Health information (including dietary requirements, allergies and health conditions)
Website user information (including user journeys and cookie tracking)
Photographs or video recordings
Information relating to compliments or complaints
Records of meetings and decisions
We also collect the following special category information to provide services and goods. This information is subject to additional protection due to its sensitive nature:
Health information
For the operation of customer accounts and guarantees
Names and contact details
Purchase history
Account information, including registration details
Information used for security purposes
Marketing preferences
For service updates or marketing purposes
Names and contact details
Marketing preferences
Records of consent, where appropriate
To comply with legal requirements
Name
Contact information
Financial transaction information
Any other personal information required to comply with legal obligations
For dealing with queries, complaints or claims
Names and contact details
Account information
Purchase or service history
Customer or client accounts and records
Financial transaction information
Correspondence
We also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:
Health information
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights, which are set out briefly below:
Your right of access – You have the right to ask us for copies of your personal information.
Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure – You have the right to ask us to delete your personal information.
Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information.
Your right to object to processing – You have the right to object to the processing of your personal data.
Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
To provide services and goods:
Consent – we have permission from you after we gave you all the relevant information. You have the right to withdraw your consent at any time.
Contract – we have to collect or use the information so we can enter into or carry out a contract with you.
For the operation of customer accounts and guarantees:
Contract – we have to collect or use the information so we can enter into or carry out a contract with you.
For service updates or marketing purposes:
Consent – we have permission from you after we gave you all the relevant information. You have the right to withdraw your consent at any time.
To comply with legal requirements:
Legal obligation – we have to collect or use your information so we can comply with the law.
For dealing with queries, complaints or claims:
Legal obligation – we have to collect or use your information so we can comply with the law.
Legitimate interests – we need to use your information to respond to your query or complaint effectively and fairly. The information used is limited to what you have shared with us, is not disclosed beyond those handling the matter, and is retained only for as long as necessary. You retain the right to object to this processing at any time.
Where we get personal information from
Directly from you
Publicly available sources
Suppliers and service providers
Third parties: Corporate client organisations who book FLOESSENCE Ltd programmes may share the names and contact details of their employees or nominated participants with us for the purpose of delivering the agreed wellbeing programme. This information is shared by the organisation’s representative, typically within a People & Culture or HR function, and is used solely to facilitate programme delivery and communications with participants.
How long we keep information
We keep personal information only for as long as necessary for the purpose it was collected. As a guide:
Mailing list subscriber data is kept until you unsubscribe
Client session notes and correspondence are kept for 3 years after last contact
Financial and invoice records are kept for 6 years in line with HMRC requirements
Website enquiry data is kept for 1 year if no contract follows
Who we share information with
Data processors
Cookie Information A/S (Denmark) This data processor does the following activities for us: They provide our cookie consent management platform and process website user consent data on our behalf.
Simply.com (Denmark) This data processor does the following activities for us: They host our website and store website user data and contact form submissions on our behalf.
Google LLC (USA) This data processor does the following activities for us: They provide Google Analytics, which collects website user journey and cookie data on our behalf, and Google Drive, which we use to store client and participant information on our behalf.
Zoom Video Communications Inc (USA) This data processor does the following activities for us: They provide video conferencing software used to deliver online sessions and may process participant data on our behalf.
Elementor Ltd (Israel) This data processor does the following activities for us: They provide our website page building software and may process website user data on our behalf.
EzyCourse (USA) This data processor does the following activities for us: They host our online course platform and store participant account information and course activity data on our behalf.
Others we share personal information with
Insurance companies
Professional or legal advisors
Relevant regulatory authorities
Organisations we are legally obliged to share personal information with
Publicly on our website, social media or other marketing and information media
Sharing information outside the UK
Where necessary, we will transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.
Organisation: Google LLC Category: Technology and cloud services provider Country: USA Transfer mechanism: Adequacy Regulations (UK-US data bridge)
Organisation: Cookie Information A/S Category: Consent management provider Country: Denmark Transfer mechanism: Adequacy Regulations
Where necessary, our data processors may also share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.
Organisation: Zoom Video Communications Inc Category: Video conferencing services provider Country: USA Transfer mechanism: Adequacy Regulations (UK-US data bridge)
Organisation: Elementor Ltd Category: Website software provider Country: Israel Transfer mechanism: Adequacy Regulations
How to complain
If you have a concern about how FLOESSENCE Ltd handles your personal data, we want to hear from you. You have the right to raise a formal data protection complaint and we will handle it promptly and fairly.
Include your name, contact details and a clear description of your concern. We will acknowledge your complaint within 30 days of receiving it and let you know how we intend to address it.
How we handle complaints
We will investigate your concern, keep you informed of our progress and aim to resolve it as quickly as possible. We will always try to resolve complaints directly before they are escalated further.
If you remain unhappy
If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
Information Commissioner’s Office Wycliffe House, Water Lane Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 Website:ico.org.uk/make-a-complaint
Data Protection Complaints
If you have a concern about how FLOESSENCE Ltd handles your personal data, we want to hear from you. You have the right to raise a formal data protection complaint and we will handle it promptly and fairly.
Include your name, contact details and a clear description of your concern. We will acknowledge your complaint within 30 days of receiving it and let you know how we intend to address it.
How we handle complaints
We will investigate your concern, keep you informed of our progress and aim to resolve it as quickly as possible. We will always try to resolve complaints directly before they are escalated further.
If you remain unhappy
If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
