Privacy Policy

This Privacy Policy explains how Boxbox collects, records, stores, uses, processes, discloses, protects and retains personal data in connection with the Boxbox parcel locker service.

This Privacy Policy applies to:

• a. Recipients collecting Parcels from Boxbox lockers;
• b. Couriers and delivery personnel depositing Parcels;
• c. senders and merchants arranging deliveries;
• d. authorised Parcel collectors;
• e. users of the Boxbox website, locker interface and supported applications; and
• f. persons who contact Boxbox customer support.

By using the Boxbox service or providing personal data to Boxbox, you acknowledge that your personal data may be processed in accordance with this Privacy Policy and applicable Malaysian data protection laws.

1. Definitions

For the purposes of this Privacy Policy:

1.1 Personal Data

“Personal Data” means information that relates directly or indirectly to an identified or identifiable individual.

1.2 Processing

“Processing” includes collecting, recording, holding, storing, organising, modifying, retrieving, using, disclosing, transmitting, securing, deleting or otherwise handling Personal Data.

1.3 Recipient

“Recipient” means the individual whose telephone number is registered for the collection of a Parcel.

1.4 Courier

“Courier” means the courier company, delivery driver, delivery personnel, sender, merchant or other person who deposits or arranges for the deposit of a Parcel into a Boxbox locker.

1.5 Parcel

“Parcel” means any package, document, product, item or shipment deposited into a Boxbox locker.

1.6 Pickup Code

“Pickup Code” means the unique collection code generated for the collection of a Parcel.

1.7 TAC

“TAC” means the Transaction Authorisation Code sent to a registered telephone number for telephone number verification.

2. Personal Data We May Collect

Depending on how you use the Boxbox service, we may collect and process the following Personal Data.

2.1 Recipient and Contact Information

We may collect:

• a. telephone number;
• b. name, where provided;
• c. email address, where provided;
• d. communication preferences; and
• e. other contact information submitted through customer support.

A Recipient’s telephone number may be provided to Boxbox by a Courier, sender or merchant rather than directly by the Recipient.

2.2 Parcel and Locker Information

We may collect:

• a. Parcel tracking number;
• b. courier or delivery service information;
• c. sender or merchant information, where available;
• d. Boxbox locker location;
• e. locker compartment number or identifier;
• f. Parcel deposit date and time;
• g. Parcel collection date and time;
• h. Parcel transfer date and time;
• i. Parcel collection status;
• j. overdue status;
• k. storage duration; and
• l. information relating to Parcel redelivery, return or disposal.

Boxbox does not ordinarily open Parcels or collect information about Parcel contents as part of its normal locker service.

2.3 Collection and Verification Information

We may collect:

• a. Pickup Code generation and usage records;
• b. telephone number verification records;
• c. TAC request, delivery and verification records;
• d. successful and unsuccessful collection attempts;
• e. locker opening and closing records;
• f. the date and time a locker compartment was accessed; and
• g. customer support verification information.

For security reasons, Boxbox may limit the validity period and number of attempts permitted for a Pickup Code or TAC.

2.4 Notification and Communication Information

We may collect records relating to notifications sent through:

• a. WhatsApp;
• b. SMS; and
• c. tracking.my application notifications.

These records may include:

• a. the registered telephone number;
• b. the notification date and time;
• c. the notification channel;
• d. the type of notification;
• e. delivery or failure status, where available;
• f. response records; and
• g. customer support communications.

Notifications may include:

• a. the initial Parcel collection notification;
• b. the seventh-day overdue reminder;
• c. the fifteenth-day overdue reminder;
• d. the notification issued when a Parcel is removed and transferred to Boxbox Headquarters; and
• e. a final notification before an unclaimed Parcel becomes eligible for disposal.

2.5 Payment and Refund Information

Where a payment is required, we may collect:

• a. payment amount;
• b. payment date and time;
• c. payment status;
• d. payment provider;
• e. transaction reference number;
• f. storage charges;
• g. redelivery charges;
• h. refund application information;
• i. refund status; and
• j. supporting documents provided for a payment dispute or refund request.

Boxbox currently supports payments through:

• a. Touch ’n Go eWallet;
• b. GrabPay; and
• c. Boost.

The relevant payment provider may process payment account information in accordance with its own privacy policy and service terms.

