Legal · Privacy
Privacy and cookies
How we handle personal data about the people and businesses that contact us, apply or become clients, and about job applicants and introducers; the browser storage this site uses; and how to make a data request.
In short
- Boxwind CR, S.R.L. decides how and why your data is used. It is the controller. You can write to us at notices@boxwind.io.
- We collect contact details, identity and ownership information for onboarding, wallet addresses, messages and basic site data.
- We use it to check and onboard clients, to run the agreement, to meet legal duties such as anti-money laundering, and for our legitimate interests.
- No analytics provider is used. The site stores only your cookie choice, and a price cache that lasts 60 seconds. Pages that show an indicative price ask three public price services for it. They see your IP address, as any website you visit does. We send them nothing about you.
- You can ask to see, correct, delete or move your data, or object to its use. Use the data request form (section 13).
- The cookie policy (section 12) and the data request form are part of this page.
1. Who is responsible
The controller of your personal data is Boxwind CR, S.R.L., a company incorporated in Costa Rica (cédula jurídica 3-102-887839). See who you contract with.
Data protection contact: notices@boxwind.io.
This notice is for individuals connected to our clients: people who contact us, apply for an advance, or act for a client, and the directors, beneficial owners and authorised persons of business clients. Where the client is an individual (a high-net-worth individual or a professional investor), we process the client's own personal data for the same purposes, and the same categories and purposes in this notice apply to the client directly. It also covers people who apply for a job with us (see careers) and introducers who refer clients to us (see the introducers section). Box Advance is for businesses, high-net-worth individuals and professional investors. We do not offer it to retail consumers.
2. What we collect
- Contact data. Name, job title, email address, telephone number, company name (if you apply as a business) and the details you give us when you get in touch.
- Identity and business checks (KYC and KYB). For the company: constitutional documents, registration details, board resolutions and ownership evidence. For directors, beneficial owners and authorised persons of a company, and for an individual client: name, date of birth, nationality, address, identity documents, specimen signatures and the results of our checks.
- Job applicants. The details you send us when you apply for a job, such as your contact details and CV.
- Introducers. Name, business contact details and the introductions you make to us.
- Source of funds and wealth. Information on where the client's funds and wealth and the collateral come from.
- Wallet and transaction data. Wallet addresses you whitelist, details of transfers, and the blockchain history of the assets you pledge.
- Communications. Emails, messages and the content of forms. We may record and keep calls and electronic communications with you.
- Site data. Your choice about cookies, which is stored in your browser. The site is hosted on Cloudflare, our hosting provider, which processes requests to deliver the site and may record technical data such as IP address and browser type. No analytics provider is used. The only other external services the site contacts are three public price services. Each receives your IP address and browser details, as any web request does, and we send them no personal data, no account details and no cookies. See section 12.
We get this data from you, from the business you act for (if you act for one), from identity and screening services, and from public sources and blockchain data.
If you give us personal data about other people, such as directors or owners, you must have the right to do so and must have told them. The agreement asks the client to confirm that it has the consents needed.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Replying to enquiries and assessing whether we can work with a client | Legitimate interests; steps at your request before an agreement |
| Onboarding and due diligence on the client and, for a company, its owners, directors and authorised persons | Legal obligation; legitimate interests |
| Making and running an advance, custody, notices and statements | Performing the agreement; legitimate interests |
| Anti-money laundering, sanctions screening, record-keeping and reporting to authorities | Legal obligation |
| Keeping the site and our systems secure; handling complaints, disputes and legal claims | Legitimate interests; legal obligation |
| Considering job applications; dealing with introducers | Legitimate interests; steps at your request. |
We use "legitimate interests" where our need is real and does not override your rights.
4. Who we share it with
We share personal data only where needed, with:
- service providers that help us run the product, such as custody technology providers and identity verification and screening providers;
- professional advisers, auditors and insurers, under a duty of confidence;
- our affiliates, and any funding vehicle or person to which we transfer our rights under the agreement;
- authorities, courts and law enforcement, where the law requires or allows it. We may be barred from telling you when we do.
We do not sell personal data. When we move assets, the law may require us to pass originator and beneficiary information along with the transfer.
5. International transfers
Boxwind CR is incorporated in Costa Rica. Some providers, advisers and authorities we share data with are in other countries. Your data may therefore be sent outside Costa Rica and outside your own country.
Where we do this, we take steps to protect it.
