Customer Privacy Notice

Registered name: FLOESSENCE LTD

We are the controller of your personal data. This privacy notice tells you what to expect us to do with your personal information.

• Contact details

• What information we collect, use, and why

• Lawful bases and data protection rights

• Where we get personal information from

• How long we keep information

• Who we share information with

• Sharing information outside the UK

• How to complain

---

Contact details

Email: hello@floessence.world

---

What information we collect, use, and why

To provide services and goods

• Names and contact details

• Purchase or account history

• Health information (including dietary requirements, allergies and health conditions)

• Website user information (including user journeys and cookie tracking)

• Photographs or video recordings

• Information relating to compliments or complaints

• Records of meetings and decisions

We also collect the following special category information to provide services and goods. This information is subject to additional protection due to its sensitive nature:

• Health information

For the operation of customer accounts and guarantees

• Names and contact details

• Purchase history

• Account information, including registration details

• Information used for security purposes

• Marketing preferences

For service updates or marketing purposes

• Names and contact details

• Marketing preferences

• Records of consent, where appropriate

To comply with legal requirements

• Name

• Contact information

• Financial transaction information

• Any other personal information required to comply with legal obligations

For dealing with queries, complaints or claims

• Names and contact details

• Account information

• Purchase or service history

• Customer or client accounts and records

• Financial transaction information

• Correspondence

We also collect the following special category information for dealing with queries, complaints or claims. This information is subject to additional protection due to its sensitive nature:

• Health information

---

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights, which are set out briefly below:

• Your right of access – You have the right to ask us for copies of your personal information.

• Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.

• Your right to erasure – You have the right to ask us to delete your personal information.

• Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information.

• Your right to object to processing – You have the right to object to the processing of your personal data.

• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.

• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

To provide services and goods:

• Consent – we have permission from you after we gave you all the relevant information. You have the right to withdraw your consent at any time.

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you.

For the operation of customer accounts and guarantees:

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you.

For service updates or marketing purposes:

• Consent – we have permission from you after we gave you all the relevant information. You have the right to withdraw your consent at any time.

To comply with legal requirements:

• Legal obligation – we have to collect or use your information so we can comply with the law.

For dealing with queries, complaints or claims:

• Legal obligation – we have to collect or use your information so we can comply with the law.

• Legitimate interests – we need to use your information to respond to your query or complaint effectively and fairly. The information used is limited to what you have shared with us, is not disclosed beyond those handling the matter, and is retained only for as long as necessary. You retain the right to object to this processing at any time.

---

Where we get personal information from

• Directly from you

• Publicly available sources

• Suppliers and service providers

• Third parties: Corporate client organisations who book FLOESSENCE Ltd programmes may share the names and contact details of their employees or nominated participants with us for the purpose of delivering the agreed wellbeing programme. This information is shared by the organisation’s representative, typically within a People & Culture or HR function, and is used solely to facilitate programme delivery and communications with participants.

---

How long we keep information

We keep personal information only for as long as necessary for the purpose it was collected. As a guide:

• Mailing list subscriber data is kept until you unsubscribe

• Client session notes and correspondence are kept for 3 years after last contact

• Financial and invoice records are kept for 6 years in line with HMRC requirements

• Website enquiry data is kept for 1 year if no contract follows

---

Who we share information with

Data processors

Cookie Information A/S (Denmark)
This data processor does the following activities for us: They provide our cookie consent management platform and process website user consent data on our behalf.

Simply.com (Denmark)
This data processor does the following activities for us: They host our website and store website user data and contact form submissions on our behalf.

Google LLC (USA)
This data processor does the following activities for us: They provide Google Analytics, which collects website user journey and cookie data on our behalf, and Google Drive, which we use to store client and participant information on our behalf.

Zoom Video Communications Inc (USA)
This data processor does the following activities for us: They provide video conferencing software used to deliver online sessions and may process participant data on our behalf.

Elementor Ltd (Israel)
This data processor does the following activities for us: They provide our website page building software and may process website user data on our behalf.

EzyCourse (USA)
This data processor does the following activities for us: They host our online course platform and store participant account information and course activity data on our behalf.

Others we share personal information with

• Insurance companies

• Professional or legal advisors

• Relevant regulatory authorities

• Organisations we are legally obliged to share personal information with

• Publicly on our website, social media or other marketing and information media

---

Sharing information outside the UK

Where necessary, we will transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.

Organisation: Google LLC
Category: Technology and cloud services provider
Country: USA
Transfer mechanism: Adequacy Regulations (UK-US data bridge)

Organisation: Cookie Information A/S
Category: Consent management provider
Country: Denmark
Transfer mechanism: Adequacy Regulations

Where necessary, our data processors may also share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

Organisation: Zoom Video Communications Inc
Category: Video conferencing services provider
Country: USA
Transfer mechanism: Adequacy Regulations (UK-US data bridge)

Organisation: Elementor Ltd
Category: Website software provider
Country: Israel
Transfer mechanism: Adequacy Regulations

---

How to complain

If you have a concern about how FLOESSENCE Ltd handles your personal data, we want to hear from you. You have the right to raise a formal data protection complaint and we will handle it promptly and fairly.

How to raise a complaint

Please send your complaint in writing to: hello@floessence.world

Include your name, contact details and a clear description of your concern. We will acknowledge your complaint within 30 days of receiving it and let you know how we intend to address it.

How we handle complaints

We will investigate your concern, keep you informed of our progress and aim to resolve it as quickly as possible. We will always try to resolve complaints directly before they are escalated further.

If you remain unhappy

If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint

Data Protection Complaints

If you have a concern about how FLOESSENCE Ltd handles your personal data, we want to hear from you. You have the right to raise a formal data protection complaint and we will handle it promptly and fairly.

How to raise a complaint

Please send your complaint in writing to: hello@floessence.world

Include your name, contact details and a clear description of your concern. We will acknowledge your complaint within 30 days of receiving it and let you know how we intend to address it.

How we handle complaints

We will investigate your concern, keep you informed of our progress and aim to resolve it as quickly as possible. We will always try to resolve complaints directly before they are escalated further.

If you remain unhappy

If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

ICO helpline: 0303 123 1113 Website: ico.org.uk/concerns