Hero Wellbeing Ltd is committed to taking data security very seriously and takes great care with customer and user data. This Privacy Notice outlines how your personal information will be treated. Our security and privacy policies are periodically reviewed and enhanced and you should check this page to see our most up to date policy.

1. (a) The controller is Hero Wellbeing Ltd, and we are committed to complying with the UK’s data protection law and the EU General Data Protection Regulation (GDPR) for the protection of personal data, as well as the principles of data security in the configuration of our services. We can be contacted at Registered office address Gresham House, 5-7 St Paul’s Street, Leeds, LS1 2JG.

(b) If you have any questions about this Privacy Notice or how we use your personal data, please contact via support@herowellbeing.com.

(c) The purpose for processing your personal information is to allow us to administer your account with us and to provide the products and services you have requested from us. In order to enter into an agreement with Hero Wellbeing Ltd, we will collect, store and use elements of your personal data. The lawful basis for processing of this personal data is known as contractual basis and is necessary by Hero Wellbeing Ltd in order to administer your account and to provide the products and services you have requested from us.

When engaging Hero Wellbeing Ltd you will usually need to disclose the following:

• first name(s), surname or company name (including representation as the case may be)
• address (street, street number, postal code, city and country/region)
• email address
• telephone and mobile number

We will also monitor, record, store and use any telephone call, email or other electronic communications with you for training purposes so that we can check any instructions given to us and to improve the quality of our customer service.

(d) We will also process your details through our internal systems to enable us to send you relevant communications. The lawful basis for processing this information internally will be Legitimate Interests. Any email communications we send will however comply with the Privacy and E-communications Regulation (PECR.) If you have chosen to opt-in to our direct marketing communications, we will use your information to tell you about products and services available from us which may be of interest to you. We may also use your information to tell you about
products and services from our approved partners. You have a right to opt-out of our direct marketing communications at any time. You can opt-out by following the unsubscribe instructions at the bottom of the communication or by emailing support@herowellbeing.com.

2. (a) Where possible, Hero Wellbeing Ltd will take steps to erase any personal data that is no longer necessary for the purposes for which it is collected or otherwise processed, or if you have withdrawn consent for its processing and retention. As a general rule, if you currently have a contract or intend to enter into a contract with Hero Wellbeing Ltd, we will store the data for a period of six years after the contract ends, for compliance with our general legal obligations and for the exercise or defence of any legal claims.

(b) Under the GDPR, you have the right to ‘block’ or request the deletion or removal of personal data to prevent further processing. This right to erasure is also known as ‘the right to be forgotten’.

Specific circumstances in which you can request the deletion or removal of personal data includes:

• Where the personal data is no longer necessary for the purposes for which it is collected or otherwise processed
• Where you withdraw consent
• When you object to the processing and there is no overriding legitimate interest for continuing the processing
• Where the personal data was unlawfully processed (i.e. otherwise in breach of the GDPR)
• Where the personal data has to be erased in order to comply with a legal obligation
• In case a deletion is not possible due to legal, statutory or contractual retention periods, or if it requires disproportionate efforts or prejudices your legitimate interests, the data will be blocked instead of deleted.

You also have the right to see what personal information we are processing. This can be requested by emailing our Data Protection Officer at support@herowellbeing.com. There will be no charge for this service. If, however, you log multiple requests, then there may be nominal charge which we will request to cover the administration of these requests.

You may also request from us a copy of the personal data which has been processed through automated means This will be provided in a structured, commonly used, and machine-readable format (where technically feasible) which you may then transmit to another controller. You have the right to request us to send this to another controller on your behalf, but only if this is technically feasible for us to do so.

(c) You have the right to withdraw your consent for us to collect, process and store your data at any time. If you wish to withdraw your consent, please confirm this in writing to our Data Protection Officer.

(d) If you have a complaint about any aspect of data protection or if you feel your privacy has been breached by us, we would like to hear from you. To help us investigate and resolve your concerns as quickly as possible, please contact our Data Protection Officer.

If you are unhappy with the final response you have received from Hero Wellbeing Ltd, you have the right to complain to the supervisory authority, the Information Commissioner’s Office (ICO) within three months of your last meaningful contact with us. You can call the ICO on 0303 123 1113 or by visiting their website: https://ico.org.uk/.

(e) You will be required to provide personal data, and this is a requirement to enter in to contract. You are obliged to provide this data. Failure to provide this personal data may mean we will be unable to execute the contract and could result in termination of our services. If at any time we intend to further process your personal data for a reason not originally communicated, we shall provide you, prior to that processing taking place, all relevant information on the additional processing as per paragraph 2 above.