Privacy policy

This Privacy Policy explains how Flam collects, uses, stores and protects personal information when you use our websites, applications and services.

Flam is operated by Flam Labs Ltd, a company registered in England and Wales under company number 17480585, whose registered office is at Primrose Cottage, Eversley Centre, Hook, Hampshire, RG27 0NF, United Kingdom.

In this policy, "Flam", "we", "us" and "our" refer to Flam Labs Ltd.

If you have any questions about this policy or how we use personal information, you can contact us at privacy@flamlabs.com.

1. Who this policy applies to

This policy applies to:

• people who create or use a Flam account;
• employees, contractors and team members invited to a Flam business account;
• visitors to our website;
• people who contact us directly; and
• customers or prospective customers whose information is processed through Flam by a business using our Service.

Flam is primarily a business-to-business service.

2. Our role when processing personal data

There are two main situations in which Flam processes personal data.

Information about Flam users

Where we collect personal information about people who create accounts, pay for Flam, contact us or use our website, we act as the data controller.

This means we determine why and how that information is processed.

Information about your customers

Businesses using Flam may collect and manage personal information about their own customers or prospective customers through the Service.

For example, this may include:

• customer names;
• email addresses;
• telephone numbers;
• enquiry details;
• messages;
• booking information;
• uploaded files;
• quotes;
• payment information; and
• other information submitted through an enquiry form.

In these circumstances, the business using Flam will generally be the data controller, and Flam will act as a data processor on that business's behalf.

Our processing of this information is governed by our Terms of Use and, where applicable, our Data Processing Agreement.

3. Information we collect

Depending on how you use Flam, we may collect the following information.

Account information

This may include:

• your name;
• email address;
• password credentials in encrypted or hashed form;
• business name;
• business contact details;
• business address;
• account role;
• account preferences; and
• information about other people you invite to your account.

Business information

You may provide information about your business, including:

• services;
• prices;
• branding;
• contact information;
• enquiry forms;
• booking terms;
• availability information; and
• other business settings.

Customer and enquiry information

When your customers use Flam, the information processed may include:

• names;
• email addresses;
• telephone numbers;
• enquiry responses;
• event or booking information;
• messages;
• notes;
• uploaded files;
• quotes;
• payment records; and
• booking history.

The exact information collected depends on how the business using Flam configures its enquiry forms and Service.

Payment information

Payments may be processed by Stripe.

We generally do not receive or store full payment card numbers.

Stripe may provide us with information such as:

• payment status;
• payment amount;
• transaction identifiers;
• card type;
• limited card details such as the last four digits;
• connected Stripe account information; and
• information relating to refunds, disputes or chargebacks.

Stripe processes payment information under its own privacy terms.

Technical information

When you use Flam, we may automatically collect information including:

• IP address;
• browser type;
• device type;
• operating system;
• pages accessed;
• timestamps;
• login activity;
• security events;
• error logs; and
• general usage information.

We use this information to operate, secure and improve the Service.

Communications

If you contact us, we may retain information contained in your correspondence with us, including support requests and emails.

4. How we use personal information

We may use personal information to:

• provide and operate Flam;
• create and administer accounts;
• authenticate users;
• process enquiries, messages, quotes and bookings;
• process or facilitate payments;
• provide customer support;
• send transactional emails and notifications;
• manage subscriptions and billing;
• prevent fraud and abuse;
• protect the security of Flam;
• diagnose errors and software bugs;
• maintain logs and backups;
• improve the performance and usability of the Service;
• comply with legal obligations;
• enforce our Terms of Use; and
• establish, exercise or defend legal claims.

Where analytics are enabled, we may also use aggregated website usage information to understand how visitors use our website and improve it.

5. Our lawful bases

Under UK data protection law, we must have a lawful basis for processing personal data. The appropriate lawful basis depends on the reason we are using the information.

We generally rely on the following.

Contract

We process information where it is necessary to provide Flam and fulfil our contractual obligations to you.

For example:

• creating your account;
• providing the Service;
• processing subscriptions;
• providing support; and
• administering your business account.

Legitimate interests

We may process information where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights.

These interests may include:

• securing Flam;
• preventing fraud;
• improving the Service;
• monitoring reliability;
• responding to support requests;
• maintaining records;
• protecting our legal rights; and
• understanding how our Service is used.

Legal obligation

We may process information where required to comply with applicable laws, regulations, tax obligations, court orders or lawful requests.

Consent

Where required, we may rely on consent.

For example, we would normally rely on consent for non-essential analytics cookies such as Google Analytics.

You may withdraw consent at any time.

6. Google Analytics

We may use Google Analytics to understand how visitors use our website.

Google Analytics may collect information such as:

• pages viewed;
• approximate location;
• device type;
• browser information;
• referral source;
• interactions with the website; and
• general usage information.