2.6 Website, Device and Technical Information

When you use the Boxbox website, locker interface or supported application, we may collect:

• a. IP address;
• b. browser type;
• c. device type;
• d. operating system;
• e. application version;
• f. language settings;
• g. date and time of access;
• h. pages or features accessed;
• i. error logs;
• j. system activity records; and
• k. cookies or similar technologies.

2.7 CCTV and Security Information

CCTV may be installed at or near certain Boxbox locker locations by Boxbox, property management or another authorised party.

Where CCTV is available, footage may record:

• a. individuals approaching or using a locker;
• b. Parcel deposit and collection activities;
• c. security incidents;
• d. suspected unauthorised access; and
• e. damage or misuse involving a locker.

The availability, coverage and retention of CCTV footage may differ between locker locations.

2.8 Customer Support and Complaint Information

When you contact Boxbox, we may collect:

• a. the Parcel tracking number;
• b. registered telephone number;
• c. locker location;
• d. description of the issue;
• e. photographs or documents submitted;
• f. payment receipt or transaction reference;
• g. proof of identity, where reasonably required;
• h. proof of ownership or entitlement to a Parcel; and
• i. communication records between you and Boxbox.

3. Sources of Personal Data

Boxbox may obtain Personal Data from:

• a. the Recipient;
• b. a Courier or delivery driver;
• c. a sender or merchant;
• d. an authorised Parcel collector;
• e. tracking.my;
• f. Touch ’n Go eWallet, GrabPay or Boost;
• g. payment processors;
• h. redelivery service providers;
• i. property management or building management;
• j. Boxbox lockers, systems, websites and applications;
• k. CCTV systems, where available; and
• l. customer support communications.

Where a Courier, sender, merchant or another person provides Personal Data relating to someone else, that person is responsible for ensuring that the information is accurate and that they are authorised to provide it for Parcel delivery and collection purposes.

4. Why We Process Personal Data

Boxbox may process Personal Data for the following purposes.

4.1 Providing the Parcel Locker Service

We may use Personal Data to:

• a. register a Parcel in the Boxbox system;
• b. assign or manage a locker compartment;
• c. link a Parcel to the registered telephone number;
• d. generate a Pickup Code;
• e. allow a Recipient to locate and collect a Parcel;
• f. verify a telephone number using a TAC;
• g. display Parcels linked to a verified telephone number; and
• h. record the deposit, storage and collection of a Parcel.

4.2 Sending Service Notifications

We may use Personal Data to send:

• a. the initial collection notification;
• b. collection instructions;
• c. the Pickup Code;
• d. TAC messages;
• e. payment notifications;
• f. overdue storage reminders;
• g. the seventh-day reminder;
• h. the fifteenth-day reminder;
• i. the transfer-to-Headquarters notification;
• j. redelivery information;
• k. refund updates; and
• l. the final disposal notification.

These communications are service-related communications and are necessary for the operation, security and administration of the Boxbox service.

4.3 Calculating and Processing Charges

We may use Personal Data to:

• a. calculate the first twenty-four-hour free storage period;
• b. calculate RM2.00 daily storage charges after the free storage period;
• c. determine whether payment is required before collection;
• d. process or confirm payments;
• e. calculate redelivery fees;
• f. identify duplicate or unsuccessful payments; and
• g. process refund applications.

4.4 Managing Overdue and Unclaimed Parcels

We may use Personal Data to:

• a. identify Parcels that have remained uncollected;
• b. send overdue notifications;
• c. remove a Parcel from a locker after thirty (30) days;
• d. transfer the Parcel to Boxbox Headquarters or another designated storage facility;
• e. verify a Recipient seeking to reclaim the Parcel;
• f. arrange redelivery;
• g. calculate continuing storage charges; and
• h. manage the return, destruction or disposal of Parcels that remain unclaimed for ninety (90) days.

4.5 Security and Fraud Prevention

We may process Personal Data to:

• a. prevent unauthorised Parcel collection;
• b. verify Pickup Codes and TACs;
• c. prevent repeated unauthorised verification attempts;
• d. investigate suspected fraud or misuse;
• e. detect unusual system activity;
• f. investigate locker damage;
• g. protect Parcels, lockers, Users and property; and
• h. maintain system and operational security.

4.6 Customer Support and Dispute Management

We may use Personal Data to:

• a. respond to enquiries;
• b. resolve collection problems;
• c. investigate incorrect charges;
• d. process refund applications;
• e. investigate notification issues;
• f. manage disputes and complaints;
• g. verify Parcel ownership or entitlement; and
• h. maintain records of resolutions and customer support actions.