6. How long we keep it
We keep personal data only as long as we need it for the purposes above. We keep records connected to the agreement for at least seven years, or longer if the law requires.
We keep enquiries, unsuccessful applications, site data and communications only as long as needed for the purposes above.
7. Security
We use technical and organisational measures to protect personal data, and we limit access to those who need it. No system is perfectly secure. If you find a weakness, please tell us through responsible disclosure.
If a breach affects your data, we will act as the law requires.
8. Your rights
Under Costa Rica Law No. 8968 on the protection of persons regarding the processing of their personal data, you have rights over your data. These include the right to know what we hold, to correct it, to have it deleted where the law allows, and to withdraw consent.
Where a data protection law outside Costa Rica applies to us, you may also have the rights to access, rectification, erasure, restriction, portability and objection, and to withdraw consent.
Some rights have limits. For example, we may need to keep records for anti-money laundering and legal reasons even if you ask us to delete them. We will explain if that applies.
9. How to make a request
Use the data request form in section 13, or write to the data protection contact in section 1 (notices@boxwind.io). Tell us what you want and, if you are connected with a business, which one.
10. Complaints
Please tell us first, through our complaints process, so we can try to put things right.
You may also complain to the data protection authority that applies to you.
11. Changes to this notice
We may update this notice. We list each version, with its date and a summary of the change, in the version history. That includes the cookie policy and the data request below.
12. Cookies and browser storage
A cookie is a small file saved by your browser. Browser storage is a similar place where a site keeps small pieces of information. We call both "cookies" here for short. This website is run by Boxwind CR, S.R.L.
Necessary storage
The site needs one small item to work, as well as the short-lived price cache described below: it remembers that you have made your cookie choice. Without it, we would have to ask you again on every page. It is set when you choose OK or save your choices. It is not used to track you or identify you. It is not shared with anyone. Necessary storage does not need your consent.
Analytics
No analytics provider is used. The banner offers only OK and Preferences. In Preferences, the analytics switch is shown as off and cannot be turned on, because nothing is installed. If we ever add analytics, we will ask first, they will stay off until you accept, and we will update this policy and list them in the table below.
Fonts and price services
The site hosts its own typefaces, so no font provider receives data from your visit. The site itself is hosted on Cloudflare, which processes requests to deliver it.
Pages that show an indicative price, such as the simulator and the price ladder, also make requests from your browser to three public price services: api.coinbase.com, api.kraken.com and data-api.binance.vision. We send no personal data with the request, and the services set no cookie through our pages. The answers are kept in your browser's session storage for 60 seconds, so the page does not ask again straight away, and they are cleared when you close the tab. If the services cannot be reached, the page shows a stated fixed price instead.
Cookies and storage we use
| Name | Type | Purpose | Holds | How long | Consent needed |
|---|---|---|---|---|---|
| box_consent_v1 | Local storage in your browser | Remembers your cookie choice | The word "necessary", meaning you have made your choice | Until you clear your browser data or change your choice | No |
| box.prices.v1 | Session storage in your browser | Keeps indicative prices so the page does not ask again straight away | Public asset prices and the time they were fetched. No personal data | 60 seconds, and until you close the tab | No |
| Analytics | None. No analytics provider is used | Not applicable | Nothing | Not applicable | Yes, if added |
Change your choices
You can change your choice at any time. Choose the button below, or "Cookie preferences" in the footer of any page. To remove the stored choice entirely, clear this site's data in your browser settings.
13. Data request
Use this form to ask what we hold about you, or to have it corrected, deleted or moved. Sending the form opens your email app with your details filled in.
What you can ask for
- Access. A copy of the personal data we hold about you, and how we use it.
- Correction. Fixing data that is wrong or incomplete.
- Deletion. Removing your data, where the law allows.
- Objection. Asking us to stop using your data for a purpose, such as one based on our legitimate interests.
- Portability. Receiving data you gave us in a common format, where the right applies.
Which rights apply depends on the law: see section 8.
Make a request
What happens next
We will ask you to prove who you are before we give you data or change it. If you act for someone else, we will ask for proof that you are allowed to. We may ask for extra information to find your data, and we will tell you how to send it safely. If we cannot verify you, we cannot act on the request.
We will confirm that we have your request. We will then reply with our decision, or with the data.
We may refuse a request, or part of it, where the law allows, for example where it would reveal another person's data, or where we must keep the records (section 6). We will explain why. We do not charge for a request. If you are not happy, tell us through the complaints process (section 10).