HolistiQ Lifestyle Limited

Privacy Policy

Version 1.0 · Effective Date: 23/07/2026 · Last Updated: 23/07/2026

1. Introduction

HolistiQ Lifestyle Limited (“HolistiQ”, “we”, “our” or “us”) is committed to protecting your privacy and processing your personal data fairly, lawfully and transparently.

This Platform Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you use the HolistiQ Lifestyle Platform (the “Platform”), including our website, mobile applications, customer accounts, Business Partner dashboards, ordering services, promotional features, rewards programmes and any related products or services that we provide.

We recognise the importance of safeguarding personal data and are committed to complying with all applicable data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (“PECR”), together with any legislation replacing or supplementing those laws and any applicable guidance issued by the Information Commissioner’s Office (“ICO”).

This Privacy Policy explains the categories of personal data that we collect, the purposes for which we process that data, the lawful bases upon which we rely, the circumstances in which we may share personal data with third parties, the measures we take to protect personal data, the period for which we retain personal data, and the rights available to individuals under applicable data protection legislation.

By accessing or using the Platform, creating an account, placing an order, registering as a Business Partner, participating in any rewards or promotional programme or otherwise interacting with HolistiQ, you acknowledge that your personal data may be processed in accordance with this Privacy Policy.

Where additional privacy notices are provided in connection with specific products, services, promotions or features, those notices supplement this Privacy Policy and apply in addition to its terms.

Nothing in this Privacy Policy limits or excludes any rights that you may have under applicable data protection legislation.

2. Who We Are

HolistiQ Lifestyle Limited is the operator of the HolistiQ Lifestyle Platform and, unless expressly stated otherwise, acts as the data controller in relation to the personal data processed through the Platform.

Our registered office is situated at 5 South Charlotte Street, Edinburgh, Scotland, EH2 4AN. Our company registration number is SC823617. You may contact us regarding this Privacy Policy or the processing of your personal data by emailing info@holistiqlifestyle.co.uk.

As data controller, HolistiQ determines the purposes for which and the manner in which personal data is processed through the Platform.

Certain Business Partners may also act as independent data controllers in relation to personal data that they collect or process for their own business purposes, including the preparation and fulfilment of orders, compliance with legal obligations, customer support and the provision of their own goods or services. Where this applies, those Business Partners are responsible for complying with their own obligations under applicable data protection legislation and may provide their own privacy information.

In certain circumstances, HolistiQ may process personal data on behalf of Business Partners or other organisations under a separate written agreement. Where this occurs, HolistiQ will act as a data processor only in relation to the relevant processing activities.

3. Scope of this Privacy Policy

This Privacy Policy applies to all personal data processed through the HolistiQ Lifestyle Platform, including our website, mobile applications, customer accounts, Business Partner dashboards, ordering services, reservation services, promotional activities, rewards programmes, referral programmes, marketing communications, customer support services and any other Platform functionality that we make available from time to time.

This Privacy Policy applies to customers, prospective customers, Business Partners, authorised users of Business Partner accounts, suppliers, contractors, website visitors, marketing contacts and any other individuals who interact with HolistiQ in connection with the Platform.

The Platform is designed to support a marketplace comprising independent restaurants, cafés, takeaways, food businesses, wellness providers, local service providers, experience providers, merchants and other participating businesses approved by HolistiQ. Accordingly, this Privacy Policy applies equally to personal data processed in connection with all categories of Business Partners operating through the Platform.

This Privacy Policy does not apply to personal data processed solely by independent Business Partners outside the Platform where HolistiQ has no control over that processing activity. In such circumstances, the relevant Business Partner will be responsible for its own compliance with applicable data protection legislation.

Where this Privacy Policy refers to the Platform, it includes all current and future digital services, websites, applications, dashboards, customer interfaces, ordering systems, payment integrations, rewards systems, promotional services and related technologies operated by or on behalf of HolistiQ Lifestyle Limited.

4. Definitions

In this Privacy Policy, unless the context otherwise requires, the following expressions shall have the meanings set out below.

“Account” means any customer account, Business Partner account or other registered account created on or through the Platform.

“Business Partner” means any restaurant, café, takeaway, food business, merchant, venue, wellness provider, local service provider, experience provider or other organisation approved by HolistiQ to offer goods or services through the Platform.

