Privacy Policy

1. Introduction

FLEX Active Group Ltd (trading as “FLEX”, “we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use the FLEX gym clothes laundry service, our website at flexlaundry.co.uk, and our WhatsApp-based communication platform.

FLEX Active Group Ltd is the data controller for the purposes of applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: hello@flexlaundry.co.uk | +44 7366 907286

2. Information We Collect

We collect the following categories of personal data:

2.1 Information you provide directly

• Full name, email address, and mobile phone number (provided during registration)
• Gym location preference (selected during sign-up)
• Payment information (card details are processed and stored securely by Stripe; we do not store your full card number on our servers)
• Support ticket content, including descriptions of issues and any photographs submitted

2.2 Information generated through your use of the service

• Drop and pickup records, including bag numbers, dates, times, and status updates
• Subscription plan details, billing history, and drop usage
• WhatsApp messages exchanged with our service (processed via Twilio)
• Login verification codes and authentication session data

2.3 Automatically collected information

• Device type, browser type, and operating system when accessing our website
• IP address and approximate location data
• Pages viewed and interactions on our website

3. How We Use Your Information

We process your personal data for the following purposes:

• Service delivery: To process your laundry drops, track bag status, manage pickups, and return your clean clothes to the correct gym location
• Communication: To send you notifications via WhatsApp and email, including drop confirmations, ready-for-pickup alerts, subscription reminders, and low-drop warnings
• Payment processing: To charge for services via Stripe, manage subscription billing, process refunds, and handle failed payment recovery
• Customer support: To respond to your inquiries, manage support tickets, and resolve issues related to lost or damaged items
• Account management: To authenticate your identity via verification codes, manage your subscription status, and maintain your member profile
• Service improvement: To analyse usage patterns (in aggregate) and improve the quality and efficiency of our service
• Legal compliance: To comply with our legal and regulatory obligations, including financial record-keeping requirements

The legal bases for our processing are: performance of a contract (providing the service you signed up for), legitimate interests (improving our service, preventing fraud), consent (where applicable for marketing communications), and legal obligation (financial records, tax compliance).

4. Data Sharing

We share your personal data only with the following third-party service providers, each of whom is necessary to deliver the FLEX service:

• Stripe (stripe.com) — Payment processing. Stripe processes and stores your payment card details securely. Stripe is PCI DSS Level 1 certified.
• Twilio (twilio.com) — WhatsApp messaging. Twilio processes your phone number and message content to deliver WhatsApp notifications and enable conversational support.
• Resend (resend.com) — Email delivery. Resend processes your email address and email content to send transactional emails (verification codes, receipts, support replies).
• Airtable (airtable.com) — Operational database. Airtable stores your account information, drop records, and support tickets to enable service operations.
• Vercel (vercel.com) — Website hosting. Vercel hosts our website and processes standard web server logs.

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We do not share your data with advertisers.

We may disclose your information if required to do so by law, regulation, or legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

5. International Data Transfers

Some of our third-party service providers (Stripe, Twilio, Airtable, Vercel) process data in the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the Information Commissioner's Office (ICO), or reliance on the provider's certification under recognised frameworks.

6. Data Retention

• Active accounts: We retain your personal data for as long as your FLEX account is active and you are using our service.
• After cancellation: We retain your account data for 12 months following cancellation or account closure, in case you wish to reactivate your account or in the event of a dispute.
• Financial records: Payment and transaction records are retained for 7 years as required by UK tax and accounting regulations (HMRC requirements).
• Support tickets: Support correspondence is retained for 24 months after resolution.
• Verification codes: Login verification codes are automatically deleted within 10 minutes of generation or upon successful use.

You may request earlier deletion of your data at any time (see Section 7 below), subject to our legal retention obligations.

7. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can request correction of inaccurate or incomplete data.
• Right to erasure: You can request deletion of your data (subject to our legal retention obligations).
• Right to restrict processing: You can request that we limit how we use your data in certain circumstances.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at hello@flexlaundry.co.uk. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encrypted data transmission (HTTPS/TLS) across all services
• Secure authentication using time-limited JWT tokens
• Payment data handled exclusively by PCI DSS-certified Stripe
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular review of data processing practices and security measures

While we take reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

9. Cookies

We use only essential cookies necessary for the operation of our service:

• flex_auth: An authentication cookie containing a JSON Web Token (JWT) that keeps you logged into the member portal. This cookie expires after 7 days. It is strictly necessary and cannot be disabled without preventing access to authenticated features.

We do not use any analytics, advertising, or third-party tracking cookies. We do not participate in any advertising networks or retargeting programmes.

10. Children's Privacy

FLEX is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, service features, or legal requirements. We will notify you of significant changes via email or WhatsApp at least 14 days before they take effect. The “last updated” date at the top of this page indicates when this policy was most recently revised.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: hello@flexlaundry.co.uk
• WhatsApp: +44 7366 907286
• Post: FLEX Active Group Ltd, London, United Kingdom
• Company Number: 12345678 (registered in England & Wales)