GDPR & Data Protection

Last updated 17 July 2026

CloudBox is built to be private by design and compliant with UK data protection law (UK GDPR and the Data Protection Act 2018). This page summarises how we meet those obligations. It complements our Privacy Policy.

Data controller

Octrax Holdings Limited, operating as CloudBox, is the controller for personal data processed through the service. For data our business customers upload about their own users, we generally act as a processor and can provide a Data Processing Agreement on request.

Lawful bases

We process personal data under one or more of: performance of a contract, legitimate interests (security, service operation and improvement, limited marketing), legal obligation, and consent where required. We keep processing to what is necessary for each purpose.

Your rights

• Access — obtain a copy of your personal data.
• Rectification — correct inaccurate data.
• Erasure — ask us to delete your data ("right to be forgotten").
• Restriction / objection — limit or object to certain processing.
• Portability — receive your data in a portable format.
• Withdraw consent — at any time, without affecting prior processing.

To exercise any right, email hello@cloudbox.biz. We respond within one month. You may also complain to the ICO.

Sub-processors

International transfers

Your files and drive data are held in the United Kingdom. Where a processor handles limited data outside the UK, we rely on adequacy decisions or standard contractual clauses to protect it.

Security & breach handling

We apply zero-knowledge encryption on transfers, encryption at rest, TLS in transit, two-factor authentication by default, and access controls. If a personal data breach is likely to result in a risk to your rights, we will notify the ICO within 72 hours and affected users without undue delay.

Data retention

Free transfers auto-delete after their link expires. Account data is kept while your account is active and deleted or anonymised afterwards, subject to legal retention periods.

Contact

Data protection queries: hello@cloudbox.biz. Octrax Holdings Limited, registered in England & Wales (company number, registered office and ICO registration available on request).

This summary is provided for transparency and is kept up to date as our processing evolves.