“Customer” means any individual who accesses or uses the Platform to browse, purchase, book, reserve or otherwise interact with Business Partners or Platform services.

“Personal Data” has the meaning given to it under the UK GDPR and means any information relating to an identified or identifiable natural person.

“Platform” means the HolistiQ Lifestyle website, mobile applications, customer interfaces, Business Partner dashboards, ordering systems, rewards programmes, promotional services and all related digital services operated by or on behalf of HolistiQ.

“Processing” means any operation performed on Personal Data, whether or not by automated means, including collection, recording, organisation, storage, adaptation, retrieval, consultation, use, disclosure, transmission, restriction, deletion or destruction.

“Special Category Personal Data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification purposes, health data or data concerning an individual’s sex life or sexual orientation.

Any words or expressions defined in the UK GDPR or the Data Protection Act 2018 shall, unless otherwise stated, have the same meaning in this Privacy Policy.

5. Personal Data We Collect

The categories of Personal Data that HolistiQ collects and processes depend upon the manner in which you interact with the Platform, the services you use, your relationship with HolistiQ and the information that you choose to provide.

Where you create a Customer Account, we may collect your name, title, date of birth where required, email address, telephone number, postal address, username, encrypted password credentials, account preferences, communication preferences and any profile information that you voluntarily provide.

When you place an Order or make a reservation through the Platform, we may collect information relating to the relevant transaction, including the Business Partner selected, the products or services ordered, delivery or collection details, booking information, payment status, promotional discounts, reward redemptions, order history, delivery instructions, customer support communications and any other information necessary to process and administer your Order.

Where you communicate with HolistiQ, we may collect the contents of emails, messages, telephone calls, support requests, complaints, reviews, survey responses, feedback and any other correspondence exchanged between you and HolistiQ.

If you participate in rewards programmes, cashback schemes, referral programmes, competitions, promotions or marketing campaigns, we may collect information relating to your participation, reward balances, referral activity, promotional eligibility, redemption history and campaign interactions.

When you browse or use the Platform, we may automatically collect technical information relating to your device and your use of our services. This may include your IP address, browser type, operating system, device identifiers, approximate location derived from your IP address, session information, pages viewed, search activity, clicks, interactions with Platform features, referral sources, cookies, analytics information and similar technical data.

Where you register as a Business Partner or as an authorised representative of a Business Partner, we may collect your name, business name, company registration details, registered office address, trading address, VAT registration number, payment details, bank account information, tax information, contact details, identity verification information, licensing information, menu information, product information, pricing information, opening hours, marketing preferences and details relating to the operation of your business through the Platform.

We may also collect information relating to authorised users of Business Partner accounts, including names, business email addresses, telephone numbers, job titles, access permissions, authentication records and account activity where necessary to administer Business Partner accounts and protect the security of the Platform.

Where payments are made through the Platform, payment card information is generally processed directly by our appointed payment service provider. HolistiQ does not ordinarily store complete payment card details. However, we may receive limited payment information, payment confirmations, transaction identifiers, payment status information and fraud prevention data necessary to administer transactions and maintain appropriate accounting records.

We may collect Personal Data from publicly available sources, business directories, regulatory registers, fraud prevention agencies, sanctions screening providers, identity verification providers, payment providers and other third-party organisations where such collection is lawful and reasonably necessary for the operation, security or legal compliance of the Platform.

In certain circumstances, you may voluntarily provide Special Category Personal Data, such as dietary requirements, allergen information, accessibility requirements or health-related information when placing an Order or requesting customer support. HolistiQ requests that you provide such information only where it is necessary for the relevant service. Where Special Category Personal Data is processed, HolistiQ will do so only where a lawful basis and, where required, an appropriate condition under applicable data protection legislation applies.

HolistiQ does not intentionally collect Personal Data that is excessive, irrelevant or unnecessary for the purposes described in this Privacy Policy and will take reasonable steps to ensure that the Personal Data processed is adequate, relevant and limited to what is necessary for those purposes.

6. How We Collect Personal Data

HolistiQ collects Personal Data directly from you when you create an Account, register as a Business Partner, place an Order, make a reservation, contact customer support, participate in rewards programmes, submit reviews, complete surveys, enter promotions, subscribe to marketing communications or otherwise interact with the Platform.

