Privacy Policy
Last updated: 16 September 2026
Who we are
Lockbox Digital B.V. (“Lockbox Digital”, “we”, “us”) is an ecommerce growth agency registered in the Netherlands.
- Address: Joan Muyskenweg 30J, 1114 AN Amsterdam
- Chamber of Commerce (KvK): 42100052
- Contact for anything in this policy: info@lockboxdigital.com
- Website: lockboxdigital.com
We are the controller of the personal data described here, which means we decide why and how it is processed.
We have not appointed a Data Protection Officer, and we are not required to: we do not carry out large-scale monitoring and we do not process special categories of data.
What this policy covers
This policy covers lockboxdigital.com and lockboxdigital.nl, their Dutch-language pages under /nl/, and the campaign landing pages served under /lp/.
It does not cover work we carry out inside a client’s own systems. There the client is the controller and their policy applies, not ours.
What we collect, and why
1. When you fill in a form
Our forms ask for some combination of: first name, last name, work email address, company name, company website, job title, monthly marketing budget range, how far along you are with AI visibility, and whatever you type into a message field. Which of these appear depends on the form. None of our forms ask for more than seven visible fields.
We also record which language you filled the form in, so we reply in Dutch or English rather than guessing.
Alongside what you type, the form sends how you arrived: the campaign parameters in the URL you landed on (utm_source, utm_medium, utm_campaign, utm_content, utm_term), advertising click identifiers if present (Google’s gclid, gbraid, wbraid; Meta’s fbclid; Microsoft’s msclkid; LinkedIn’s li_fat_id; Reddit’s rdt_cid; TikTok’s ttclid), the page you landed on, the website that referred you, and the first of those we ever recorded for you. Identifiers we have no dedicated field for are stored together as a single JSON value on your contact record.
Why: to answer your enquiry, and to know which campaign it came from so we do not spend money on channels that do not work.
Legal basis: taking steps at your request before entering a contract (Art. 6(1)(b)) for the reply itself; our legitimate interest in measuring our own marketing (Art. 6(1)(f)) for the attribution data. Where that data is read from a cookie that required your consent, the basis for the cookie is your consent (Art. 6(1)(a)).
Where it goes: HubSpot, our CRM. Our HubSpot account uses EU data residency, so these records are stored in the European Union.
2. When you download something we gate
If you give us your details to download a report, we send you the file immediately on the same page. We then contact you once with an offer of a personalised session. That is the entire sequence. We do not run a drip campaign and we do not add you to a recurring newsletter.
Legal basis: consent, given by submitting the form, for that single follow-up. You can tell us to stop at any time and we will.
3. When you simply visit
With your consent, we use:
- Google Analytics 4 to count visits and see which pages and campaigns work.
- Google Ads to measure advertising, and to build remarketing audiences, lists of browsers that have visited us, which we can later show ads to on Google’s networks.
- Meta Pixel and the Meta Conversions API to measure and target advertising.
Without your consent, none of these run. Our consent banner defaults to denying analytics, advertising and personalisation storage for visitors in the EEA, the UK and Switzerland, and nothing is loaded until you choose. Strictly necessary storage, the record of your own consent choice, is the only thing set before you decide.
What we send to Google Ads is not only form submissions. With your consent we also report when you click a call-to-action button, when you start filling in a form, and when you leave a page with a form part-filled. We use these to understand where our own pages lose people. They are reported as events tied to advertising identifiers, not to your name or email.
The Meta Conversions API sends conversion events from our server rather than your browser. When it fires after a form submission it sends Meta: a SHA-256 hash of your email address (the hash is computed in your browser, and your actual email address is never sent to Meta by us), Meta’s own _fbp and _fbc cookie values if present, your IP address, your browser’s user-agent string, and the URL of the page. We send the hash rather than the address so Meta can match you if it already knows you, without us handing over a readable email.
Legal basis: consent.
4. Server logs
Our host records standard web-server logs, including IP addresses, for security and to keep the site running.
Legal basis: legitimate interest in the security and availability of our own site (Art. 6(1)(f)).
Cookies and similar storage
| Name | Set by | Purpose | Lifetime | Needs consent |
|---|---|---|---|---|
cookieyes-consent | CookieYes | Remembers your consent choice | 1 year | No, strictly necessary |
lb_attr_first | Us | The first campaign we ever saw you arrive from | 365 days | Yes |
lb_attr_last, lb_attr_first_pending | Us | Held in your browser’s session storage only, cleared when you close the tab | Session | No |
_ga, _ga_* | Google Analytics | Distinguishes visitors | Up to 2 years | Yes |
_gcl_au | Google Ads | Measures ad conversions | 90 days | Yes |
_gcl_aw | Google Ads | Stores the Google ad click that brought you, so a later enquiry can be attributed to it | 90 days | Yes |
_fbp | Meta | Identifies a browser to Meta | 3 months | Yes |
_fbc | Meta | Stores the ad click that brought you | 3 months | Yes |
Google and Meta also write a few localStorage entries once you consent (_gcl_ls, multiFbc, lastExternalReferrer) for the same advertising measurement purposes.
One deliberate detail, and you can check it. Before you give consent we do not write the 365-day lb_attr_first cookie at all. Your first-touch campaign is held in session storage and thrown away when you close the tab. It only becomes a durable cookie if you consent. A year-long identifier written before anyone agreed to it is not something we are willing to defend.
You can change or withdraw your choice at any time through the cookie banner, and you can delete cookies in your browser at any time.
Who else sees your data
We use the following processors. Each handles data on our instructions.
| Processor | What they do for us | Where |
|---|---|---|
| HubSpot | CRM. Stores your enquiry and contact record | EU data residency |
| Google (Analytics, Ads, Tag Manager) | Measurement, advertising and remarketing audiences | US, with EU processing terms |
| Meta | Advertising measurement and targeting | US |
| CookieYes | Records your consent choice | EU/UK |
| SiteGround | Website hosting | European Union (Netherlands) |
We do not sell your personal data. We do not share it with anyone else except where we are legally required to.
Transfers outside the EEA. Google and Meta process data in the United States. Those transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified, and on Standard Contractual Clauses otherwise.
How long we keep it
| Data | Kept for |
|---|---|
| Enquiries that did not become clients | 24 months from our last contact with you |
| Client records | The length of the relationship, then 7 years, to meet Dutch tax record-keeping obligations |
| Analytics data in GA4 | 14 months |
| Server logs | 30 days |
When a period ends we delete the data, or anonymise it so it can no longer identify you.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and get a copy.
- Rectification: have anything inaccurate corrected.
- Erasure: have it deleted, where no obligation requires us to keep it.
- Restriction: have us pause processing while a dispute is resolved.
- Portability: receive the data you gave us in a machine-readable format.
- Object to processing based on our legitimate interests, including profiling for marketing. If you object to direct marketing we will stop, with no balancing test.
- Withdraw consent at any time, without affecting anything done before you withdrew it.
To exercise any of these, email info@lockboxdigital.com. We will respond within one month.
Automated decision-making: we do not make decisions about you by automated means that produce legal or similarly significant effects.
Complaints: if you think we have handled your data badly, please tell us first, because we would rather fix it. You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live.
Children
Our services are sold to businesses. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.
Changes to this policy
If we change this policy we will update the date at the top. If a change materially affects how we use your data, we will say so more prominently than a date.