Privacy Policy

‍

Effective Date: 1^st May 2025

This privacy policy explains how we collect, use, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Legal Basis for Processing

We process your personal data under the following legal bases as defined by the UK GDPR:

• Consent: Where you have given clear consent for specific processing activities
• Contract: Where processing is necessary for the performance of a contract with you
• Legal Obligation: Where we must process your data to comply with the law
• Legitimate Interests: Where we have a legitimate business interest that doesn't override your rights
• Vital Interests: Where processing is necessary to protect someone's life
• Public Task: Where processing is necessary for the performance of a public task

Information We Collect

Personal Information

We may collect personal information that you voluntarily provide to us, including but not limited to:

• Name and contact information (email address, phone number, mailing address)
• Account credentials (username, password)
• Payment information (processed securely through third-party payment processors)
• Survey information (collected through interaction with the platform)
• Communications you send to us

Automatically Collected Information

When you visit our website, we automatically collect certain information about your device and usage, including:

• IP address and location data
• Browser type and version
• Device information
• Pages visited and time spent on our site
• Referring website addresses

Cookies and Tracking Technologies

We use cookies and similar tracking technologies such as tags, pixels, scripts, web beacons, etc. to enhance your experience and collect usage data. You can manage cookie preferences through our cookie banner or through the cookie preference settings of your web browser. Our cookie banner explains:

• What cookies we use and why
• How to manage your cookie preferences
• Your rights regarding cookies

Essential Cookies: Required for website functionality (no consent needed)

Analytics Cookies: Help us understand how you use our website (consent required)

Marketing Cookies: Used for advertising and personalization (consent required)

How We Use Your Information

We process your personal data for the following purposes, with the corresponding legal basis:

Service Provision (Legal basis: Contract/Legitimate Interest)

• Provide and maintain our services
• Process transactions and send related information
• Manage your account and customer relationship

Communication (Legal basis: Contract/Consent)

• Respond to your inquiries and customer service requests
• Send administrative information and updates
• Send marketing communications (where you have consented)

Improvement and Analytics (Legal basis: Legitimate Interest)

• Analyse usage patterns to improve our website
• Personalise your experience
• Conduct research and development

Legal Compliance (Legal basis: Legal Obligation)

• Comply with legal requirements, court orders, or governmental requests
• Maintain records as required by law

Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Account Information: Retained for the duration of your account plus 6 years after closure for legal and accounting purposes

• Transaction Records: Retained for 6 years in accordance with UK tax and accounting requirements

• Marketing Data: Retained until you withdraw consent or for 3 years of inactivity

• Website Analytics: Anonymized after 26 months in accordance with ICO guidance

Information Sharing and Disclosure

We do not sell your personal data to third parties. We may share your information with:

Service Providers (Data Processors)

• Third-party companies that provide services on our behalf
• All processors are bound by data processing agreements and UK GDPR requirements

Legal Requirements

• Where required by law, court order, or regulatory authority
• To protect our rights, property, or safety, or that of others

Business Transfers

• In connection with a merger, acquisition, or sale of assets
• You will be notified of any such change in ownership

With Your Consent

• Where you have explicitly consented to sharing with specific third parties

International Transfers

If we transfer your personal data outside the UK, we ensure adequate protection through:

• Adequacy Decisions: Transfers to countries with adequacy decisions from the UK government

• Standard Contractual Clauses: Using UK-approved standard contractual clauses

• Other Safeguards: Implementing other appropriate safeguards as required by UK GDPR

We will inform you of any international transfers and the safeguards in place.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure.

Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of Access (Article 15)

• Request a copy of the personal data we hold about you
• Receive information about how we process your data

Right to Rectification (Article 16)

• Request correction of inaccurate or incomplete personal data

Right to Erasure (Article 17)

• Request deletion of your personal data in certain circumstances
• Also known as the "right to be forgotten"

Right to Restrict Processing (Article 18)

• Request that we limit the processing of your personal data in certain situations

Right to Data Portability (Article 20)

• Request a copy of your data in a machine-readable format
• Request that we transfer your data to another controller

Right to Object (Article 21)

• Object to processing based on legitimate interests
• Object to direct marketing at any time

Rights Related to Automated Decision-Making (Article 22)

• Not be subject to decisions based solely on automated processing
• Request human intervention in automated decision-making

Right to Withdraw Consent

• Withdraw consent at any time where processing is based on consent
• This does not affect the lawfulness of processing before withdrawal

To exercise any of these rights, please contact us using the details provided below. We will respond within one month of receiving your request.

Data Breach Notification

In the event of a data breach that poses a high risk to your rights and freedoms, we will:

• Notify the Information Commissioner's Office (ICO) within 72 hours
• Inform affected individuals without undue delay
• Provide clear information about the breach and steps being taken

Children's Privacy

Our website is not directed to children under 13 years of age (or under 16 in the context of consent under data protection law). If you are under 16, you are not permitted to use this website, including signing up for our newsletter. By accessing or using our website, or joining Conscious by way of signing up for our newsletter or marketing communications, you confirm that you meet this age requirement. 

We do not knowingly collect or solicit personal data from children under 16. If you believe we have inadvertently collected personal data about a child, please contact us and we will take steps to delete this data as soon as possible.

Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

International Users

If you are accessing our website from outside UK, please note that your information may be transferred to, stored, and processed in UK where our servers are located and our central database is operated.

Automated Decision-Making

We use limited automated decision-making, including profiling. Where we do use automated processing, we will:

• Inform you of the logic involved
• Explain the significance and consequences
• Provide information about your rights
• Offer human intervention where appropriate

Complaints and Supervisory Authority

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Website: www.ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We encourage you to contact us first so we can try to resolve any concerns directly.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Effective Date" above. Your continued use of our website after any changes constitutes acceptance of the updated policy.

Contact Information

Data Protection Inquiries:

• Email: paul@heyconscious.com
• Address: Sherbro House, Naphill, Bucks. HP14 4QX
• Phone: +15412926422

‍

This privacy policy has been designed to comply with UK GDPR and Data Protection Act 2018 requirements. Please customize all bracketed sections with your specific information and consider consulting with a UK data protection specialist to ensure full compliance with your specific circumstances and industry requirements.