This policy explains what personal information we collect through The Flourishing Organisation Standard, why we collect it, how long we keep it, and the rights you have over it.
1. Who we are
The Flourishing Organisation Standard (“FOS”, “the Standard”) is a workplace wellbeing accreditation run by SuperWellness Limited. In this policy, “we”, “us” and “our” mean SuperWellness Limited.
- SuperWellness Limited is the data controller for the personal information described here.
- Company number: 07523006 (registered in England and Wales).
- Registered address: Beckett House, 36 Old Jewry, London EC2R 8DD.
- Information Commissioner’s Office (ICO) registration number: ZA063188.
- Data Protection Officer: Angela Steel, info@flourishingstandard.com.
2. What this policy covers
This policy applies to flourishingstandard.com and its subdomains, including the free diagnostic, the waitlist, our webinars and events, and the accreditation process, including the members’ area.
It does not cover:
- the anonymous employee survey used during accreditation, which has its own privacy notice;
- superwellness.co.uk, which is covered by the SuperWellness privacy policy;
- other websites we link to. Please check their own privacy policies.
3. Information we collect
We collect only what we need for the purposes in section 4.
| Type of information | Examples | How we get it |
|---|---|---|
| Contact and professional details | Name, job title, organisation, work email address, telephone number | You give it to us through a form, by email or on a call |
| Diagnostic responses | Your answers to the sixteen diagnostic questions and the resulting score | You complete the diagnostic. We keep your answers only if you tick the consent box. Otherwise we record only your contact details and that you completed it |
| Waitlist and enquiry details | When you are looking to get started, any comments you add, your contact preferences | You complete the waitlist or contact form |
| Event and webinar details | Registration, attendance, and any access or dietary requirements for in-person events | You register for an event or webinar |
| Accreditation information | Members’ area login details, evidence documents, assessment responses, assessor notes and feedback, award level | Your organisation takes part in accreditation |
| Website usage (only with your consent) | Pages visited, how you arrived at the site, device and browser type, approximate location (town or city) | Analytics cookies, see section 12 |
| Cookie choices | Your cookie preference, when you made it, and your country | Our cookie banner |
| Email engagement | Whether you opened our emails and which links you clicked | Our email platform |
The diagnostic and accreditation questions are about your organisation’s practices, not about you personally. Please do not include health or other sensitive personal information in comment fields, and please remove unnecessary personal details from evidence documents before uploading them. If you tell us about access or dietary requirements for an event, we use them only to arrange that event.
4. How we use your information and our lawful basis
UK data protection law requires a lawful basis for each use of personal information. These are ours:
| What we use it for | Lawful basis |
|---|---|
| Responding to your enquiry or waitlist sign-up and contacting you when applications open | Legitimate interests (responding to people who have asked to hear from us), and steps taken at your request before a contract |
| Showing your diagnostic results, sending your results report, and following up about a consultation | Legitimate interests (providing the results you asked for) |
| Keeping your diagnostic answers so a consultation can start from what you said | Consent, given with the tick box. You can withdraw it at any time |
| Sending updates about the Standard, research and events | Consent. Every email includes an unsubscribe link |
| Delivering accreditation: managing evidence, assessment, reports and awards | Contract with your organisation, and our legitimate interests in running the assessment properly |
| Running webinars and events | Contract (your registration), or legitimate interests for free events |
| Understanding how our website is used, so we can improve it | Consent, given through the cookie banner |
| Keeping a record of your cookie choices | Legal obligation (to show that consent was given) |
| Producing anonymised, aggregated insights, for example the share of organisations with a particular practice in place | Legitimate interests. No individual or organisation can be identified in anything we publish |
| Meeting accounting, tax and legal requirements | Legal obligation |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The diagnostic score is an indicative self-check, not an assessment or an award decision.
5. Who we share your information with
We do not sell your personal information. We share it only with service providers who process it on our behalf, under contracts that require them to keep it secure and use it only on our instructions.
| Provider | What they do for us | Where data may be processed |
|---|---|---|
| HubSpot | Contact records, email, enquiries and follow-up | UK, EU and USA |
| ScoreApp | Runs the free diagnostic and generates your results | UK and USA |
| Google (Google Analytics 4) | Website analytics, only with your consent | EU and USA |
| Kinsta | Website hosting | Google Cloud data centre |
| Cloudflare | Website security and performance | Global network |
| Elementor (Cookiez) | Cookie banner and consent records | Elementor’s cloud servers |
| Microsoft | Webinar hosting (Teams) and email | UK, EU and USA |
We may also share information:
- With your organisation’s accreditation assessor. Assessors work under contract and confidentiality obligations.
