Service by appointment only
Call 020 7736 0046
Call 020 7736 0046 To book
1. Who are we?
This privacy policy explains how Profeet Limited (‘Profeet, ‘we’, ‘us’ or ‘our’) collects, uses and protects personal data.
Data controller: Profeet Limited
Register office/postal address: 867-869 Fulham Road, London, SW6 5HP
Company registered number: 04286892
Email: info@profeet.co.uk
Phone: 020 7736 0046
Website: www.profeet.co.uk and shop.profeet.co.uk
If you have any questions about this policy or want to exercise your data protection rights, please contact us using the details above.
Privacy queries should be sent to info@profeet.co.uk.
2. What this policy covers
This policy applies to our websites at www.profeet.co.uk and shop.profeet.co.uk
This policy applies to personal data we collect when you visit our website, contact us with an enquiry, book or attend an appointment, buy products or services from us, sign up for marketing, interact with us on social media, or visit our premises.
It explains what personal data we collect, how we use it, our lawful bases under the UK GDPR, when we may share it, whether we transfer it outside the UK, how long we keep it, your rights, and how to contact us or the Information Commissioner’s Office (ICO).
Most of the personal data covered in this policy is obtained directly from you. Where we receive personal data from another source, we will provide any privacy information required by Article 14 UK GDPR within a reasonable period and, where applicable, no later than 30 days after receiving the data, unless an exemption applies.
3. The personal data we collect
Depending on how you interact with us, we may collect the following categories of personal data:
Contact and identity data: name, billing address, delivery address, email address, phone number, and social media handle or messaging details where relevant.
Booking, order and account data: appointment details, products and services purchased, payment-related status information, order history, refund and aftercare records, and communications about your booking, order or enquiry. Some of this data may be received from third parties as described in ‘How we collect your personal data’ below.
Appointment and assessment data: information you give us about your sport, activity, footwear needs and fitting history, observations and notes from appointments, movement or biomechanical assessment information, video, images, 3D images, pressure, force or gait-related measurement data where used as part of our service, and fitting, customisation and refit records.
Special category data: some appointment information may amount to special category data, especially where it reveals information about your physical health or injury status. This may include injury history, physical limitations, physical condition relevant to fitting or movement assessment, and assessment outputs that reveal health-related information. Some of the appointment and assessment data described above may also constitute special category health data. We explain how we handle this, including our reliance on explicit consent, in the “Special category data” section below.
Technical and website usage data: IP address, browser type, device information, pages viewed and actions taken on our website, cookie and analytics data, and approximate location derived from IP where relevant.
CCTV data: if you visit our premises, we may capture CCTV footage for safety, security and incident management.
Marketing and preference data: whether you want to receive marketing from us, your communication preferences, and records of opt-ins, soft opt-in assessments and opt-outs.
4. How we collect your personal data
We collect personal data directly from you, for example when you complete a form, make an enquiry, book an appointment, attend an appointment, place an order, or contact us.
We also collect data during appointments through specialist tools, software or hardware used to assess fitting, movement or product suitability, and automatically when you use our website through cookies and similar technologies.
Where relevant, we may also receive personal data provided by you from third parties such as Jane.app (online booking provider), Citrus Lime (E-commerce platform), CitrusPay (Payment Processor), delivery providers, or another person acting on your behalf.
We do not usually obtain personal data from any other source. If we receive your personal data from a source other than you, we will provide any required privacy information as soon as reasonably possible.
5. How we use your personal data and our lawful bases
We must have a valid and lawful basis under Article 6 UK GDPR for using your personal data. Where we process special category data, we must also satisfy a separate Article 9 condition. The table below sets out the main processing purposes described in this policy.
