; geolocation (approximate); and inferences.

We do not knowingly sell or share for cross-context behavioral advertising the personal information of consumers under 18 years of age.

You have the right to opt out of the sale or sharing of your personal information. You can exercise this right by:

1. Clicking the "Do Not Sell or Share My Personal Information" in the link in the footer of our Sites; or
2. Contacting us using the information in the "Exercising Your Privacy Rights" section below.

Global Privacy Control ("GPC"). We honor opt-out preference signals, including the GPC as a valid request to opt out of the sale or sharing of your personal information and the processing of your personal information for targeted advertising. When you visit our Sites using a browser or extension that transmits the GPC signal, we treat that signal as an opt-out request for the browser and device and, where you are logged into an account associated with the browser, for that account.

SMS / TEXT MESSAGE COMMUNICATIONS

Where you separately provide your mobile telephone number to us or to a service provider acting on our behalf and affirmatively opt in to receive text messages from 40 Boxes (for example, through an SMS promotion or a future SMS feature of the App), you expressly consent to receive recurring marketing and transactional text messages from us and our service providers at the number provided, including messages sent using an automatic telephone dialing system or other automated technology.

Consent is not a condition of any purchase. Message frequency varies. Message and data rates may apply. To stop receiving text messages, reply STOP to any message. For help, reply HELP. Carriers are not liable for delayed or undelivered messages. We do not share, sell, rent, or otherwise transfer mobile telephone numbers or text-messaging opt-in data to any third party for that third party's own marketing purposes.

NOTICE OF FINANCIAL INCENTIVE

Our email program, and any loyalty, rewards, or subscription program we may offer through the App in the future (collectively, the "Programs"), may involve the collection of personal information in connection with a promotional offer, discount, or membership benefit. The Programs may be considered "financial incentives" under the California Consumer Privacy Act, Cal. Civ. Code §1798.125(b).

How We Calculate the Value of Your Data

We have estimated in good faith that the value of the personal information collected from each program participant is reasonably related to the expense we incur to provide the promotional offer or benefit and to administer the program. We calculate this value based on the marginal cost of the offer or benefit, the expected redemption rate, and the operational costs of program administration. We do not assign a market price to the personal information itself.

INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

40 Boxes is headquartered in the United States. If you reside outside of the United States and access our Services, you acknowledge that your information will be collected and transmitted to the United States. Please do not use our Services if you do not agree to this transfer. Many of our third-party service providers are United States companies. Data transmitted to those service providers are done in accordance with their respective privacy policies.

SECURITY MEASURES

40 Boxes takes your privacy seriously and we take reasonable measures and precautions to protect and secure your personal information. This includes implementing physical, technical, administrative, and other safeguards to protect you and your information from unauthorized access, alteration, disclosure or destruction. Encryption is our security strategy to ensure the stored personal information can be accessed only by the authorized roles and services with audited access to the encryption keys. Any payment transactions and other information will be encrypted using industry standard SSL or TLS technology.

Personal information is encrypted and stored in a private and isolated environment for extended security. No method of transmission or storage is fully secure. We cannot guarantee absolute security and you provide personal information at your own risk.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Site, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to use the utmost caution when disclosing information in public areas of the Site like message boards. The information you share in public areas may be viewed by any user of the Site.

CONSEQUENCES OF NOT PROVIDING YOUR DATA 

You are not obligated to provide your personal information to 40 Boxes. However, there may be times where your information is required for us to provide you with our Services, deliver requested products, or provide you with the content, feedback, or other materials that you request from us. In certain situations, we will not be able to offer some or all of our products or Services to you without requesting or collecting your personal information.

HOW LONG WE KEEP YOUR DATA

40 Boxes retains your personal information for as long as necessary for the purpose for which it is collected, to provide you with our Services, such as our Sites and apps. 

ARTIFICIAL INTELLIGENCE AND AUTOMATED DECISION-MAKING 

We currently use, or in the near future expect to deploy, artificial intelligence, machine learning, and similar automated technologies in connection with the Services. The categories of personal information processed by these technologies are described in the "Information We Collect" section above. Examples of current or anticipated uses include:

• Operating chat, voice, ordering-assistant, or virtual-assistant features within our App, Sites, or third-party ordering platforms (including our delivery partners);
• Personalizing content, menu recommendations, promotions, offers, and advertising;
• Detecting fraud, abuse, payment irregularities, and security threats;
• Analyzing guest feedback, survey responses, and customer-service communications; and
• Improving, training, evaluating, and developing our Services and the tools that support them.

Where we deploy artificial-intelligence features that interact directly with you (such as a chatbot or virtual ordering assistant), we will make reasonable efforts to identify those features as automated. Inputs you provide to those features (such as messages, voice transcripts, or order details) may be processed by us and our service providers to deliver, secure, and improve the feature. We do not knowingly use the content of those interactions to train generative-AI models offered to the general public outside the Services, and we contractually require our service providers to handle that content consistent with this Privacy Policy.

We do not use automated tools to make decisions about you that produce legal or similarly significant effects (such as eligibility decisions about employment, credit, housing, insurance, or healthcare) on a solely automated basis without human involvement. Where applicable state privacy law affords you the right to opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, you may exercise that right as described in the "Your Privacy Rights" section below.

