Business User Privacy Notice
Version 1.0 — Effective 3 October 2026
Who this is for This notice applies to people who visit our business websites, create or use a FlexiStarter employer account, contact us about the Service, receive business communications from us, or act as an administrator or authorised user for a Customer. |
1. Controller
FLEXIWORK LTD is the controller for the personal data described in this notice. Company number: 17116161. Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. ICO registration reference: ZC220600. Contact: joinflexiwork@gmail.com.
2. Information we collect
- identity and contact information, such as name, work email, telephone number and job title;
- account and organisation information, such as employer name, locations, role, permissions and account status;
- billing and transaction information where paid plans are enabled;
- communications with us, including support requests, feedback and complaints;
- technical and security information, such as IP address, device/browser information, session identifiers, login activity, diagnostic events and security logs;
- product usage information, such as features used and actions taken in the employer workspace; and
- marketing preferences and consent records.
3. Why we use it and lawful bases
Purpose | Examples | Lawful basis |
|---|---|---|
Provide and administer FlexiStarter | Create accounts, authenticate users, manage organisations, permissions and support | Contract; legitimate interests |
Secure and protect the Service | Fraud prevention, abuse detection, access logs, incident response | Legitimate interests; legal obligation where applicable |
Billing and records | Process subscriptions, invoices, tax/accounting records | Contract; legal obligation |
Improve and operate the Service | Troubleshooting, service analytics, quality and performance | Legitimate interests, balanced against user rights |
Communicate with users | Service messages, security notices, support and account updates | Contract; legitimate interests |
Product marketing | Optional news, tips and offers | Consent where obtained; otherwise only where permitted by PECR and data protection law |
Legal and regulatory matters | Exercise or defend legal rights, respond to regulators or lawful requests | Legal obligation; legitimate interests |
4. Where information comes from
We receive information directly from you, from your organisation or colleagues, through your use of our websites and Service, from our service providers, and from public business sources where relevant to a business relationship.
5. Sharing
We share personal data only where necessary, including with infrastructure, hosting, authentication, communications, support and payment providers; professional advisers; authorities where legally required; and a buyer or successor in connection with a genuine corporate transaction. Our material sub-processors are listed separately.
6. International transfers
Some providers may process information outside the UK. Where required, we use an applicable adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to approved Standard Contractual Clauses. You may contact us for information about relevant safeguards.
7. Retention
We keep personal data only for as long as reasonably necessary for the purposes described above, including to provide the Service, maintain security, comply with legal/accounting obligations, resolve disputes and enforce agreements. Account and contractual records may be retained after an account closes where reasonably necessary for those purposes. Marketing records are kept until you withdraw consent or opt out, with limited suppression information retained so we can respect that choice.
8. Your rights
Depending on the circumstances and lawful basis, you may have rights to be informed, access your personal data, correct inaccurate data, request erasure or restriction, receive portable data, object to certain processing, withdraw consent, and receive safeguards relating to solely automated significant decisions. Rights can be subject to legal conditions and exemptions.
Right to object: where we rely on legitimate interests, you may object to that processing. You can always object to direct marketing and we will stop using your data for that purpose.
9. Automated decisions
FlexiStarter is not intended to make hiring or employment decisions on behalf of Customers. If we introduce solely automated processing that produces legal or similarly significant effects for business users, we will provide the information and safeguards required by law.
10. Complaints
You can raise a data protection complaint with us at joinflexiwork@gmail.com. We will acknowledge a data protection complaint within 30 days and investigate and communicate the outcome in accordance with applicable law. You also have the right to complain to the UK Information Commissioner’s Office (ICO).
11. Changes
We may update this notice when our processing or the law changes. We will publish the current version and, where appropriate, notify users of material changes.