Where required by law, Google Analytics will only be enabled after you have given consent through our cookie controls.

You can withdraw or change your consent at any time.

If we use Google Analytics, information may be processed by Google in countries outside the UK.

For more information about how Google processes information, please refer to Google's privacy documentation.

7. Cookies

Flam may use cookies and similar technologies.

Some cookies are strictly necessary for the Service to function.

These may be used for things such as:

• logging you in;
• maintaining your session;
• remembering security settings;
• preventing fraud; and
• keeping the Service secure.

We may also use optional analytics cookies, such as those used by Google Analytics.

Where required, optional cookies will not be placed until you have provided consent.

You can change your cookie preferences at any time through our cookie controls.

8. Who we share information with

We do not sell personal information.

We may share information with trusted service providers where necessary to operate Flam.

These may include providers of:

• website and application hosting;
• databases;
• cloud infrastructure;
• email delivery;
• file storage;
• payment processing;
• monitoring and error reporting;
• analytics;
• security services; and
• customer support tools.

Examples may include Stripe for payment processing and Google if Google Analytics is enabled.

These providers are only permitted to process information as necessary to provide their services to us and are subject to their own contractual and legal obligations.

We may also disclose information where reasonably necessary:

• to comply with the law;
• to respond to a court order or lawful authority;
• to investigate fraud or security incidents;
• to protect Flam, our users or others;
• to enforce our agreements; or
• in connection with a merger, acquisition, restructuring or sale of our business.

9. International transfers

Some companies that provide services to Flam may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we will take reasonable steps to ensure that appropriate safeguards are in place as required by applicable data protection law.

These safeguards may include:

• UK adequacy regulations;
• approved contractual safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses; or
• another legally recognised transfer mechanism.

10. How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Retention periods vary depending on the type of information.

For example, we may retain:

• account information for the duration of your account;
• transaction and financial records for periods required by tax and accounting law;
• security and system logs for a limited period;
• support communications where reasonably necessary;
• backups for a limited period after data is removed from the live Service; and
• information required to establish or defend legal claims.

When an account is deleted, information may remain within backups for a limited period before being automatically removed.

Where Flam processes customer information on behalf of a business, retention may also depend on instructions given by that business.

11. Security

We take reasonable technical and organisational measures designed to protect personal information.

These may include:

• encryption in transit;
• password hashing;
• access controls;
• authentication controls;
• secure hosting;
• logging and monitoring;
• private file storage;
• backups;
• software updates; and
• restrictions on internal access to personal information.

However, no internet-based service or storage system can be guaranteed to be completely secure.

You are also responsible for protecting your Flam account, passwords, devices and authentication credentials.

12. Your data protection rights

Depending on the circumstances, UK data protection law gives you rights including the right to:

• request access to personal information we hold about you;
• ask us to correct inaccurate information;
• ask us to delete your information;
• ask us to restrict how your information is used;
• object to certain types of processing;
• request transfer of your information in certain circumstances;
• withdraw consent where we rely on consent; and
• complain about how your information has been handled.

These rights are not absolute and may depend on the circumstances.

To exercise your rights, contact us at privacy@flamlabs.com.

We may need to verify your identity before responding to a request.

13. Requests concerning information held by a Flam business

If you are a customer of a business using Flam and wish to exercise rights relating to information that business holds about you, you should normally contact that business directly.

For example, if you submitted an enquiry through a photographer, makeup artist or other Flam user, that business will generally be responsible for deciding how your personal information is used.

Where appropriate, Flam will assist businesses in responding to legitimate data protection requests.

14. Children

Flam is intended for use by businesses and professionals.

We do not knowingly offer Flam accounts directly to children.

Businesses using Flam are responsible for ensuring they have an appropriate lawful basis where they collect information relating to children through their own enquiry forms or customer relationships.

15. Automated decision-making

We do not currently use personal information to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

If this changes, we will update this Privacy Policy where required.

16. Marketing

We may contact Flam users about matters relating to their account or the operation of the Service.

These are service communications and may include:

• security notifications;
• payment information;
• account changes;
• important product changes; and
• other operational messages.

If we send optional marketing communications, you will be able to unsubscribe from them.

We do not use customer data submitted to Flam by businesses to independently market Flam to those customers.

17. Changes to this policy

We may update this Privacy Policy from time to time as Flam evolves or where laws, technologies or our processing activities change.

When we make material changes, we may notify Flam users through the Service, by email or by another appropriate method.

The latest version will always show the date on which it was last updated.

18. Complaints

If you have concerns about how we handle personal information, please contact us first at privacy@flamlabs.com.

You also have the right to complain to the UK data protection regulator:

Information Commissioner's Office (ICO)

You can find information about making a complaint on the ICO website.

19. Contact

For privacy questions or requests, contact: