1. Data Controller Information
The data controller responsible for your personal data is Shouldersshoulde, located at 188-196 Regent St, London W1B 5BT, United Kingdom. You may contact us regarding data protection matters by email at hello@shouldersshoulde.world or by telephone at +44 20 7494 2000. We are committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable international data protection legislation.
2. Scope of This Policy
This Privacy Policy applies to all personal data collected through the website shouldersshoulde.world, including data submitted via our contact form, data collected through cookies and similar technologies, and data generated through your interaction with our educational content and consulting guidance services. Shouldersshoulde provides general informational workplace content only — we are not a healthcare provider and do not process special category health data through this website. This policy does not apply to third-party websites that may be linked from our pages. We encourage you to review the privacy policies of any external sites you visit.
3. Categories of Personal Data We Collect
We may collect and process the following categories of personal data depending on how you interact with our website and services:
- Identity data: your name and job title when voluntarily provided through contact forms or correspondence.
- Contact data: your email address, telephone number, and organisation name when you submit an enquiry or request information about our services.
- Technical data: your IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access our website.
- Usage data: information about how you use our website, including pages visited, time spent on pages, navigation paths, and interaction with website features.
- Communication data: the content of messages you send us through our contact form or email, including any attachments or supplementary information you choose to provide.
- Consent records: records of your cookie preferences and GDPR consent choices, including the date and time consent was given or withdrawn.
4. How We Collect Personal Data
We collect personal data through several methods. Direct interactions occur when you fill in forms on our website, correspond with us by post, phone, email, or otherwise, or request information about our educational products and consulting guidance. Automated technologies collect technical and usage data as you interact with our website through cookies, server logs, and similar tracking technologies. Third-party sources may provide limited data where you have consented to such sharing, such as analytics providers that help us understand website usage patterns in aggregate form.
5. Purposes and Legal Bases for Processing
We process your personal data only where we have a lawful basis to do so under UK GDPR. The purposes for which we process data and the corresponding legal bases are as follows:
- To respond to your enquiries and provide requested information about our workplace team flow systems, educational resources, and consulting guidance. Legal basis: performance of a contract or steps taken at your request prior to entering a contract, and legitimate interests in operating our business.
- To manage and improve our website, including troubleshooting, data analysis, testing, and research. Legal basis: legitimate interests in ensuring our website functions effectively and provides a positive user experience.
- To comply with legal and regulatory obligations, including responding to lawful requests from public authorities. Legal basis: compliance with a legal obligation.
- To send you information about our services where you have opted in to receive such communications. Legal basis: consent, which you may withdraw at any time.
- To analyse website usage through cookies where you have provided consent for analytics and marketing cookies. Legal basis: consent.
6. Data Retention Periods
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. Contact form submissions and correspondence are retained for three years from the date of last communication unless a longer retention period is required by law or ongoing business relationship. Technical and usage data collected through analytics cookies is retained for twenty-six months from the date of collection. Cookie consent records are retained for twelve months from the date consent was given or last updated. Financial and transaction records related to purchased educational products or consulting services are retained for seven years in accordance with UK tax and accounting requirements.
7. Data Sharing and Third Parties
We do not sell your personal data to third parties. We may share your data with trusted service providers who assist us in operating our website and delivering our services, including website hosting providers, email service providers, analytics platforms, and payment processors where applicable. All third-party processors are bound by data processing agreements that require them to protect your data in accordance with UK GDPR standards. We may also disclose personal data where required by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Shouldersshoulde, our users, or the public.
8. International Data Transfers
Your personal data is primarily processed within the United Kingdom and the European Economic Area. Where data is transferred to countries outside the UK or EEA that do not provide an adequate level of data protection, we ensure appropriate safeguards are in place. These safeguards may include Standard Contractual Clauses approved by the UK Information Commissioner's Office, binding corporate rules, or other mechanisms recognised under applicable data protection law. You may request details of the specific safeguards applied to your data by contacting us using the details provided in Section 1.
9. Security Measures
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit using TLS/SSL protocols, secure hosting infrastructure with regular security updates, access controls limiting data access to authorised personnel only, regular review and testing of our security practices, and staff training on data protection responsibilities. While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
10. Your Rights Under UK GDPR
Under the UK GDPR, you have the following rights regarding your personal data:
- Right of access: you may request a copy of the personal data we hold about you.
- Right to rectification: you may request correction of inaccurate or incomplete personal data.
- Right to erasure: you may request deletion of your personal data in certain circumstances, such as where the data is no longer necessary for the purpose it was collected.
- Right to restrict processing: you may request that we limit how we use your data in specific situations.
- Right to data portability: you may request transfer of your data to another organisation in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means.
- Right to object: you may object to processing based on legitimate interests or for direct marketing purposes.
- Right to withdraw consent: where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.
To exercise any of these rights, please contact us at hello@shouldersshoulde.world. We will respond to your request within one month, although this period may be extended by two further months for complex requests. We may need to verify your identity before processing your request.
11. Children's Privacy
Our website and services are not directed at individuals under the age of eighteen. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately and we will take steps to delete such information promptly.
12. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals. All decisions regarding responses to enquiries and service provision involve human review.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the date at the top of this page and, where appropriate, notify you by email or through a prominent notice on our website. We encourage you to review this policy periodically to stay informed about how we protect your data.
14. Complaints
If you have concerns about how we handle your personal data, we encourage you to contact us first so we can attempt to resolve the matter. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. The ICO can be contacted at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or via their website at ico.org.uk.
15. Contact Us
For any questions about this Privacy Policy or our data processing practices, please contact Shouldersshoulde at 188-196 Regent St, London W1B 5BT, United Kingdom, by email at hello@shouldersshoulde.world, or by telephone at +44 20 7494 2000.