Privacy Policy

Last updated: Sept 2026

This policy explains what personal data Pure Flow State ("Pure Flow State", "we", "I", "us") collects when you use www.pureflowstate.co.uk, why we collect it, and what rights you have over it.

We are the data controller for the information described below. Our details are:

Pure Flow State
Studio 9, 50-54 St Paul’s Square, Birmingham, B3 1QS
Company number: 13606745
Email: hello@pureflowstate.com

What we collect, and why

When you fill in a form on this site
We collect your first name, last name, email address and anything you choose to write in the message field. If you request the messaging guide, we collect the same details plus your choice about receiving our newsletter.

We use this to reply to you, to send you the guide you asked for, and to have a conversation about whether we can help. Our lawful basis is taking steps at your request before entering into a contract, and our legitimate interest in responding to enquiries about our services.

When you subscribe to the newsletter
We collect your name and email address. Our lawful basis is your consent, given by ticking the subscription box. You can withdraw it at any time using the unsubscribe link in any email, or by emailing us. Withdrawing consent does not affect anything we sent before you withdrew it.

When you book a call

Bookings are handled by WIX's Booking. When you book, you provide your name, email address and any details you add about what you'd like to discuss. That information is held by WIX's Booking under their own privacy policy, and is also visible in our calendar and email. Our lawful basis is taking steps at your request before entering into a contract.

When you visit the site

Our host records technical information automatically, including your IP address, browser type, device type, the pages you view and the site you arrived from. Some of this is necessary to serve the site securely, and our lawful basis for that is our legitimate interest in keeping the site working and protected. Anything beyond that, including analytics, is only collected if you consent through our cookie banner.

If you become a client
We collect the information needed to deliver the work and run the business, which will typically include your name, role, business contact details, billing details and the material you share with us during a project. Our lawful basis is performance of our contract with you, and compliance with our legal obligations for accounting records.

We do not collect special category data

We don't ask for information about health, race, religion, political opinions, sexual orientation, trade union membership, biometrics or genetics, and we'd ask you not to send it to us. If you do include something like that in a message, we'll only use it to respond to you and will delete it when we no longer need it.

Who we share it with

We don't sell your data and we don't share it for anyone else's marketing. We do use a small number of service providers who process data on our behalf:

Provider What they do Wix.com Ltd Hosts the website and processes form submissions Mail Lite Sends the newsletter and delivers the guide WIX's Bookings Manages call bookings Google (Workspace) Our email and document storage with Google Website analytics, only where you have consented Invoicing and accounting records

Each of these is bound by a contract requiring them to protect your data and use it only on our instructions. We may also disclose information where we're legally required to, for example to HMRC or in response to a valid court order.

International transfers

Some of the providers above store data outside the UK, including in the United States, the European Economic Area and Israel. Where data leaves the UK, we rely on either a UK adequacy decision for that country, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, which places contractual obligations on the recipient to protect your data to UK standards.

How long we keep it

Enquiries that don't become work: up to 24 months from our last contact, then deleted.
Newsletter subscribers: until you unsubscribe, or after 24 months of no engagement, whichever comes first.
Client records: for the duration of the engagement and then 7 years, to meet HMRC and accounting requirements.
Website analytics:  14 months.

Cookies

The site uses cookies that are strictly necessary for it to function, including session and security cookies set by Wix. These don't require your consent.

We also use Google Analytics cookies, which are only set if you agree through the banner when you first visit. You can change or withdraw that choice at any time via the cookie banner on the website, or by clearing cookies in your browser.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you

• have inaccurate data corrected

• ask us to delete your data, in certain circumstances

• ask us to restrict how we use it, in certain circumstances

• object to processing we carry out on the basis of legitimate interests

• object to direct marketing at any time, with no conditions

• receive your data in a portable format, where processing is based on consent or contract

• withdraw consent at any time, where consent is the basis we rely on

To exercise any of these, email adele@pureflowstate.com. We'll respond within one month. There's no charge unless a request is manifestly unfounded or excessive.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Security

We use encrypted connections (HTTPS) across the site, restrict access to personal data to those who need it, and require multi-factor authentication on the accounts holding it. No system is completely secure, but we take reasonable steps to protect your information and will notify you and the ICO where we're legally required to following a breach.

Automated decision-making

We don't make any decisions about you using automated processing or profiling.

Links to other sites

This site links to third-party websites, including Instagram and LinkedIn. We're not responsible for their privacy practices, and we'd encourage you to read their policies before sharing anything with them.

Changes to this policy

We'll update this page when our practices change, and the "last updated" date will tell you when. Where changes are significant, we'll let newsletter subscribers know by email.