Privacy notice

Data controller

2BOX, including TeaBox and JuiceBox, is a product range of GustoProducts OE, Larisis–Karditsis Ring Road, Rizario, Trikala 42131, Greece. Privacy and rights contact: [email protected].

Business enquiries

We use your contact and business details, region, product interests and message to verify your email and respond to your specific enquiry. Verified enquiries and subsequent updates are handled centrally by the team at [email protected]. The team may privately assign your enquiry to the appropriate partner to assist you.

An enquiry does not subscribe you to the newsletter. Your personal email link lets you update contact preferences or stop further handling of the enquiry. It does not create a partner account, order or contract.

Why we process information

Necessary details for a quotation or agreed transaction are used for pre-contractual steps or performance of a contract (GDPR Article 6(1)(b)). Handling business representatives’ enquiries and protecting the site rely on legitimate interests in service and security (6(1)(f)). Mandatory transaction records are retained under legal obligations (6(1)(c)).

Newsletter subscriptions, publication of reviews and optional Google/Meta measurement rely on separate consent (6(1)(a)) where enabled. Advertising consent is not required to handle an enquiry. We do not make decisions with legal or similarly significant effects solely through automated processing.

Partner quotations and orders

The private quotation/order process uses contact, business, billing and delivery details, selected products and acceptance or payment status. Public interest forms remain separate. Internal management access is restricted to authorised people.

Newsletter with email confirmation

Subscription is optional, requires separate consent and is activated only after you confirm your email. TeaBox/JuiceBox interests help us send relevant information. New confirmed subscribers are kept in a separate Brevo list.

You can withdraw consent through the unsubscribe link or by contacting [email protected]. Unsubscribing does not automatically delete a separate business enquiry or transaction records. We retain the necessary unsubscribe indication to prevent resubscription without fresh consent.

Email and engagement measurement

Service emails from the site —such as email verification, enquiry and offer updates— are sent through Cloudflare without open-tracking images or click-tracking links. Personal links are used to verify or manage your request. Brevo is used separately for newsletter management.

Consent to receive a newsletter is not automatically consent to individual tracking. Before any newsletter campaign, choice and withdrawal controls will be finalised for measurement requiring consent. Contact [email protected] for information or to object.

Product reviews

Reviews require email verification and consent to publish your display name, rating and text alongside the product. Your email is not published. Reviews are checked before publication; both positive and negative experiences can be published.

The team at [email protected] receives notice of new verified reviews. Contact [email protected] to correct or remove your review. Test reviews are never presented as real customer experiences.

Providers and security

The site is hosted through Lovable. Cloudflare handles forms, stored submissions and service email delivery; Brevo provides newsletter management. Access is limited to authorised people and necessary service providers. Personal confirmation links are time-limited.

The submissions database is configured in the EU. This does not mean that every provider operation takes place exclusively in the EU. Processing terms and safeguards for any international transfers will be finalised before public activation. Contact [email protected] for information. Technical abuse-prevention counters do not store the original IP address.

Retention

Information is retained for its purpose: responding to an enquiry, managing a relationship, maintaining a subscription or publishing a review. Enquiries that do not lead to a business relationship are reviewed after 12 months without meaningful contact. We check whether a documented need to retain the data remains; otherwise personal details are erased or anonymised following review. This internal review does not trigger a new email to you. Statutory obligations for transaction records are considered separately.

Expiry of a confirmation link does not automatically delete its record. A request to stop further contact takes effect immediately for that enquiry. You may also request erasure of your personal data.

Browsing and your rights

Boxy uses site content and does not send conversations to an external AI service. The site, including its QR menus, serves its fonts and videos from its own files. External destinations, including the Gusto eShop and social networks, have their own policies.

Where the GDPR applies, you may request access, correction, erasure and, where applicable, restriction, objection or portability. Withdrawal of consent does not affect the lawfulness of prior processing. Contact [email protected] to ask questions or exercise your rights. You may complain to the competent supervisory authority, including the Hellenic Data Protection Authority in Greece.

Lovable hosting statistics

The published site uses Lovable Visitor analytics for aggregate traffic: visits, page views, sources, countries and device types. Counting starts after publication. According to the provider’s documentation, it does not build individual visitor profiles or follow visitors across separate visits. These statistics are separate from optional Google and Meta measurement.

Optional Google and Meta measurement

Google Analytics and Meta Pixel/CAPI operate only at the official public address, when enabled and after you select the relevant category. Statistics and advertising measurement are separate, unchecked choices. Refusing does not prevent browsing or form use.

Google Analytics measures selected public pages and actions. Meta may associate a visit or successful enquiry submission with an account using technical information such as IP address, browser and optional cookie identifiers. We do not send names, email addresses, phone numbers, form messages, Boxy chat text or private enquiry links to measurement services. An enquiry event does not mean a sale.

Your choice lasts up to 180 days and can be changed through Cookie settings in the footer. Withdrawal stops subsequent measurement. When permitted, cookies _ga and _ga_* may be used for Google and _fbp/_fbc for Meta, in addition to the locally stored consent choice.