Privacy Policy

Last updated: 6 June 2026

This Privacy Policy explains how Organglow.ddd ("we", "us", "our") collects, uses, stores, and protects your personal data when you visit our website or contact us.

1. Data Controller

The data controller responsible for your personal data is:

Organglow.ddd
1st Floor 47 Marlands Shopping Centre, Civic Centre Rd
Southampton SO14 7SJ, United Kingdom
Email: assist@organglow.world
Phone: +44 7932 322588

2. UK Data Protection Law (Post-Brexit)

Following the United Kingdom's departure from the European Union, data protection across England, Scotland, Wales, and Northern Ireland is governed by the UK General Data Protection Regulation (UK GDPR) — retained in domestic law under the Data Protection Act 2018. Cookie and similar technologies are additionally regulated by the Privacy and Electronic Communications Regulations (PECR).

We process personal data in accordance with these laws. Where this policy refers to "GDPR", it means the UK GDPR unless otherwise stated. You have the same core rights as under the former EU framework, enforced in the UK by the Information Commissioner's Office (ICO).

3. ICO Registration

Organisations that process personal data in the UK must normally pay a data protection fee to the ICO and register as a data controller, unless a statutory exemption applies. Because we collect and process personal data — including contact form submissions, technical data, and cookie consent records — we are registered with the ICO.

Register name: Organglow.ddd
ICO public register: ICO Public Register Search

If you have questions about our registration status, contact us using the details in Section 1.

4. Personal Data We Collect

We collect only data that is adequate, relevant, and limited to what is necessary for the purposes described in this policy. We do not collect special category data (such as health records) or data relating to criminal convictions through this website.

Identity and contact data: your name and email address when you submit our contact form.
Communication data: the content of messages you send us, including any information you choose to include about your work setup or wellbeing routine.
Consent data: your GDPR consent confirmation when submitting the contact form, and your cookie preference choices with timestamps.
Technical data: IP address, browser type and version, device type, operating system, time zone, and pages visited — collected only where permitted (via strictly necessary storage or with your cookie consent).
Usage data: aggregated information about how you use our website, collected via analytics cookies only if you have consented.

We do not knowingly collect personal data from children under 13. Our website is not directed at children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

5. How We Collect Data

We obtain personal data from the following sources:

Directly from you — when you complete our contact form, register interest in workshops, or email us.
Automated technologies — cookies, local storage, and similar technologies as described in our Cookie Policy. Non-essential technologies are only activated after you give consent.
Third-party embeds — services such as Google Maps on our contact page may collect technical data under their own policies when you interact with them.

Providing contact form data is voluntary. However, if you do not provide your name, email, and message, we cannot respond to your enquiry. Submitting the contact form requires your explicit consent to data processing, as indicated by the mandatory consent checkbox.

6. Purposes and Legal Bases for Processing

Under UK GDPR Article 6, we process personal data only where a lawful basis applies. The table below sets out our main processing activities:

Responding to enquiries — Purpose: to read, respond to, and follow up on contact form submissions and emails. Legal basis: legitimate interests (handling communications from website visitors in a proportionate way) and, where applicable, steps prior to entering a contract. You may object to processing based on legitimate interests (see Section 12).
Storing consent records — Purpose: to demonstrate compliance with UK GDPR and PECR, and to honour your cookie choices. Legal basis: legal obligation and legitimate interests.
Cookie and analytics processing — Purpose: to understand website usage and improve content. Legal basis: consent (obtained via our cookie banner before non-essential cookies are set).
Marketing communications — Purpose: to send information about workshops or events if you have opted in. Legal basis: consent. We do not send unsolicited marketing email without consent, in accordance with PECR.
Legal and regulatory compliance — Purpose: to comply with applicable UK law, respond to lawful requests from authorities, and protect our legal rights. Legal basis: legal obligation and legitimate interests.

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

7. Data Processors and Recipients

We do not sell or rent your personal data. We may share data with trusted third parties who process data on our behalf as data processors, including:

Website hosting and infrastructure providers
Email delivery and communication services
Analytics providers (only where you have consented to analytics cookies)

All processors are bound by written contracts (Data Processing Agreements) requiring them to protect your data, process it only on our instructions, and comply with UK GDPR. We may also disclose data to regulators, courts, or law enforcement where required by UK law.