| Purpose | Typical data used | Article 6 lawful basis | Article 9 condition (if special category data is involved) |
|---|---|---|---|
| Respond to enquiries and manage bookings | Contact data, booking details, communications | Contract, or steps at your request before entering a contract | Not usually applicable |
| Provide appointments, fitting, product recommendations, customisation, refits and aftercare | Contact data, booking data, appointment notes, assessment data, purchase history | Contract | Explicit consent where appointment information reveals health-related information and consent is the Article 9 condition relied on |
| Process and fulfil orders, deliveries, refunds and returns | Identity, contact, order and transaction data | Contract | Not usually applicable |
| Keep service history so we can assist with future visits, including administering our fit guarantees and aftercare services | Appointment records, purchase history, correspondence | Legitimate interests, namely continuity of service and customer support; in some cases, contract where the record is needed to perform ongoing aftercare obligations | Explicit consent where appointment information reveals health-related information and consent is the Article 9 condition relied on |
| Keep accounting, tax and consumer law records | Identity, contact, transaction and order records | Legal obligation | Not usually applicable |
| Manage complaints | Correspondence, service history, complaint records, CCTV where relevant | Legitimate interests, namely complaint handling, service improvement and defending our position; legal obligation where a complaint record must be kept by law | Only if special category data is unavoidably involved; if so, Article 9 condition should be identified in the specific case |
| Keep our premises, staff and visitors safe and prevent or detect incidents | CCTV footage, incident records | Legitimate interests | Not usually applicable |
| Administer and improve our website and online services | Technical data, analytics data, cookie data | Legitimate interests for strictly necessary functionality; consent where required for non-essential cookies/technologies | Not applicable |
| Send marketing by email, SMS or similar electronic means to new subscribers or where consent is otherwise required | Contact details, marketing preferences | Consent | Not applicable |
| Send service messages about bookings, orders, safety, policy changes or important account matters | Contact details, booking or order data | Contract where the message is necessary to provide the service; legal obligation where the message is required by law; legitimate interests for other essential administrative communications | Not applicable |
| Establish, exercise or defend legal claims | Relevant records from the categories above | Legitimate interests | Where special category data is involved, the relevant Article 9 condition will depend on the circumstances and legal advice received |
6. Where we rely on legitimate interests
Where we rely on legitimate interests, those interests include running and improving our business, providing continuity of service and aftercare, handling complaints and customer support, keeping appropriate business records, maintaining website performance and security, using CCTV for safety and incident management, and protecting our staff, customers, premises and property.
You can object to processing based on legitimate interests in some circumstances. You also have an absolute right to object to direct marketing at any time.
If you would like more information about a legitimate interest or assessment relevant to a particular processing activity, you can contact us using the details in this policy.
7. Special category data
Some of the information used during appointments may be special category data because it may reveal information about your health or physical condition.
Where we process health-related data as part of fitting, biomechanical assessment, customisation, or aftercare services, we do so only where it is reasonably necessary to assess suitability and provide the service you have requested. Our Article 6 basis will usually be performance of a contract or, where relevant, legitimate interests at your request before entering a contract. Our Article 9 condition is explicit consent, unless another lawful condition applies in the specific circumstances.
Where we process special category data, we will only collect what is reasonably needed, explain why we need it, use an Article 6 lawful basis and an Article 9 condition, ask for explicit consent where that is the condition we rely on, and stop using it for that purpose if you withdraw consent unless another lawful basis or Article 9 condition applies.
Where we rely on explicit consent, we obtain that consent through our appointment booking or acceptance process before collecting or using the relevant health-related information.
Where we rely on explicit consent, you can withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing carried out before the withdrawal.
If you do not provide certain information or withdraw consent where that consent is necessary for the service, we may be unable to carry out some appointment, fitting or customisation services.
Some personal data is required so that we can manage bookings, provide appointments, fulfil orders and comply with legal obligations. If you do not provide that information, we may be unable to enter into or perform our contract with you.
We do not normally process criminal offence data.
8. Marketing
We may send you information about products, services, events, offers or updates that we think may interest you.
Where UK law requires it, we will ask for your consent before sending electronic marketing. In some cases, we may rely on the soft opt-in if you are an existing customer and the law allows it.
You have the right to object at any time to processing for direct marketing. If you object, we will stop using your personal data for that purpose. You can opt out of marketing at any time by clicking the unsubscribe link in an email or, replying STOP to a text message where applicable, or contacting us at info@profeet.co.uk. We may still send you non-marketing messages where necessary, for example about a booking, order, safety issue, refund, service update or legal notice.
9. Cookies and similar technologies
We use cookies and similar technologies on our website.
Strictly necessary cookies are needed for the website to work properly and do not require consent.
Non-essential cookies may include analytics, performance, advertising or social media cookies. We do not place these cookies on your device until you have given your consent.
You can withdraw or change your cookie preferences at any time, and doing so is as easy as giving consent, by using the “Cookie settings” link available on our website.
For more information, including the specific cookies we use, their duration and how to change your choices, please see the applicable cookie policy for the website you are using:
10. Who we share personal data with
We do not sell personal data.