4.7 Service Improvement and Administration

We may process Personal Data to:

• a. maintain and improve the Boxbox system;
• b. analyse locker usage and capacity;
• c. diagnose technical problems;
• d. improve collection and notification processes;
• e. conduct internal audits;
• f. prepare operational reports;
• g. maintain business and accounting records; and
• h. train authorised personnel.

Where possible, Boxbox may use aggregated or de-identified information for analytics and service improvement.

4.8 Legal and Regulatory Purposes

We may process and disclose Personal Data where reasonably necessary to:

• a. comply with Malaysian laws and regulatory requirements;
• b. respond to a lawful request, court order or investigation;
• c. establish, exercise or defend legal rights;
• d. report suspected criminal activity;
• e. maintain financial, tax and transaction records; and
• f. comply with personal data breach reporting or notification obligations.

5. Mandatory and Optional Personal Data

The following information is generally required to provide the Boxbox Parcel service:

• a. Parcel tracking number;
• b. Recipient telephone number;
• c. locker location; and
• d. Parcel deposit information.

A telephone number is required to:

• a. link the Parcel to the intended Recipient;
• b. send collection notifications;
• c. provide the Pickup Code; and
• d. complete TAC verification where the Pickup Code is unavailable.

Where the required information is not provided, is inaccurate or cannot be verified, Boxbox may be unable to:

• a. register the Parcel;
• b. send a collection notification;
• c. identify Parcels linked to the Recipient;
• d. verify the Recipient;
• e. open the locker compartment;
• f. process a refund; or
• g. arrange redelivery of an overdue Parcel.

Other information requested by Boxbox may be optional unless it is reasonably required to verify a claim, investigate an incident, process a refund or comply with applicable law.

6. Disclosure of Personal Data

Boxbox may disclose Personal Data to the following categories of parties where reasonably necessary.

6.1 Couriers, Senders and Merchants

We may disclose Parcel status, locker location, collection status and other relevant information to the Courier, sender or merchant responsible for the Parcel.

6.2 Notification Service Providers

We may disclose relevant contact and notification information to:

• a. WhatsApp or related service providers;
• b. SMS gateway providers; and
• c. tracking.my.

6.3 Payment Service Providers

We may disclose payment-related information to:

• a. Touch ’n Go eWallet;
• b. GrabPay;
• c. Boost; and
• d. payment processing and settlement providers.

6.4 Redelivery and Logistics Providers

Where an overdue Parcel must be redelivered, returned or transferred, we may disclose relevant information to delivery, transport, warehouse or logistics providers.

6.5 Property Management

We may disclose relevant locker, access or security information to apartment, building, commercial property or site management where reasonably necessary to:

• a. maintain access to the locker;
• b. investigate a security incident;
• c. maintain the locker location; or
• d. protect persons and property.

6.6 Technology and Service Providers

We may disclose Personal Data to authorised providers that support:

• a. cloud hosting;
• b. databases;
• c. system maintenance;
• d. cybersecurity;
• e. messaging;
• f. customer support;
• g. analytics;
• h. document storage; and
• i. business operations.

These providers may only process Personal Data for authorised purposes and subject to appropriate confidentiality and data protection obligations.

6.7 Professional Advisers

We may disclose relevant information to auditors, insurers, accountants, legal advisers and other professional advisers where reasonably necessary.

6.8 Authorities and Legal Disclosures

We may disclose Personal Data to law enforcement agencies, regulators, courts, government departments or other authorities where:

• a. required or permitted by law;
• b. necessary to comply with a lawful request;
• c. necessary to investigate suspected illegal activity; or
• d. necessary to protect the rights, safety or property of Boxbox or another person.

6.9 Business Transfers

If Boxbox or the relevant business is reorganised, merged, acquired, transferred or sold, Personal Data may be disclosed or transferred as part of that transaction, subject to applicable legal requirements.

Boxbox does not sell or rent Personal Data to third parties for their own independent marketing purposes.

7. Cross-Border Processing

Some third-party service providers, messaging platforms, payment providers, cloud providers or technology systems used by Boxbox may process or store Personal Data outside Malaysia.

Where Personal Data is transferred outside Malaysia, Boxbox will take reasonable steps to ensure that the transfer is made in accordance with applicable Malaysian data protection requirements.

