Privacy Policy

What personal data we collect

From clients: name and job title · organisation name · email address and telephone number · business and invoice address · event and programme details · information about your space, venue and facilities · participant numbers and timings · payment and invoicing information · booking history and correspondence · marketing preferences.

From participants: name, where needed for the event · dietary requirements · any health information the participant chooses to disclose so that a session can be adapted.

Health and dietary information

This section is specific to how Free Spirit works.

To deliver our services safely we may need to know about dietary requirements, allergies and intolerances; injuries, physical limitations or mobility requirements; pregnancy, where disclosed; and any health condition a participant wishes us to know about.

Under UK GDPR, health information is special category data and attracts additional protection. Dietary information may also be special category data where it reveals a health condition or a religious or philosophical belief.

We ask participants directly, not their employer.
Free Spirit provides a confidential form completed by the participant. We do not ask clients to collect health information about their employees, and we would prefer they did not. Nobody should have to tell their HR team that they are pregnant, injured or taking medication in order to attend a wellness day.

Where the information goes.
Participant → Free Spirit event manager → only the specific practitioner or chef who needs it to deliver safely → deleted. It is not circulated to the wider team, not shared with your employer beyond aggregate numbers where necessary, not used for marketing, and not used for any other purpose.

How long we keep it.
Health and dietary information is deleted within three (3) months of your event, unless you ask us to retain it for a recurring programme.

Participants may ask us to correct or delete information held about them at any time.

How we use your personal data

• Performance of a contract — to plan, coordinate and deliver your event, issue quotations and invoices, and manage the client relationship.
• Legitimate interests — to respond to enquiries, send operational communications, and maintain records of services delivered.
• Explicit consent — for participants' health and dietary information, as above.
• Consent — for marketing communications, where you have opted in. You may opt out at any time.
• Legal obligation — to comply with financial, tax and other legal obligations.

Photography at events

We will confirm with the client in advance whether photography or filming may take place at your event.

Where we wish to publish images in which an individual is clearly identifiable, particularly close-up or portrait images, we will obtain that individual's consent. No participant will be named or tagged without consent.

If any participant would prefer not to be photographed, tell us before the event and we will manage it discreetly.

Event photography is retained for as long as it remains current for portfolio and marketing purposes, and reviewed every three (3) years. Images of identifiable individuals are removed on request.

Data sharing

We do not sell, rent or trade personal data, and we do not share it with third parties for commercial purposes.

Where necessary to deliver your event, information may be shared with the practitioners and staff delivering it, venues we are booking on your behalf, any associated company or brand engaged as part of your booking, and third-party service providers acting on our instructions.

We may also share data where legally required.

Third-party service providers may include email and marketing platforms, cloud storage and productivity tools, accounting and invoicing software, and website hosting and IT support. These act only on our instructions, are subject to confidentiality obligations, and must handle data in accordance with UK GDPR.

Information collected via our website

We collect information submitted through contact and enquiry forms (name, email, telephone, message), quotation requests (event details and contact information), and mailing list sign-up (name and email).

Information submitted through website forms is used to respond to your enquiry or process your request, and will not be used for marketing without your explicit consent.

Cookies

Our website uses cookies to help the site function, to understand how visitors use it, and — where you consent — to support our marketing.

• Essential cookies are necessary for the site to function and cannot be disabled.
• Analytics cookies are used to understand how visitors use the site and are only set with your consent.
• Marketing cookies enable relevant advertising and are only set with your consent.

Our website currently only uses essential cookies for functionality.

How long we keep your data

• Health and dietary information — 3 months after the event
• Enquiries that do not result in a booking — 12 months from last contact
• Client correspondence and booking records — 6 years from the last event, per HMRC requirements
• Financial records — 6 years, per HMRC requirements
• Event photography and film — while current for marketing; reviewed every 3 years
• Marketing contacts — until you unsubscribe or ask to be removed
• Website form submissions not progressed — 12 months

Data is securely deleted or anonymised at the end of these periods.

Your rights under UK GDPR

You have the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to object, the right to data portability, and rights relating to automated decision-making.

Where we process data on the basis of consent, you may withdraw it at any time.

You have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.

Storage, security and international transfers

Personal data is stored securely in the United Kingdom. We use HTTPS encryption, restrict access to authorised staff, and review access permissions when responsibilities change.

Where a service provider stores or processes data outside the UK, we ensure an appropriate transfer mechanism is in place — the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or transfer to a country covered by UK adequacy regulations.

Data breaches

In the unlikely event of a breach posing a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours where required, and inform affected individuals without undue delay where the breach is likely to result in high risk.

Children's data

Our services are directed at adults acting on behalf of organisations or as individual clients. We do not knowingly collect personal data from children under 13. Where an event involves participants under 18, we collect information only with appropriate parental or organisational consent.

ICO registration

PenniBlack LDN Ltd is registered with the Information Commissioner's Office as a Data Controller. Our registration number is available on request and can be verified at ico.org.uk.

How to contact us

Free Spirit is a trading name of PenniBlack LDN Ltd, registered in England and Wales, company no. 12397094.

Data Controller:

PenniBlack LDN Ltd

Registered Office:

3 West Drive, Tooting, London SW16 1RP

Email:

info@free-spirit.uk

Telephone:

0800 121 8921

Website:

www.free-spirit.uk

To make a Subject Access Request, withdraw consent or request deletion, please contact us in writing. We will respond within one month.

Changes to this policy

This policy was last updated in October 2026. The current version is always available on our website.