We may share personal data with the following categories of recipient where necessary: Jane.app, Citrus Lime, CitrusPay, MailChimp, Royal Mail, IT support and cloud storage providers, gait analysis software providers, CCTV or security service providers, professional advisers including lawyers, accountants, auditors and insurers, regulators, law enforcement or government bodies where legally required, and potential buyers or advisers in connection with a business sales, merger or restructuring where lawful and appropriate.
Where a third-party acts as our processor, it may only process personal data on our documented instructions and must keep it secure. Some recipients, such as payment providers, delivery providers, professional advisers, regulators or law enforcement bodies, may act as separate controllers for their own purposes.
If you want more detail about a particular recipient or category of recipient relevant to your data, you can contact us using the details above.
11. International transfers
Some suppliers may process personal data outside the UK.
Where this happens, we will only transfer personal data where there is a lawful transfer mechanism in place, such as a country covered by UK adequacy regulations or approved transfer safeguards under Article 46 UK GDPR, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses or another approved mechanism, as applicable.
Where required, we will also carry out transfer risk assessments and put supplementary measures in place. You can contact us if you would like more information about the international transfers relevant to your data or the safeguard relied on.
12. How long we keep personal data
We keep personal data only for as long as we need it for the purpose it was collected, including to meet legal, accounting, tax, consumer protection, complaint-handling and record-keeping requirements.
| Category of data | Retention period |
|---|---|
| General enquiries | For as long as required to fulfil the enquiry |
| Booking records | For as long as required to fulfil the booking |
| Appointment notes and assessment records | 6 years after the initial appointment or interaction |
| Video, image, pressure and biomechanical assessment outputs | 6 years after the initial appointment or interaction |
| Order, invoice, refund and transaction records | 7 years from the end of the financial year or transaction date |
| Complaint and aftercare records | 6 years after resolution |
| Marketing consent and suppression records | For as long as needed to respect your preference |
| CCTV footage | 14 days, unless required for an incident, investigation or legal claim |
| Website analytics and cookie data | See the applicable cookie policy for the website you are using, which sets out the retention period for each cookie/technology. |
We may keep data for longer where necessary to establish, exercise or defend legal claims or to comply with law.
13. Security
We use appropriate technical and organisational measures to help protect data against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include access controls, staff training, secure systems, supplier due diligence and policies on retention and deletion.
No system can ever be completely secure, but we take data protection and information security seriously and work to protect personal data in a way that is proportionate to the sensitivity of the information we hold.
14. Automated decision making
We do not make decisions about you solely by automated means where those decisions have legal or similarly significant effects on you.
15. Children’s personal data
Our website and in-store services are not intended for children under 13 years of age unless we say otherwise at the point of collection.
We do not knowingly collect personal data online or in-store from children under that age without appropriate parent or guardian involvement. If you believe a child has given us personal data in error, please contact us so we can review and, where appropriate, delete it.
16. Your data protection rights
Depending on the circumstances, you have the right to:
- be informed about how we use your personal data
- access a copy of your personal data
- correct inaccurate or incomplete data
- erase personal data in some circumstances
- restrict how we use personal data in some circumstances
- object to processing based on legitimate interests
- object at any time to direct marketing
- receive data portability where applicable
- withdraw consent at any time where we rely on consent.
To exercise your rights, please contact us at info@profeet.co.uk. We may ask you for information to verify your identity before dealing with your request. We will usually respond within 30 days, although the law allows longer in some cases.
17. Your right to complain
You have the right to make a complaint to us if you are concerned about how we have handled your personal data. We welcome the chance to address your concerns directly. You can make a complaint by contacting us at info@profeet.co.uk or using the contact details in this policy. We will acknowledge your complaint within 30 days of receiving it, take appropriate steps to investigate it without undue delay, keep you informed of progress, and let you know the outcome.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection matters if your complaint remains unresolved.
ICO website: https://ico.org.uk/make-a-complaint/
ICO helpline: 0303 123 1113
18. Changes to this policy
We may update this privacy policy from time to time. When we make changes, we will post the updated version on the relevant website and update the ‘Last updated’ date. Where appropriate, we may also bring important changes to your attention directly.
19. Contact us
If you have any questions about this privacy policy or how we handle personal data, please contact:
Profeet Limited
867-869 Fulham Road
London
SW6 5HP
info@profeet.co.uk
020 7736 0046