• a. assessing the destination and service provider;
• b. implementing contractual safeguards;
• c. limiting the Personal Data transferred;
• d. applying security and access controls; and
• e. obtaining consent where required.

8. Data Security

Boxbox takes reasonable administrative, technical and physical measures to protect Personal Data against:

• a. loss;
• b. misuse;
• c. unauthorised access;
• d. unauthorised disclosure;
• e. unauthorised alteration;
• f. accidental destruction; and
• g. unlawful processing.

These measures may include:

• a. access restrictions;
• b. staff confidentiality obligations;
• c. user verification controls;
• d. TAC and Pickup Code security controls;
• e. system activity logs;
• f. security monitoring;
• g. secure system configuration;
• h. backup and recovery procedures; and
• i. vendor and service provider controls.

No electronic system, internet transmission or storage method can be guaranteed to be completely secure. Users should keep Pickup Codes, TACs, mobile devices and communication accounts secure and must not disclose collection credentials to unauthorised persons.

9. Personal Data Breaches

Where Boxbox becomes aware of a Personal Data breach, Boxbox may:

• a. investigate the nature and scope of the incident;
• b. take steps to contain and remedy the incident;
• c. assess the possible impact on affected individuals;
• d. notify relevant authorities where required; and
• e. notify affected individuals where required or reasonably appropriate.

Any notification may include information about the incident, the possible risks, actions taken by Boxbox and steps the affected person may take to protect themselves.

10. Accuracy of Personal Data

Boxbox takes reasonable steps to maintain Personal Data that is accurate, complete, not misleading and up to date for the purposes for which it is processed.

The Courier or sender is responsible for entering the correct:

• a. Parcel tracking number;
• b. Recipient telephone number; and
• c. locker location.

Recipients should contact Boxbox customer support as soon as possible if they believe that Personal Data relating to them is incorrect.

Boxbox may require verification before changing Personal Data linked to a Parcel to prevent unauthorised access or collection.

11. Retention of Personal Data

Boxbox will retain Personal Data only for as long as reasonably necessary for:

• a. providing the Boxbox service;
• b. completing Parcel collection, transfer, redelivery or disposal;
• c. maintaining security and transaction records;
• d. processing payments and refunds;
• e. resolving complaints and disputes;
• f. preventing fraud and unauthorised collection;
• g. maintaining financial, audit and legal records; and
• h. complying with applicable laws.

Different categories of Personal Data may be retained for different periods.

The physical Parcel storage period under the Boxbox Terms and Conditions is separate from the retention period for electronic records relating to the Parcel.

Even after a Parcel has been collected or disposed of, Boxbox may retain relevant transaction, notification, payment, security and support records where reasonably required for legal, audit, dispute resolution or fraud prevention purposes.

When Personal Data is no longer reasonably required, Boxbox may securely delete, destroy, anonymise or de-identify it.

12. Cookies and Similar Technologies

The Boxbox website or supported applications may use cookies, local storage or similar technologies to:

• a. enable essential website functions;
• b. maintain user sessions;
• c. remember preferences;
• d. improve website performance;
• e. identify technical errors;
• f. maintain security; and
• g. understand how users interact with the service.

Users may be able to control cookies through their browser or device settings.

Disabling essential cookies may prevent certain website or service features from functioning correctly.

13. Service Communications and Marketing

13.1 Service Communications

Boxbox may send service-related communications that are necessary to operate the Parcel locker service, including:

• a. Pickup Codes;
• b. TAC messages;
• c. collection notifications;
• d. storage charge reminders;
• e. overdue notifications;
• f. transfer notifications;
• g. disposal notifications;
• h. payment confirmations;
• i. refund updates; and
• j. security alerts.

These communications are not promotional marketing messages.

A User may not be able to opt out of service communications while a Parcel remains linked to their telephone number or while an active transaction, payment, refund, complaint or security matter remains unresolved.

13.2 Marketing Communications

Where Boxbox sends promotional or marketing communications, Boxbox will obtain consent where required and provide an appropriate method to withdraw or unsubscribe.

Withdrawing from marketing communications will not prevent Boxbox from sending necessary service-related notifications.

14. Automated Processing

Certain Boxbox functions may operate automatically, including:

• a. generating Pickup Codes;
• b. sending TAC messages;
• c. linking Parcels to a verified telephone number;
• d. calculating storage duration and charges;
• e. identifying overdue Parcels;
• f. triggering reminder notifications; and
• g. determining whether payment is required before a locker can be opened.

