This policy explains how MysteryBoxes.Software handles personal data submitted through this website. It applies to visitors to mysterybox.software and to business enquiries made through our contact form.

Who we are. MysteryBoxes.Software provides turnkey mystery box and case-opening platform technology to businesses. This website is a business-to-business marketing site. We are the controller of the personal data described below.

What we collect. When you submit the contact form we collect the name you provide, plus the contact channel you choose to give us: a WhatsApp number, a Telegram username, or both. If you tell us when you plan to launch, we store that too. We also record technical and campaign information about the visit: the page you submitted from, the referring page, your browser user agent, an approximate country derived from your connection, and campaign parameters including utm_source, utm_medium, utm_campaign, utm_term, utm_content and advertising click identifiers such as gclid and fbclid.

IP addresses. We do not store raw IP addresses. We store a salted, irreversible hash of the IP address, used solely to detect abuse and automated form submissions.

Why we use it, and our lawful basis. We use your contact details to respond to your enquiry and to discuss a possible commercial relationship, on the basis of our legitimate interest in responding to business enquiries and taking steps at your request prior to entering a contract. We use campaign data on the basis of legitimate interest in understanding which marketing generates genuine business enquiries. Analytics and advertising cookies are used only with your consent.

We do not sell personal data, and we do not use your contact details for unrelated marketing.

Cookies. A necessary cookie records your cookie choices. First-party cookies record which campaign brought you to the website; these store campaign metadata only, never names, contact details or IP addresses. Analytics and advertising cookies are set only where you have allowed them. See the Cookie Policy for detail.

Who we share it with. Personal data is stored in our own systems. It is processed by the infrastructure and communication providers we use to host this website and to receive enquiry notifications, acting as processors on our instructions. We disclose personal data to authorities only where legally required.

International transfers. Where a provider processes data outside the European Economic Area, we rely on an adequacy decision or on standard contractual clauses.

Retention. Enquiry records are kept for as long as needed to pursue the business relationship and to meet record-keeping obligations, and are reviewed periodically. Campaign attribution cookies expire after the retention period set in our cookie settings, which is 90 days by default.

Your rights. Subject to applicable law you may request access to your personal data, correction, erasure, restriction or portability, and you may object to processing based on legitimate interests. Where processing relies on consent you may withdraw it at any time. Contact us using the details in the footer. You also have the right to lodge a complaint with your local data protection authority.

Changes. If this policy changes we will update this page.