How we handle personal data.

This policy is issued by [REGISTERED COMPANY NAME] trading as Flora Labs, [REGISTERED ADDRESS], company number [COMPANY NUMBER], ICO registration [ICO REFERENCE].

For the contact details you give us directly — through the audit form, the contact page or a strategy call — Flora Labs is the data controller. We decide why and how that data is used.

For a client's customer database, the client is the controller and Flora Labs is the processor. We act on their documented instructions and nothing else. The split matters, because it decides who is answerable for what, and it is set out in the data processing terms that form part of every engagement.

We only collect what a specific purpose needs. For each one, the lawful basis under UK GDPR is named.

• Enquiry details — name, business name, email, phone, and what you told us about your database. Purpose: to respond to your enquiry and prepare a proposal. Lawful basis: legitimate interests (responding to a business enquiry you initiated).
• Campaign data processed for a client — the contact records in their database, including names, phone numbers, and the history of messages sent and received. Purpose: to run the campaign they instructed. Lawful basis: the client's, as controller; we hold it as processor.
• Consent and opt-out records — who consented, when, how, and who has since opted out. Purpose: to prove a lawful basis exists for every message and to honour withdrawals. Lawful basis: legal obligation.
• Website analytics — see the [COOKIE POLICY]. At the time of writing this site sets no analytics or advertising cookies at all.

We do not buy contact lists, we do not sell data to anyone, and we do not use a client's database for any purpose other than that client's own campaign.

This is the part of our work the law is most specific about, so it gets its own section.

Under PECR, a marketing SMS to an individual requires their prior consent, unless the soft opt-in applies: the number was obtained during a sale or negotiations for a sale, the message concerns similar products or services, and the person was given a simple means of refusing at the point of collection and in every message since.

Before any campaign runs, we require the client to confirm in writing which basis applies and to evidence it. Where neither consent nor a genuine soft opt-in exists for a contact, that contact is excluded. We would rather send to a smaller list than an unlawful one.

• Every message identifies the sender.
• Every message carries a free and simple opt-out.
• Opt-outs are actioned immediately and are permanent.
• Opt-out and consent records are retained so the basis for each message can be demonstrated after the fact.

We use a small number of processors to deliver the service. Each is bound by contract to process data only on our instructions.

• [CRM / CAMPAIGN PLATFORM] — stores contact records and message history.
• [SMS GATEWAY / NETWORK PROVIDER] — delivers the messages.
• [HOSTING PROVIDER] — hosts this website.
• Professional advisers, where we are required to take advice.

Where any processor stores data outside the UK, the transfer is covered by [TRANSFER MECHANISM — e.g. UK adequacy regulations or the International Data Transfer Addendum]. Confirm this before launch; naming the wrong mechanism is worse than naming none.

• Enquiry details: [RETENTION PERIOD] from last contact.
• Client campaign data: for the term of the engagement, then returned or deleted on the client's instruction within [PERIOD].
• Opt-out records: retained indefinitely. This is deliberate — the only way to guarantee we never message someone again is to keep a record that they asked us not to.
• Consent evidence: [RETENTION PERIOD], so the lawful basis for a past campaign can still be demonstrated.

You have the right to access your data, to have it corrected or erased, to restrict or object to how it is used, to data portability, and to withdraw consent at any time where consent is the basis.

If your data is in a client's database, the client is the controller and the request is properly theirs to answer. Send it to us anyway and we will pass it on promptly and help them answer it — being bounced between two companies is not your problem to solve.

Requests go to [PRIVACY CONTACT EMAIL]. We respond within one month.

If you are not satisfied with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but the right is yours either way.

Access to campaign data is restricted to the people working on that campaign. Data is transmitted over encrypted connections and held in access-controlled systems. Accounts use individual credentials, never shared ones.

We are explicit here rather than reassuring, because a privacy policy claiming security measures that are not actually in place is a worse position than one that says nothing. [CONFIRM THE CONTROLS ACTUALLY DEPLOYED BEFORE LAUNCH.]

We will update this page when what we do changes. Material changes will be notified to clients directly rather than left for anyone to notice.