Privacy notice

We are Edacity Ltd, trading as WellbeingROI. We're a company registered in England and Wales with company number 09380627, whose registered address is 43a St Marys Road, Market Harborough, Leicestershire, LE16 7DS. In this privacy notice we refer to ourselves as 'we', 'us' or 'our'. We are the Data Controller of the personal information we collect, hold and use about you, as explained here.

You can contact us by email at contact@wellbeingroi.com. Please use email rather than post — it reaches us directly and we can respond faster.

We take the privacy and the security of personal information we hold about you seriously. This notice tells you how we collect personal information about you and how we use it. Please read it carefully, so you know and can understand why and how we use the personal information we collect and hold about you.

We do not have a data protection officer. If you have any questions about this notice, or any issue arising from it, please contact Barry Taylor, who is responsible for matters relating to data protection at our organisation. You can reach him using the details above.

We may issue you with other privacy notices from time to time, including when we collect personal information from you. This notice supplements those and does not override them. We may update this notice from time to time.

1.Key definitions

The key terms used in this notice are defined below, for ease.

Data Controller: the organisation or person responsible for deciding how personal information is collected, stored and used.

Data Processor: a Data Controller may appoint another organisation or person to carry out certain tasks on its behalf in relation to the personal information. This may include hosting a site containing personal information, for example, or providing an email service that sends marketing material to a Data Controller's customers.

Personal Information: any information from which a living individual can be identified. It does not apply to information that has been anonymised.

Special Information: certain very sensitive personal information requires extra protection under data protection law. This includes information relating to health, racial and ethnic origin, political opinions, religious and similar beliefs, trade union membership, sex life and sexual orientation. It also includes genetic and biometric information.

2.What we collect, and how long we keep it

Set out below are the general categories of personal information we collect, use and hold about you, and how long we keep each of them.

We will only hold your personal information for as long as is necessary. How long is necessary depends on the purposes for which we collected it, and whether we are under any legal obligation to keep it — for example in relation to accounting or auditing records, or for tax reasons. We may also need to keep personal information in case of legal claims, including in relation to any guarantees or warranties provided with the goods and services.

The types of personal information we collect about you may differ from person to person, depending on who you are and the relationship between us.

3.Special information

Special information is explained in Section 1 above. We do not collect or hold any special information about you.

We do not collect information from you relating to criminal convictions or offences.

4.How and why we use your information

We are only able to use your personal information for certain legal reasons set out in data protection law. There are other legal reasons available, but in most cases we will rely on the following:

• Contract Reason: to perform our obligations to you under a contract we have entered into with you.
• Legitimate Interests Reason: where using your personal information is necessary for our legitimate interests (or a third party's), so long as those interests do not override your fundamental rights, freedoms or interests.
• Legal Obligation Reason: where we have to use your personal information to perform a legal obligation by which we are bound.
• Consent Reason: where you have given us your consent to use your personal information for a specific reason.

So that we can provide you with goods and services, we need your personal information. If you do not provide it, we may be prevented from supplying those goods and services to you. It is important that you keep your personal information up to date — if anything changes, please contact us as soon as you can.

Where we rely on consent as the legal reason for processing your personal information, you have the right to withdraw that consent at any time. Please contact us using the details at the top of this notice. If we receive a request withdrawing your consent, we will stop processing your personal information for that purpose unless we have another legal reason for doing so, in which case we will confirm that reason to you.

The table below explains the different purposes for which we use your personal information, and the legal reason for each. Where we rely on the Legitimate Interests Reason, we have explained what that interest is. For some purposes more than one legal reason is listed, because the reason may differ depending on the circumstances. If you need confirmation of the specific reason we're relying on, please contact us.

Sometimes we may anonymise information you provide so that you can no longer be identified from it, and use it for our own purposes. We may also combine some of your information with other people's to give us statistical data. Because that is grouped together and you are not identifiable from it, we are able to use it.

Under data protection law, we can only use your personal information for the purposes we have told you about, unless we consider a new purpose compatible with those. If we want to use it for a purpose we do not think is compatible, we will contact you to explain and provide a supplementary privacy notice.

5.How we collect it

We usually collect identity information, contact information, payment information, transaction information and marketing information directly from you — when you fill out a form, purchase goods, services or digital content from us, or contact us by email, in writing or otherwise. This includes the personal information you provide when you subscribe to our mailing list.

We may receive some of your personal information from third parties. This includes:

• contact information and payment information from our selected third-party suppliers, such as Lemon Squeezy, our payment provider and merchant of record;
• website, device and technical information from third parties such as analytics providers (for example Google).