CHILDREN'S INFORMATION

40 Boxes and its Sites and Services provide products and services for general audiences, and are intended for individuals over the age of 18. We do not intentionally or knowingly collect, use, or process the Personal Information from children under the age of 18, and such children are not permitted to use our Site or services. If you are under 18, do not attempt to register for or use any of our services, including our Sites, and do not provide us with any Personal Information about yourself. By purchasing our products or otherwise using our services, you acknowledge you are an adult over 18 years of age and are permitted to use our services in accordance with our Privacy Policy and Terms and Conditions. If you are a parent or guardian and you are aware that your child has violated this Privacy Policy and provided us with Personal Information, please contact us and we will take measures to remove that Personal Information from our services.

YOUR PRIVACY RIGHTS

Individuals may have certain rights over their personal information under particular laws. Please see the following sections regarding the rights you may have over your information:

Your Rights under various United Sates state data privacy laws such as the California Consumer Protection Act.

If you are a resident of California, Nebraska, and Texas,, you may have the following rights under your state's comprehensive privacy law (California Consumer Privacy Act, as amended by the California Privacy Rights Act, Cal. Civ. Code §1798.100 et seq.; and Delaware Personal Data Privacy Act, Delaware Code Title 6 §12D et seq.):

1. Right to Access / Disclosure: The right to have access to your personal data upon simple request – that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing of your data.
2. Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete.
3. Right to Deletion: The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law.
4. Right to Opt-Out: The right to opt out of the processing of your personal data for targeted advertising, as defined by applicable law. This right also allows you to opt out of the sharing of your personal data for cross-context behavior advertising as defined by the California Privacy Rights Act. The right also includes your right to opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.
5. Right to Appeal: You may also have the right to appeal the denial of any of these rights by submitting a form that will be provided to you if we deny a data request.
6. Right to Limit Use of Sensitive Personal Information: To the extent we use or disclose sensitive personal information beyond the purposes permitted by appliable law (such as California Civil Code §1798.121(a)), a right to limit such use.

To exercise any of these rights, please contact us at the contact information listed in the “Exercising Your Privacy Rights” section below. Note that we may ask you to verify your identity before responding to such requests.

Your California Privacy Rights Regarding Direct Marketing Information

California law allows California residents or their authorized agent once a year to request information regarding our disclosure of your personal information, if any, to third parties for those third parties’ direct marketing purposes during the preceding calendar year. This information includes:

1. The categories of information we disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year;
2. The names and addresses of third parties that received the information; and
3. If the nature of the third party’s business cannot be determined from their name, to obtain examples of the products or services marketed.

PROFILING DISCLOSURE

40 Boxes does not engage in profiling of consumers in furtherance of automated decisions that produce legal or similarly significant effects, as those terms are defined under the Colorado Privacy Act or similar regulations.

TRANSFER OF INFORMATION OUTSIDE OF YOUR JURISDICTION 

Please be aware that your personal information will be transferred to, stored or processed by us or our service providers in the United States, where our servers are located and our central database is operated, or other jurisdictions where our service providers are located for the purposes set out in this Privacy Policy.

EXERCISING YOUR PRIVACY RIGHTS / NON-DISCRIMINATION

We will not discriminate against you if you exercise your privacy rights. If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure. 

Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.

As described above, you may have certain rights to access, delete, or otherwise control the use, collection, and/or disclosure of their information. Once 40 Boxes receives and confirms a verifiable consumer request, we will work to promptly process such request. The need to verify an individual’s identity is critical to protecting your information, and ensuring that your information is not shared with anyone pretending to be you or someone who is not authorized to act as your agent on your behalf. To that end, we must be able to verify your information in order to process your request.

You may submit a verifiable request via the following:

By email: 

privacy@40boxes.com

By phone:

(844) 785-8609

Please provide sufficient information for us to determine if this applies to you. Please include “Privacy Rights Request” in the Subject line of your email. In the body of your request, please include your full name, year of birth, telephone number, email address, complete mailing address (street name and number, city, state, and zip code) so that we can process your request.

We will ask you to provide information about yourself so that we can verify your identity as part of this process. This information may include your name, address, account information, and any other information deemed necessary by 40 Boxes to reasonably verify your identity, to ensure that your information is not shared with anyone impersonating you. Once we have verified your identity, we will work to fulfill your request in a timely manner. Please note there may be some situations in which we are unable to fulfill your request, such as if we cannot find any information about you within our systems. Additionally, we may not be able to honor a deletion request in some situations, such as if your information is necessary to fulfill the Services you requested or meet a legal obligation. We will inform you whether we can fulfill your rights request.

We may ask for additional information if we have difficulty confirming your identity. We will not share your information or honor other requests in those situations in which we are unable to confirm a request for your information is a “verifiable request.”

LODGING A COMPLAINT 

40 Boxes only processes your personal information in compliance with this Policy and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal information or are unsatisfied with how we have handled your information, you have the right to lodge a complaint with your local supervisory authority.

If you would like to raise an issue or lodge a complaint directly with 40 Boxes, please contact us using the information below.

By email: 

privacy@40boxes.com

By phone:

(844) 785-8609

UPDATE TO OUR PRIVACY POLICY

40 Boxes may update this Policy from time to time. All changes will be posted and updated here. We will notify you directly by email (if we hold one for you) or by other appropriate means if any significant changes occur. Any changes to the privacy policy will become effective when the updated policy is posted. We advise you to check back here frequently to review the most current version of this Policy.

This statement was last updated on September 1, 2026.