- On the public register, with your organisation’s agreement. If your organisation is accredited, we publish its name and award level. Case studies are published only with your organisation’s approval of the final copy.
- When the law requires it, for example to comply with a court order or a regulator’s request.
- If our business changes hands. If all or part of SuperWellness Limited is sold or transferred, your information may pass to the new owner, who may use it only for the purposes in this policy. We will tell you before this happens.
6. International transfers
Some of our providers process data outside the UK, mainly in the EU and the USA. Where they do, the transfer is protected by UK adequacy regulations (including the UK–US Data Bridge for certified US companies) or by the ICO’s International Data Transfer Agreement or Addendum.
7. How we keep your information secure
We use encryption in transit, access controls limited to staff and assessors who need the information for their role, and providers with recognised security standards. SuperWellness Limited is Cyber Essentials certified. No transmission over the internet is completely secure, but we take reasonable steps to protect your information.
8. How long we keep your information
| Information | How long we keep it |
|---|---|
| Enquiry, waitlist and marketing contacts | Until you unsubscribe or ask us to delete it, or 2 years after we last heard from you |
| Diagnostic answers (with consent) | 2 years from completion, or until you withdraw consent |
| Accreditation records and evidence | For the three-year accreditation term plus 1 year, so renewals and appeals can be handled |
| Event and webinar registrations | 2 years after the event. Access or dietary requirements are deleted after the event |
| Website analytics (Google Analytics) | 14 months |
| Cookie consent records | Up to 2 years |
| Financial and contract records | 6 years, as required for tax and accounting |
When we no longer need information, we delete it or anonymise it so it can no longer identify you.
9. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to our use of your information where we rely on legitimate interests, including for direct marketing;
- withdraw consent at any time, where we rely on consent (this does not affect anything we did before you withdrew it);
- receive your information in a portable format, where this applies.
To use any of these rights, email info@flourishingstandard.com. We will respond within one month. There is normally no charge.
You can change your cookie choices at any time using the cookie settings link at the bottom of every page.
10. Complaints
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
11. Contact us
- Email: info@flourishingstandard.com
- Telephone: 0845 370 4070
- Post: SuperWellness Limited, Becket House, 36 Old Jewry, London, EC2R 8DD
We may update this policy from time to time. The “last updated” date at the top shows when it last changed, and we will tell you directly about any significant changes.
12. Cookies
Cookies are small text files a website stores on your device. We use two kinds:
- Necessary cookies keep the site secure and working, and remember your cookie choice. The law allows these without consent.
- Analytics cookies tell us how people use the site, so we can improve it. We set these only if you click Accept. Until you do, the Google Analytics script does not load at all.
We do not use advertising cookies, and we have switched off advertising features in Google Analytics.
Changing your choice. Use the cookie settings link at the bottom of any page to accept or reject analytics cookies at any time. You can also block or delete cookies in your browser settings, although some parts of the site may not work as intended if you block necessary cookies.
| Cookie | Provider | Type | Purpose | Duration |
|---|---|---|---|---|
__cf_bm | Cloudflare | Necessary | Distinguishes people from automated bots to protect the site | 30 minutes |
| Consent preference cookie (set by Cookiez) | Elementor (Cookiez) | Necessary | Remembers your cookie choice | Until you change your choice or clear your cookies |
wordpress_logged_in_*, wordpress_sec_* | flourishingstandard.com | Necessary (members’ area only) | Keeps you logged in to the members’ area | Session, or 14 days if you choose “Remember me” |
_ga | Google Analytics | Analytics | Distinguishes one visitor from another | 2 years |
_ga_WZ00H9B54H | Google Analytics | Analytics | Keeps track of your visit (session) | 2 years |
| fos_cookie_consent | scoreapp.flourishingstandard.com | Necessary (diagnostic only) | Remembers your cookie choice on the diagnostic | 180 days |
Google Analytics data is kept for 14 months and is not used for advertising. To opt out of Google Analytics on every website, you can install the Google Analytics opt-out browser add-on.