Privacy Policy
Who We Are
Outside the Box Advertising (“Outside the Box,” “we,” “us,” or “our”) is a marketing and advertising agency based in the Turks and Caicos Islands. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use our website (www.outsidetheboxtci.com) or interact with our services.
Scope
This Policy applies to personal information we process about website visitors, prospective and current clients, vendors, and other contacts. By using the website, you agree to the practices described here.
Information we collect
-
Information you provide to us
-
Contact details (name, email address, phone number, company).
-
Content of communications (messages, files, briefs, project details)
-
Billing information, where applicable.
-
-
Information collected automatically
-
IP address, device and browser type, operating system, and general location (derived from IP).
-
Usage data such as pages viewed, time on page, links clicked, and referral pages (via analytics tools).
-
-
Cookies and similar technologies
-
We use cookies, pixels, and similar technologies to operate our site, understand performance, and improve content. You can manage cookies in your browser settings. Some features may not work without certain cookies.
-
Legal bases for processing (EEA/UK residents)
Where GDPR/UK GDPR applies, we rely on one or more of the following lawful bases: (i) your consent, (ii) performance of a contract or to take steps at your request before entering into a contract, (iii) compliance with a legal obligation, and/or (iv) our legitimate interests (for example, to operate, secure, and improve our services, and to communicate with you about relevant offerings).
How we use personal information
-
Provide, operate, and improve our services and website.
-
Respond to inquiries, schedule meetings, and manage client relationships.
-
Send service updates and—where permitted—marketing communications.
-
Analyze site performance and user trends.
-
Detect, prevent, and address security or technical issues.
-
Comply with legal and regulatory obligations.
Marketing communications
We may send you marketing emails where permitted by law. You can opt out at any time by using the unsubscribe link in the email or by contacting us at info@outsidetheboxtci.com
How we share information
We do not sell or rent personal information. We may share limited data with: (i) service providers (e.g., hosting, analytics, email platforms) that process data on our behalf under appropriate contracts; (ii) professional advisers; and (iii) authorities or third parties where required by law or to protect rights, safety, and security.
International transfers
We operate from the Turks and Caicos Islands and may process data in other countries (including the United States and the United Kingdom). Where GDPR/UK GDPR applies, we use appropriate safeguards for cross-border transfers, such as Standard Contractual Clauses, and implement additional measures as needed.
Data retention
We retain personal information only as long as necessary for the purposes described in this Policy, including to meet legal, accounting, or reporting requirements. We determine the appropriate retention period based on the amount, nature, and sensitivity of the data, the potential risk from unauthorized use or disclosure, the purposes of processing, and applicable legal requirements.
Specific Provisions for EU, EEA and UK Users
This section applies to you if you are located in the European Union (EU), European Economic Area (EEA), or the United Kingdom (UK).
For the purposes of the EU and UK General Data Protection Regulation (GDPR), the data controller responsible for the processing of your personal information is Outside the Box Advertising, Providenciales, Turks and Caicos Islands.
As an individual in the EU, EEA, or UK, you have the following rights in relation to your personal data:
-
Access: To obtain information about how we process your personal data and to receive a copy of the data we hold about you.
-
Rectification: To correct any inaccuracies in your personal data.
-
Erasure: To request the deletion of your data in certain circumstances, including where it's no longer necessary for us to retain it, you withdraw consent, or the data has been processed unlawfully.
-
Restriction: To request that we restrict the processing of your data if it is inaccurate, the processing is unlawful, or you object and we are considering your objection.
-
Objection: To object to processing based on our legitimate interests, particularly in cases of direct marketing, including profiling related to such marketing.
-
Portability: To receive your personal data in a structured, commonly used, and machine-readable format, and to request that we transmit it to another controller where technically feasible.
-
Information about transfers: To request details about any safeguards under which your data is transferred outside the EEA or UK.
We may ask you to verify your identity before processing your request for security purposes. In some cases, where legally permitted, we may charge a reasonable fee or decline the request if it is manifestly unfounded, excessive, or impacts the rights of others.
You also have the right to lodge a complaint with your local data protection authority if you believe your rights have been violated.
Please note that some rights, such as the right to erasure or access, may be subject to limitations under local laws and the rights of other individuals.
How to exercise your rights
Please contact us at info@outsidetheboxtci.com. We may need to verify your identity before fulfilling requests.
US state privacy rights
Residents of certain US states (including California, Virginia, Colorado, Connecticut, and Utah) may have rights to access, delete, correct, and obtain a copy of certain personal information, and to opt out of specific processing such as targeted advertising, sale of personal information, or profiling in furtherance of decisions producing legal or similarly significant effects. To exercise these rights, contact info@outsidetheboxtci.com. We will respond within the required timeframes and will not discriminate against you for exercising your rights.
Notice for California residents (CCPA/CPRA)
Categories collected (last 12 months) may include: identifiers (e.g., name, email, IP), commercial information (services requested), internet or network activity (site interactions), approximate geolocation (from IP), and inferences drawn from these categories. We do not sell or share personal information as defined by the CPRA, and we do not use or disclose sensitive personal information for purposes other than those permitted by the CPRA. You may use an authorized agent to submit a request, subject to verification requirements. We honor browser-based opt-out signals (such as Global Privacy Control) where required by law.
Cookies, analytics, and ‘Do Not Track’
You can control cookies through your browser settings and, where available, through on-site preference tools. Because there is no universal ‘Do Not Track’ standard, we currently do not respond to DNT signals. We honor Global Privacy Control where legally required.
Security
We use reasonable technical and organizational measures designed to protect personal information. However, no method of transmission or storage is completely secure.
Children’s privacy
Our website is not intended for children under 13. We do not knowingly collect personal information from children under 13 (or under 16 where GDPR applies). If you believe a child has provided us information, please contact us so we can delete it.
Third-party links
Our website may link to third-party sites. We are not responsible for their privacy practices.
Changes to this Policy
We may update this Privacy Policy from time to time. When we do, we will revise the Effective Date above.
Contact & Data Controller
Outside the Box Advertising
Email: info@outsidetheboxtci.com
Website: www.outsidetheboxtci.com
Address: Providenciales, the Turks and Caicos Islands
