Your data. Clearly explained.
This policy explains what personal data Boxxpro processes, why it is needed and the choices you have. It covers our website, application and Google Calendar integration.
Last updated: 22 September 2026
- You choose whether to connect Google Calendar.
- Disconnecting does not delete your Boxxpro bookings.
- Google Calendar data is not used for advertising or AI training.
1. Who is responsible?
Boxxpro is a service of Lilopel BV, registered with the Dutch Chamber of Commerce under number 66544122, VAT number NL856601317B01. Contact us about privacy or personal data requests at info@boxxpro.com.
Lilopel BV is the controller for data relating to our own accounts, customer relationships, support, billing and website. For personal data your organisation enters in Boxxpro, such as customer or employee information, Boxxpro generally acts as a processor on your organisation’s behalf. That organisation determines the purpose of the processing. If you are a customer or employee of a Boxxpro user, contact that organisation first; we assist where needed.
2. What data do we process?
This depends on the features you use. Data comes from you, authorised users in your organisation or a service you choose to connect.
- Account and contact: name, business email, company information, user permissions and login credentials.
- Business administration: customer and supplier information, invoices, quotations, payments, bank transactions, projects, tasks, hours, bookings, documents and notes you add.
- Support: information you provide when contacting us.
- Technical data: IP address, browser and device information, sessions and technical or security records.
- Optional integrations: information and permissions required for an enabled integration. Google Calendar is described separately below.
Only enter information needed for your administration. Avoid medical or other sensitive information in appointment titles or notes that will be synchronised to an external calendar.
3. Purposes and legal bases
- Providing the service: managing accounts, processing business records, running chosen integrations and providing support. For our own customer relationship, this is necessary to perform a contract or take steps you request before entering one.
- Reliability and security: resolving faults, preventing abuse and protecting access, based on our legitimate interests while considering your privacy interests.
- Legal obligations: including our own financial records and responding to valid legal requests.
- Consent: for optional analytics cookies and access to your Google account. You can withdraw consent.
When we process data for your organisation, that organisation determines the applicable legal basis. Without necessary account information we cannot provide an account. Google Calendar and analytics cookies are optional.
4. Google Calendar: access and use
Boxxpro Agenda is the name of our Google integration. It activates only after an authorised user chooses a Google account and grants access. Boxxpro does not receive your Google password.
The integration requests Google Calendar permission to view, create, modify and delete calendars and events. This permission is technically broad. Boxxpro uses it for its visible calendar and synchronisation features; it does not provide access to Gmail messages.
- Bookings: Boxxpro retrieves the primary calendar’s identification, including the account email. New and updated bookings are sent to that calendar. Cancelling or deleting a booking can remove its Google event.
- Event content: customer name, product or service, start and end times, time zone, booking reference and notes may be included. Only enter information you want displayed there.
- The existing task integration: Boxxpro may read your calendar list to find or create the Boxxpro calendar, and read, create, update and delete task events in it.
- Storage: we retain connection details such as the connected address, calendar or event identifiers and tokens needed for synchronisation. The bookings integration’s refresh token is encrypted at rest; temporary access tokens are cached.
Google receives information needed to update your calendar. People who can access that calendar may see events according to your Google sharing settings. We do not sell Google user data or use it for advertising, credit assessment or training general-purpose AI models. This calendar integration does not forward data obtained from Google APIs to our AI features.
Human access to data obtained from Google is limited to your specific consent or necessary security, troubleshooting or legal actions. Our use and any transfer of information received from Google APIs comply with the Google API Services User Data Policy, including Limited Use requirements.
Disconnecting and deleting data
In Boxxpro, open Bookings → Calendar sync → Disconnect. This removes the connected address, stored tokens and Google event references for that bookings connection from the active application. Your Boxxpro bookings remain.
- Without cleanup: existing Google events remain. Since their references are cleared, you may need to delete those events yourself in Google afterwards.
- With cleanup: select the option to also remove appointments from Google Calendar before disconnecting. Boxxpro first attempts to delete the linked events. A failure or missing Google access may still require manual deletion.
Disconnecting bookings does not automatically revoke other Boxxpro integrations or companies’ access. You can revoke all Google access for the app at myaccount.google.com/connections. This may also affect task synchronisation and other connections using the same Google account. For deletion of other Boxxpro data, contact info@boxxpro.com.
6. Retention
Retention depends on the purpose and arrangements with your organisation. We apply these criteria:
- Accounts and business records: while needed to deliver the service, then to complete cancellation, export, deletion requests or a specific dispute. Data held as a processor is also subject to your organisation’s instructions and agreements.
- Our own billing: for applicable statutory accounting and tax retention periods. This does not mean all account content must be kept equally long.
- Support and security records: as needed for the request, investigation, abuse prevention or substantiation of a claim.
- Google connection data: while connected; disconnecting bookings clears the active connection data described above. Events in Boxxpro and Google have separate lifecycles.
- Backups: deleted data may remain temporarily in existing backups until replaced or removed under the applicable backup schedule. A deletion request does not necessarily erase every backup copy immediately.
Cancelling a subscription, disconnecting an integration and deleting data are different actions. If needed, request an export before cancellation and specify what you wish to delete. Email us for the concrete periods applicable to your account.
8. Security and access
We take measures against unauthorised access, loss and misuse, including secure connections, authentication and user permissions. Not every employee or user should have access to all data. Protect your credentials, grant only necessary permissions and use available additional security. No system can guarantee absolute security.
9. Your privacy rights
Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your data. You may object to processing based on legitimate interests and withdraw consent. Withdrawal does not retrospectively invalidate earlier lawful processing.
Email info@boxxpro.com. We may appropriately verify that a request comes from the right person. We generally respond within one month; if a statutory extension is needed, we explain this within that period. Legal obligations or other people’s rights may limit a request, in which case we explain why.
You may also complain to the Dutch Autoriteit Persoonsgegevens or the relevant privacy authority in your country.
10. Changes and contact
We update this policy when the service or our practices change. The date above shows the last update. We will inform you of significant changes where required. This policy does not replace any data processing agreement with your organisation.
Privacy contact: Lilopel BV / Boxxpro — info@boxxpro.com.
A question or a privacy request?
Email us with your organisation’s name and a description of your request. Do not include passwords, access codes or a copy of your identity document.
info@boxxpro.com