The client
BOXPARK’s philosophy is EAT.DRINK.PLAY. Boasting 3 existing venues within London, and with plans to expand across the UK, BOXPARK is a leading hospitality organisation that offers street food, drinks, and entertainment all under one roof. Beginning in 2011 with the humble ethos of bringing shipping containers to east London, BOXPARK transformed the space into the world’s first pop-up dining and shopping destination that year. Now, a decade later, BOXPARK has three established venues across London with local communities at the heart, with ambitious plans to continue to offer the unique experience across the UK.
What did they need?
Data Privacy Advisory Service was approached by BOXPARK to carry out an initial assessment of their compliance activities, and offer support in implementing any remedial measures. The organisation had a strong existing culture, and a wealth of organisational and technical measures in place. But due to the fast growth and continued success of the establishments, BOXPARK was looking for external assurance and advice in order to improve and maintain its prior efforts in data protection compliance, and to provide an additional resource to the in-house team strengthening the subject matter expertise.
How did we help?
DPAS assigned a lead consultant, and visited each BOXPARK site — as well as the London head office — to perform a thorough data protection audit and gain a deep understanding of day-to-day operations, and how data was processed. During this discovery stage, DPAS analysed security measures, reviewed policies and procedures, and assessed the processing practices. Beyond this, DPAS also reviewed accountability documentation, eLearning, and spoke to key stakeholders in order to establish whether there was any disparity in the formalised compliance and operational activities.
Through forging strong relationships with the BOXPARK team, and their faultless co-operation, DPAS was able to establish where any gaps or room for improvement were, and communicated this advice to BOXPARK by providing comprehensive reports and milestone meetings.
BOXPARK remained engaged every step of the way, and instructed DPAS to complete a variety of remedial actions, including revamping policies, and introducing some additional accountability documentation to ensure that BOXPARK could demonstrate best practice.
One of the key considerations was to ensure CCTV compliance across the venues. BOXPARK receives a high number of visitors, and regularly hosts high profile events, and so consequently there was a large amount of personal data being processed. BOXPARK was committed to ensuring their customers were receiving a high standard of service, from the customer experience, right through to ensuring that their legal data subject rights were withheld. With support from the corporate team and operational staff, BOXPARK was able to establish new processes, and make minor changes to ensure that their commitment to compliance was evident throughout the customer journey.
DPAS continues to support BOXPARK as the Data Protection Officer (DPO), maintaining the good practice changes that were implemented previously, and advising on ad-hoc issues.
What the client had to say:
‘We decided to use DPAS because we felt that they were a good fit for the BOXPARK brand being a boutique data protection advisory company. Since the commencement of the project we have received fantastic service, delivered by a great team which has made a highly complex project easy to digest. They hit every deadline and continue to provide us, and our team, with easy to understand data protection advice and support.’
Matt Carter, Head of Digital and Technology