Where a User believes that an automated result is incorrect, the User may contact Boxbox customer support and request that the matter be reviewed.

15. Your Personal Data Rights

Subject to applicable Malaysian law and any permitted exceptions, you may have the right to:

• a. request confirmation as to whether Boxbox processes your Personal Data;
• b. request access to your Personal Data;
• c. request correction of inaccurate, incomplete or outdated Personal Data;
• d. withdraw consent where processing is based on consent;
• e. request that certain processing be limited;
• f. object to processing that may cause unwarranted damage or distress;
• g. object to or opt out of direct marketing;
• h. request information about the purposes for which your Personal Data is processed;
• i. request information about the categories of parties to whom your Personal Data may be disclosed;
• j. request data portability where applicable under Malaysian law; and
• k. submit a complaint regarding the handling of your Personal Data.

Some rights may be restricted where Boxbox is required to retain or process the information for:

• a. Parcel collection and security;
• b. fraud prevention;
• c. payment and accounting records;
• d. dispute resolution;
• e. legal claims; or
• f. compliance with applicable law.

16. How to Submit a Privacy Request

A privacy request may be submitted through the official Boxbox website or available Boxbox customer support channels.

The request should include:

• a. the registered telephone number;
• b. the Parcel tracking number, where relevant;
• c. a clear description of the request; and
• d. sufficient information to verify the identity of the person making the request.

Boxbox may request additional verification before providing access to, correcting, transferring or deleting Personal Data.

This is necessary to prevent Personal Data from being disclosed or changed at the request of an unauthorised person.

Boxbox will respond within the period required by applicable law or within a reasonable period where no specific statutory period applies.

17. Withdrawal of Consent

Where Boxbox relies on consent to process Personal Data, the individual may withdraw that consent by contacting Boxbox.

Withdrawal of consent:

• a. does not affect processing lawfully carried out before the withdrawal;
• b. does not prevent processing required by law; and
• c. may affect Boxbox’s ability to provide certain services.

Where the telephone number is required to link, notify, verify or release a Parcel, withdrawing consent before collection may prevent the Recipient from using the normal Boxbox collection process.

18. Personal Data Relating to Other Individuals

A Courier, sender, merchant or User who provides Personal Data relating to another individual confirms that they are authorised to provide that information for the relevant Parcel delivery, notification and collection purposes.

The person providing the information must take reasonable steps to ensure that:

• a. the information is accurate;
• b. the intended Recipient is aware that their information has been provided; and
• c. the information is not used to send a Parcel or notification to the wrong person.

19. Minors

The Boxbox service is not specifically directed at children.

Where Personal Data relating to a minor is provided by a Courier, sender, merchant, parent, guardian or another authorised person, that person is responsible for ensuring that they have the authority to provide the information.

Boxbox may require assistance or verification from a parent, guardian or authorised adult before processing certain privacy requests relating to a minor.

20. Third-Party Websites and Services

The Boxbox website, messages or applications may contain links or connections to third-party services, including:

• a. WhatsApp;
• b. tracking.my;
• c. Touch ’n Go eWallet;
• d. GrabPay;
• e. Boost; and
• f. courier or redelivery services.

Boxbox does not control the privacy practices of these independent third parties.

Users should review the privacy policies and terms of the relevant third-party service before providing information directly to that service.

21. Changes to This Privacy Policy

Boxbox may revise this Privacy Policy to reflect changes in:

• a. Boxbox services;
• b. technology or security practices;
• c. notification and payment providers;
• d. operational procedures; or
• e. applicable legal and regulatory requirements.

The revised Privacy Policy may be published through:

• a. the Boxbox website;
• b. the Boxbox locker interface;
• c. tracking.my or another supported application; or
• d. another appropriate communication channel.

The revised Privacy Policy will take effect from the effective date stated in the published version.

22. Contacting Boxbox

Questions, complaints, access requests, correction requests, withdrawal requests and other privacy-related enquiries may be submitted through the official Boxbox website or available Boxbox customer support channels.

When contacting Boxbox, please provide enough information for Boxbox to identify and respond to the request.

Do not send a Pickup Code or active TAC unless specifically requested through an authorised and secure Boxbox support process.

23. Governing Law

This Privacy Policy is governed by the laws of Malaysia.

Nothing in this Privacy Policy limits any Personal Data right or remedy that cannot lawfully be excluded under applicable Malaysian law.