We may also receive website, device and technical information automatically from technologies such as cookies installed on our website. To find out more about these, please see our cookies policy.

6.Who we share it with

We may need to share your personal information with other organisations or people. Third parties we share with may include:

• suppliers — such as Brevo (our email platform), Lemon Squeezy (our payment provider and merchant of record), Hostinger (our website host) and Google (our website analytics provider), who are based in the UK, the European Union and the United States;
• government and regulatory bodies — such as HMRC, who are based in the UK;
• our advisers — such as lawyers, accountants, auditors and insurance companies, who are based in the UK;
• any organisation proposing to purchase our business and assets, in which case we may disclose your personal information to the potential purchaser.

Depending on the circumstances, the organisations or people we share your personal information with will be acting as either Data Processors or Data Controllers. Where we share your personal information with a Data Processor, we ensure that contracts are in place setting out the responsibilities and obligations of both parties, including in respect of security.

7.Transfers outside the UK

Some of the organisations with which we share your personal information may be located outside the UK. This may involve transferring your personal information outside the UK.

Where we do so, we will ensure the transfer is made in accordance with data protection law. We will usually do this by:

• transferring the personal information to a country, territory or organisation covered by UK adequacy regulations;
• putting in place an appropriate safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses; or
• relying on another lawful transfer mechanism or applicable exception under data protection law.

Where required, we will assess whether the personal information will receive an appropriate level of protection after transfer, and put additional protections in place. You can contact us if you would like more information about the safeguards used for a particular transfer.

8.Automated decision-making

'Automated decision-making' is where a decision is made automatically without any human involvement. Under data protection law this includes profiling — the automated processing of personal information to evaluate or analyse certain personal aspects of a person, such as their behaviour, characteristics, interests and preferences.

Data protection laws place restrictions on us if we carry out automated decision-making that produces a legal effect, or similarly significant effect, on you.

9.Your rights

Under data protection law you have certain rights in relation to your personal information.

• Right to request access — often called 'subject access'. The right to obtain a copy of the personal information we hold about you. We must also provide certain other information to help you understand how it is being used.
• Right to correction — to request that any incorrect personal information is corrected, and any incomplete information completed.
• Right to erasure — often called the 'right to be forgotten'. This applies in certain circumstances only. Where it does apply, you can request that we erase all of your personal information.
• Right to restrict processing — this applies in certain circumstances only. Where it applies, you can request that we restrict the processing of your personal information.
• Right to data portability — to request that we transfer your personal information to someone else.
• Right to object — you have the right to object to us processing your personal information for direct marketing. You can also object where our legal reason is the Legitimate Interests Reason and something about your particular situation means you want to object. In certain circumstances you can object to processing that consists of profiling.

In addition, where we rely on consent as the legal reason for using your personal information, you have the right to withdraw that consent. Further details are in Section 4.

If you want to exercise any of these rights, please contact us using the details at the top of this notice. If you make a request, please note:

• we may need certain information from you so that we can verify your identity;
• we do not charge a fee for exercising your rights, unless your request is unfounded or excessive; and
• if your request is unfounded or excessive, we may refuse to deal with it.

10.Marketing

You may receive marketing from us about similar goods and services, where either you have consented to this or we have another legal reason by which we can contact you for marketing purposes.

We will always give you the opportunity to manage how, or whether, we market to you. In any email we send you, we provide a link to unsubscribe, opt out or change your preferences. To change your marketing preferences, or to ask us to stop processing your personal information for marketing purposes, you can always contact us using the details at the top of this notice.

If you ask us to stop marketing to you, that will not prevent us from sending communications that are not marketing — for example, in relation to goods and services you have purchased from us.

11.Complaints

If you are unhappy about how we have collected, handled or used your personal information, you can make a complaint to us using any of the contact details at the top of this notice. You do not have to use a particular form or contact method.

We will acknowledge your complaint within 30 days of receiving it. We will investigate it, keep you informed about its progress and tell you the outcome, in each case without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters. You can find information about how to make a complaint, and the ICO's current contact details, on the ICO's website.

We would appreciate the opportunity to consider your concerns first, but you are not required to contact us before making a complaint to the Information Commissioner's Office.

12.Third-party websites

Our website may contain links to third-party websites. If you click and follow those links, they will take you to the third-party website. Those websites may collect personal information from you, and you will need to check their own privacy notices to understand how your personal information is collected and used by them.