We also collect Personal Data automatically through your use of the Platform by means of cookies, server logs, software development kits, analytics technologies, device identifiers and similar technologies that help us understand how the Platform is used, improve functionality, protect against fraud and maintain the security and performance of our services.

In addition, Personal Data may be collected from Business Partners where necessary to administer Orders, reservations, customer support requests, complaints, refunds, promotions or other Platform services. Business Partners may also provide information relating to authorised users of their Business Partner accounts where such individuals require access to Platform functionality.

HolistiQ may receive Personal Data from payment service providers, identity verification providers, fraud prevention agencies, analytics providers, cloud service providers, marketing partners, regulators, law enforcement authorities and other third parties where such disclosure is lawful and reasonably necessary for the operation of the Platform, the prevention of fraud, compliance with legal obligations or the protection of HolistiQ, Business Partners, Customers or other users.

Where Personal Data is obtained from third parties, HolistiQ will process that information in accordance with applicable data protection legislation and this Privacy Policy. We will take reasonable steps to ensure that such Personal Data has been collected lawfully and that its further processing by HolistiQ is compatible with the purposes for which it was originally collected.

HolistiQ may also generate certain information through your use of the Platform, including account activity records, transaction histories, fraud risk assessments, customer support records, security logs, analytical reports and operational metrics. Such information may constitute Personal Data where it relates to an identifiable individual and will be processed in accordance with this Privacy Policy.

7. Lawful Bases for Processing

HolistiQ processes Personal Data only where there is a lawful basis for doing so under applicable data protection legislation.

Where you create an Account, place an Order, register as a Business Partner or otherwise use the Platform, we process your Personal Data where such processing is necessary for the performance of a contract with you or in order to take steps at your request prior to entering into a contract. This includes administering accounts, facilitating Orders, processing payments, providing customer support, administering Business Partner services and operating the Platform.

We also process Personal Data where processing is necessary for compliance with our legal obligations. This includes compliance with applicable taxation, accounting, consumer protection, anti-money laundering, fraud prevention, sanctions screening, regulatory reporting, data protection and law enforcement requirements.

In certain circumstances, HolistiQ processes Personal Data where it is necessary for the purposes of our legitimate interests or those of a third party, provided that such interests are not overridden by your rights and freedoms. Our legitimate interests include operating and improving the Platform, maintaining cybersecurity, preventing fraud, protecting customers and Business Partners, enforcing our contractual rights, resolving disputes, developing new products and services, conducting business analytics, administering marketing activities, maintaining accurate records and ensuring the continued operation of our business.

Where required by law, HolistiQ will rely upon your consent before processing certain categories of Personal Data. This may include sending electronic marketing communications, placing non-essential cookies or processing certain categories of Personal Data where consent is the appropriate legal basis. Where processing is based upon consent, you may withdraw your consent at any time, although this will not affect the lawfulness of processing carried out before consent was withdrawn.

Where Special Category Personal Data is processed, HolistiQ will ensure that an appropriate lawful basis and any additional condition required under applicable data protection legislation is satisfied before such processing takes place.

Where HolistiQ relies upon legitimate interests as its lawful basis, we will balance our interests against your rights and freedoms and will only process Personal Data where we consider that such processing is fair, proportionate and reasonably necessary.

8. How We Use Your Personal Data

HolistiQ uses Personal Data to provide, administer, improve and protect the Platform and to deliver the services requested by Customers and Business Partners.

We use Personal Data to create and administer customer and Business Partner accounts, verify identities where appropriate, authenticate users, maintain account security and provide access to Platform functionality.

Where Customers place Orders or reservations through the Platform, Personal Data is used to process transactions, communicate with Business Partners, arrange delivery or collection, provide customer support, administer refunds and facilitate the completion of the relevant transaction.

For Business Partners, Personal Data is used to administer onboarding, verify business identities, configure Business Partner dashboards, facilitate payments, administer commissions and subscriptions, maintain listings, manage promotional campaigns and provide operational support.

HolistiQ uses Personal Data to communicate with Customers and Business Partners regarding Orders, bookings, account administration, Platform updates, customer support enquiries, security notifications, legal notices and operational matters relating to the Platform.

Personal Data may be processed to administer loyalty programmes, cashback schemes, referral programmes, promotional campaigns, competitions, rewards and other customer engagement initiatives operated by HolistiQ from time to time.