8. International Data Transfers

Your data is primarily processed within the United Kingdom. If any processor transfers personal data outside the UK — for example, to the United States — we ensure a valid transfer mechanism is in place under UK GDPR Chapter V, such as:

UK adequacy regulations (where the destination country is approved by the UK government)
UK International Data Transfer Agreement (UK IDTA)
UK Addendum to the EU Standard Contractual Clauses

You may request further information about safeguards for international transfers by contacting us.

9. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

Contact form submissions: up to 12 months from the date of your last communication, unless a longer period is needed for unresolved enquiries or legal obligations.
Cookie and consent records: up to 12 months in local storage, after which we will request your consent again.
Analytics data: up to 26 months where you have consented, retained in pseudonymised form where possible.
Legal and accounting records: up to 6 years where required by UK law.

When retention periods expire, data is securely deleted or irreversibly anonymised.

10. Data Security

We implement appropriate technical and organisational measures under UK GDPR Article 32, including:

TLS/HTTPS encryption for data transmitted via our website
Access controls limiting personal data to authorised personnel on a need-to-know basis
Secure storage of contact form data with restricted access
Regular review of data handling practices, security configurations, and processor compliance
Procedures to assess and respond to personal data breaches, including notifying the ICO within 72 hours where required, and informing affected individuals without undue delay where there is a high risk to rights and freedoms

No method of transmission over the internet is completely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

11. Your Rights Under UK GDPR

Under the UK GDPR and Data Protection Act 2018, you have the following rights in relation to your personal data:

Right of access — request a copy of the personal data we hold about you (commonly known as a "subject access request").
Right to rectification — request correction of inaccurate or incomplete personal data.
Right to erasure — request deletion of your data where there is no compelling reason for continued processing ("right to be forgotten").
Right to restrict processing — request that we limit how we use your data in certain circumstances.
Right to data portability — receive personal data you provided to us in a structured, commonly used, machine-readable format, and transmit it to another controller where technically feasible.
Right to object — object to processing based on legitimate interests, including direct marketing (we will stop marketing communications on request).
Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Rights related to automated decision-making — not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects (we do not carry out such processing).

To exercise any right, email assist@organglow.world with sufficient detail for us to identify you and your request. We will respond within one month of receipt. This may be extended by a further two months for complex requests, in which case we will inform you within the first month. We do not charge a fee for most requests unless they are manifestly unfounded or excessive.

12. Cookie Preferences

When you first visit our website, a cookie banner allows you to Reject non-essential cookies, Manage Preferences by category, or Accept All. Non-essential cookies are not placed on your device until you consent, in line with PECR. You may change your choices at any time by clicking Manage Cookie Preferences in the website footer, or by contacting us. See our Cookie Policy for full details.

13. Direct Marketing (PECR)

We will only send electronic marketing communications (email) where you have given clear consent, or where an existing customer exemption applies under PECR and you have not opted out. Every marketing email will include a clear way to unsubscribe. To opt out at any time, contact us or use the unsubscribe link in any email we send.

14. Complaints to the ICO

If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the UK's supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
Website: ico.org.uk
Helpline: 0303 123 1113

15. Online Advertising

We may use online advertising platforms (such as Google Ads) to promote our free educational content to UK audiences. Our advertising:

Clearly identifies Organglow.ddd as the business behind the website, with contact details available on our Contact page and in the website footer.
Directs users to this website for general educational information about workplace movement — we do not sell products, supplements, or treatments through these ads.
Does not make misleading claims about treating, curing, or preventing health conditions. Content is for general information only.
Uses measurement technologies (such as analytics or conversion cookies) only where you have consented to the relevant non-essential cookies under PECR. See our Cookie Policy.

Where advertising partners process personal data on our behalf, we ensure appropriate contractual safeguards are in place. You may object to direct marketing and withdraw cookie consent at any time as described in Sections 12 and 13.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in law, technology, or our practices. Material changes will be indicated by an updated "Last updated" date at the top of this page. Where changes significantly affect how we process your data, we will take appropriate steps to inform you. We encourage you to review this page periodically.