Privacy Policy

Last reviewed: 4 Oct 2026

This policy explains how ExpressBox handles personal data on expressbox.in and in the services we provide. It is written to meet the Digital Personal Data Protection Act, 2023 (the "DPDP Act") and the rules made under it. Under that law we are the Data Fiduciary and you are the Data Principal.

1. Who we are

ExpressBox is a trading name of Color Papers India Private Limited, a company registered in India.

• Registered office: II Floor, Sector D-I, Lucknow, Uttar Pradesh 226012, India
• GSTIN: 09AAJCC2415M1ZH
• Privacy and grievance contact: hello@expressbox.in (put "Privacy" in the subject line)

Email is our primary contact channel. We do not currently publish a telephone number.

2. What we collect

2.1 Details you type into our forms

This website has three forms. Each one sends what you enter to our team mailboxes and sends an automatic acknowledgement to the email address you gave.

• Contact form (expressbox.in/contact): your name, email address, phone number (optional), company name (optional), the type of enquiry and your message.
• Quote request (expressbox.in/quote): your name, email address, phone number, origin and destination, approximate weight, the service you want and the type of goods.
• Free shopping address sign-up (expressbox.in/free-address): your name, email address, mobile number and the country you live in. We use these to issue your personal ExpressBox ID and warehouse addresses.

When you submit any form, our form handler also records your IP address and the date and time of the submission. This is used to limit spam and repeat submissions and to investigate abuse.

2.2 Shipment data

To move a parcel and clear it through customs we need the information a carrier and a customs authority require: sender and recipient names, addresses, phone numbers and email addresses; a description, declared value and weight of the contents; invoices or receipts for the goods; and, where a customs authority requires it, identity or tax documents (for example, the KYC documents Indian customs ask for on imports). Tracking events for a shipment are also personal data where they can be linked to you.

2.3 Technical data

Like almost every website, our web server and the services in front of it keep standard access logs: the IP address, date and time, pages requested, referring page, and browser and device type. Section 3 explains the analytics tools we use.

2.4 Payments

This website does not take payments. If you pay us for a shipment, your bank or payment provider processes the payment and we keep the transaction record we need for invoicing and accounts.

3. Cookies, analytics and third-party resources

We use the following services on expressbox.in. They may set cookies or use similar technologies in your browser.

• Google Tag Manager loads our measurement tags. It does not itself collect personal data beyond the request to Google's servers.
• Google Analytics 4 tells us how the site is used: pages viewed, how visitors arrived, approximate location, device and browser. We have switched on IP anonymisation, so Google truncates your IP address before storing it. Google Analytics sets cookies with names beginning _ga.
• Microsoft Clarity records how visitors move through pages (clicks, scrolls and session replays) and builds heatmaps so we can improve the site. Clarity sets cookies such as _clck and _clsk.
• Cloudflare sits in front of our server to block attacks and speed up delivery. It sees your IP address and request headers, may set security cookies such as __cf_bm or cf_clearance, and may record aggregated, cookie-free performance analytics.
• Google Fonts and Unsplash serve the typefaces and some photographs on the site from their own servers. When your browser fetches them it sends those providers your IP address and browser details, as it does for any web resource.

We also store two small items in your browser's local storage, not as cookies: your day/night display preference (eb-theme) and, on the contact page, the times of your recent form submissions so the form can limit repeat sending. Neither is sent to us.

Your choices. You can block or delete cookies in your browser settings; the site still works without them. Google offers a browser add-on that stops Google Analytics from collecting data, and both Google and Microsoft publish opt-out controls for their analytics services.

4. Why we process your data and on what legal basis

We process personal data only for the purposes below, and only as far as needed for each purpose.

• To reply to you when you send an enquiry or ask for a quote.
• To provide the service you ask for: issuing your free shopping address, receiving, consolidating and forwarding your parcels, booking carriers, preparing customs declarations and keeping you informed about a shipment.
• To meet legal obligations under Indian customs, tax, company and anti-money-laundering law, and the laws of the destination country for cross-border shipments.
• To keep the service secure by preventing spam, fraud and abuse.
• To understand and improve the website through the analytics described in section 3.

