Customer Privacy Notice
Registered name: FLOESSENCE LTD
ICO registration number: ZC164958
We are the controller of your personal data. This privacy notice tells you what to expect us to do with your personal information.
- Contact details
- What information we collect, use, and why
- Lawful bases and data protection rights
- Where we get personal information from
- How long we keep information
- Who we share information with
- Sharing information outside the UK
- How to complain
Contact details
Email: hello@floessence.world
What information we collect, use, and why
To provide services and goods:- Names and contact details
- Purchase or account history
- Health information (including dietary requirements, allergies and health conditions)
- Website user information (including user journeys and cookie tracking)
- Photographs or video recordings
- Information relating to compliments or complaints
- Records of meetings and decisions
We also collect the following special category information to provide services and goods. This information is subject to additional protection due to its sensitive nature:
For the operation of customer accounts and guarantees:- Names and contact details
- Purchase history
- Account information, including registration details
- Information used for security purposes
- Marketing preferences
For service updates or marketing purposes:- Names and contact details
- Marketing preferences
- Records of consent, where appropriate
To comply with legal requirements:- Name
- Contact information
- Financial transaction information
- Any other personal information required to comply with legal obligations
For dealing with queries, complaints or claims:- Names and contact details
- Account information
- Purchase or service history
- Customer or client accounts and records
- Financial transaction information
- Correspondence
We also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:
Lawful bases and data protection rights
Under UK data protection law, we must have a 'lawful basis' for collecting and using your personal information. You can find out more about lawful bases on the ICO's website. Which lawful basis we rely on may affect your data protection rights, which are set out briefly below:
- Your right of access – You have the right to ask us for copies of your personal information.
- Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
- Your right to erasure – You have the right to ask us to delete your personal information.
- Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information.
- Your right to object to processing – You have the right to object to the processing of your personal data.
- Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
- Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
To provide services and goods:- Consent – we have permission from you after we gave you all the relevant information. You have the right to withdraw your consent at any time.
- Contract – we have to collect or use the information so we can enter into or carry out a contract with you.
For health information, we rely on your explicit consent, which you give in our participant consent form. You can withdraw it at any time by emailing hello@floessence.world.
For the operation of customer accounts and guarantees:- Contract – we have to collect or use the information so we can enter into or carry out a contract with you.
For service updates or marketing purposes:- Consent – we have permission from you after we gave you all the relevant information. You have the right to withdraw your consent at any time.
To comply with legal requirements:- Legal obligation – we have to collect or use your information so we can comply with the law.
For dealing with queries, complaints or claims:- Legal obligation – we have to collect or use your information so we can comply with the law.
- Legitimate interests – we need to use your information to respond to your query or complaint effectively and fairly. The information used is limited to what you have shared with us, is not disclosed beyond those handling the matter, and is retained only for as long as necessary. You retain the right to object to this processing at any time.
Where we get personal information from
- Directly from you
- Publicly available sources
- Suppliers and service providers
- Third parties: Corporate client organisations who book FLOESSENCE Ltd programmes may share the names and contact details of their employees or nominated participants with us for the purpose of delivering the agreed wellbeing programme. This information is shared by the organisation's representative, typically within a People & Culture or HR function, and is used solely to facilitate programme delivery and communications with participants.
How long we keep information
We keep personal information only for as long as necessary for the purpose it was collected. As a guide:
- Mailing list subscriber data is kept until you unsubscribe
- Client session notes and correspondence are kept for 3 years after last contact
- Financial and invoice records are kept for 6 years in line with HMRC requirements
- Website enquiry data is kept for 1 year if no contract follows
Who we share information with
Data processors:- Cookie Information A/S (Denmark) – They provide our cookie consent management platform and process website user consent data on our behalf.
- Simply.com (Denmark) – They host our website and store website user data and contact form submissions on our behalf.
- Google LLC (USA) – They provide Google Analytics, which collects website user journey and cookie data on our behalf, and Google Drive and Google Forms, which we use to collect and store client and participant information on our behalf, including the health information shared in our participant consent form.
- Stripe Payments UK Ltd (UK) – They process card payments for bookings on our behalf.
- Zoom Video Communications Inc (USA) – They provide video conferencing software used to deliver online sessions and may process participant data on our behalf.
- Elementor Ltd (Israel) – They provide our website page building software and may process website user data on our behalf.
- EzyCourse (USA) – They host our online course platform and store participant account information and course activity data on our behalf.
Others we share personal information with:- Insurance companies
- Professional or legal advisors
- Relevant regulatory authorities
- Organisations we are legally obliged to share personal information with
- Publicly on our website, social media or other marketing and information media
Sharing information outside the UK
Where necessary, we will transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.
- Organisation: Google LLC, Category: Technology and cloud services provider, Country: USA, Transfer mechanism: Adequacy Regulations (UK-US data bridge)
- Organisation: Cookie Information A/S, Category: Consent management provider, Country: Denmark, Transfer mechanism: Adequacy Regulations
Where necessary, our data processors may also share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.
- Organisation: Zoom Video Communications Inc, Category: Video conferencing services provider, Country: USA, Transfer mechanism: Adequacy Regulations (UK-US data bridge)
- Organisation: Elementor Ltd, Category: Website software provider, Country: Israel, Transfer mechanism: Adequacy Regulations
How to complain
If you have a concern about how FLOESSENCE Ltd handles your personal data, we want to hear from you. You have the right to raise a formal data protection complaint and we will handle it promptly and fairly.
How to raise a complaint: Please send your complaint in writing to: hello@floessence.world. Include your name, contact details and a clear description of your concern. We will acknowledge your complaint within 30 days of receiving it and let you know how we intend to address it.
How we handle complaints: We will investigate your concern, keep you informed of our progress and aim to resolve it as quickly as possible. We will always try to resolve complaints directly before they are escalated further.
If you remain unhappy: If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Helpline: 0303 123 1113.
Website: ico.org.uk/make-a-complaint.
