Privacy Policy

1. Who We Are

Iconic Beauty & Wellbeing CIC ("we", "our", "us") is a Community Interest Company registered in England and Wales. We are committed to protecting your privacy and handling your personal data responsibly.

If you have any questions about this policy, please contact us at info@iconicwellbeing.co.uk.

2. What Data We Collect

We may collect the following personal information:

• Contact information: name, email address, phone number (when you contact us via our website form)
• Enquiry details: the subject and content of your message
• Referral information: if you are referred by a partner organisation, we may receive your name and basic contact details
• Session records: attendance records, feedback forms, and wellbeing questionnaires (for service participants)
• Website usage data: cookies and similar technologies (see our Cookie Policy below)

3. How We Use Your Data

We use your personal data to:

• Respond to your enquiries and provide information about our services
• Deliver wellbeing sessions, workshops, and community events
• Assess eligibility for funded or subsidised services
• Monitor and evaluate the impact of our programmes
• Comply with legal and regulatory obligations
• Improve our services and website

4. Legal Basis for Processing

We process your personal data on the following legal bases under the UK GDPR:

• Consent: when you submit a contact form or sign up for events
• Legitimate interests: to deliver and improve our community services
• Legal obligation: where required by law or regulation

5. How We Share Your Data

We do not sell your personal data. We may share your information with:

• Service providers: Web3Forms (form processing), Google (website analytics)
• Partner organisations: only with your consent, for referral purposes
• Regulatory bodies: where required by law (e.g., CIC Regulator, safeguarding authorities)

6. How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data, including encrypted website connections (SSL/TLS), secure data storage, and access controls. Only authorised personnel have access to personal information.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact form submissions: up to 12 months
• Service participant records: up to 3 years after last contact
• Financial and legal records: as required by law (typically 6 years)

8. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Request data portability
• Withdraw consent at any time

To exercise any of these rights, please contact us at info@iconicwellbeing.co.uk.

9. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes to This Policy

We may update this policy from time to time. Any changes will be posted on this page with an updated revision date.