Our legal basis under the DPDP Act is your consent, which you give when you submit a form or ask us to handle a shipment, together with the legitimate uses the Act permits, in particular data you have voluntarily given us for a stated purpose, processing needed to perform the shipping contract you have asked for, and compliance with Indian law. You can withdraw consent at any time (see section 8); doing so may mean we cannot complete a shipment that is already under way.

5. Who we share it with

We share personal data only with the parties needed to deliver the service, and only the data they need:

• Carriers and logistics partners in the origin and destination countries who physically move, store and deliver your parcel.
• Customs authorities and customs brokers, who receive the declaration, the contents and value of the shipment and the identity details the law requires.
• Our banks and payment providers, when you pay us or we pay a duty or tax on your behalf.
• IT and service providers that host our website and email, protect it (Cloudflare) and run the analytics in section 3 (Google, Microsoft).
• Professional advisers and authorities where the law requires it or where it is needed to establish or defend a legal claim.

We never sell personal data and we do not share it with third parties for their own marketing.

6. International transfers

Cross-border shipping means your data crosses borders too. A parcel sent to or from the USA, the UAE, the UK or China is necessarily shared with carriers and customs authorities in that country. Our analytics and infrastructure providers (Google, Microsoft and Cloudflare) are headquartered in the United States and may process data there or in other countries where they operate. The DPDP Act allows personal data to be transferred outside India except to countries the Central Government restricts by notification; we transfer only what each shipment or service requires.

7. How long we keep it

• Enquiries and quote requests: for as long as needed to answer and follow up, after which they are deleted or archived.
• Free shopping address accounts: for as long as you use the address, and afterwards for as long as any shipment, invoice or legal obligation connected to it requires.
• Shipment and invoice records: for as long as Indian tax, company and customs law require business records to be kept, which is several years after the transaction.
• Server logs and analytics: for the retention period of the provider concerned, after which only aggregated statistics remain.

When data is no longer needed for any of these purposes we delete it or anonymise it.

8. Your rights and how to use them

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we have used and shared it.
• Correction and erasure: have inaccurate or incomplete data corrected and have data erased when it is no longer needed for the purpose it was collected for or required by law.
• Withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing already carried out lawfully.
• Grievance redressal: raise a complaint with us about how we handle your data and receive a response.
• Nominate another person to exercise these rights on your behalf if you die or are incapacitated.

To use any of these rights, email hello@expressbox.in with "Privacy" in the subject line, or write to the registered office in section 1. Tell us which right you are using and enough detail to identify you; we may ask you to verify your identity before acting. We aim to acknowledge every request within one business day and to resolve it within the time the DPDP Act and its rules prescribe. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

The DPDP Act also asks you to give us accurate information, not to impersonate anyone and not to raise false or frivolous grievances.

9. How we protect it

Every page and form on expressbox.in is served over HTTPS and the site enforces secure connections. Form submissions are checked for spam and rate-limited on the server. Access to the mailboxes and records that hold customer data is limited to the people who need it to do their job. This website holds no payment card data. No system can be guaranteed completely secure; if a breach affects your personal data we will notify you and the Data Protection Board of India as the DPDP Act requires.

10. Children

Our services and this website are not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, email hello@expressbox.in and we will delete it.

11. Changes to this policy

We review this policy when the law or our services change and publish the current version on this page with the "Last reviewed" date above. Where a change materially affects how we use data you have already given us, we will also tell you by email where we have an address for you.

12. Contact and grievance redressal

• Email: hello@expressbox.in (subject line "Privacy")
• Post: Color Papers India Private Limited, II Floor, Sector D-I, Lucknow, Uttar Pradesh 226012, India

Our Terms & Conditions set out the other rules that apply when you use ExpressBox services.