Where permitted by law, HolistiQ may use Personal Data to provide marketing communications relating to Platform services, new features, promotions, participating Business Partners and other products or services which we believe may be of interest. Individuals may opt out of marketing communications at any time in accordance with applicable legislation.

HolistiQ processes Personal Data to monitor the performance, reliability and security of the Platform. This includes detecting fraud, preventing abuse, identifying suspicious activity, investigating complaints, enforcing our Terms of Use and Business Partner Terms, protecting users against cyber threats and maintaining appropriate cybersecurity measures.

We also use Personal Data to analyse how the Platform is used, understand customer preferences, improve Business Partner services, develop new Platform functionality, conduct market research, prepare statistical reports and improve the overall customer experience. Wherever reasonably possible, analytical information will be aggregated or anonymised.

Personal Data may also be processed where necessary to establish, exercise or defend legal claims, comply with court orders, cooperate with regulators, respond to law enforcement requests or protect the rights, property or safety of HolistiQ, Business Partners, Customers or other individuals.

HolistiQ may share Personal Data with carefully selected third parties where such sharing is necessary to operate the Platform, provide requested services, administer promotions, facilitate rewards, deliver marketing communications that you have requested or consented to receive, or otherwise where permitted by applicable data protection legislation. HolistiQ does not disclose Personal Data for third-party marketing purposes unless you have provided any consent required by applicable law.

9. Customer Accounts

Customers may create an Account to access additional Platform functionality, including placing Orders, managing bookings, participating in rewards programmes, storing preferences, viewing order history and accessing customer support.

When a Customer creates an Account, HolistiQ processes the Personal Data necessary to establish and maintain that Account, authenticate the Customer, administer Platform services and provide ongoing customer support.

Customers are responsible for ensuring that the information contained within their Account remains accurate, complete and up to date. HolistiQ may request that Customers verify certain information from time to time in order to maintain the integrity and security of the Platform.

HolistiQ maintains records of Account activity, including login history, security events, password changes, device information and account settings, where reasonably necessary to protect the Platform against unauthorised access, fraud or other unlawful activity.

Where a Customer chooses to save preferences, favourite businesses, delivery addresses, payment preferences or other personalised settings, HolistiQ will process that information solely for the purpose of improving the Customer’s experience and facilitating future use of the Platform.

Customers may close their Accounts at any time by contacting HolistiQ or using any account management functionality provided through the Platform. Closure of an Account does not require HolistiQ to delete Personal Data immediately where continued retention is necessary to comply with legal obligations, resolve disputes, prevent fraud, enforce contractual rights or protect the integrity of the Platform.

10. Business Partner Accounts

HolistiQ processes Personal Data relating to Business Partners and their authorised representatives for the purpose of onboarding businesses, administering Business Partner accounts and enabling participation within the Platform.

This may include processing information relating to directors, owners, managers, authorised representatives, employees and other individuals authorised to access Business Partner dashboards or administer Business Partner services.

During onboarding, HolistiQ may collect information necessary to verify the identity and legitimacy of a Business Partner, confirm legal authority to act on behalf of the business, establish payment arrangements, satisfy regulatory requirements and protect the Platform against fraud and financial crime.

Business Partner account information may be used to administer subscriptions, commissions, settlements, marketing campaigns, promotional programmes, customer communications, Business Partner support, technical support, reporting, analytics and other operational services made available through the Platform.

HolistiQ maintains records of Business Partner account activity, including login history, security events, changes to account permissions, listing modifications, transaction histories, settlement information and other operational records necessary to administer the Platform and protect its security.

Business Partners are responsible for ensuring that Personal Data provided to HolistiQ relating to authorised users is accurate and that appropriate authority has been obtained before providing such information.

Where a Business Partner ceases to use the Platform, HolistiQ may continue to retain relevant Personal Data where necessary to comply with legal obligations, maintain accounting records, resolve disputes, administer outstanding transactions, investigate complaints, defend legal claims or enforce contractual rights.

Business Partner information may continue to be processed following termination of the commercial relationship where such processing is reasonably necessary for the legitimate operation and protection of the Platform or is otherwise required by applicable law.

11. Anonymised and Aggregated Information

HolistiQ may create, analyse, use, publish, licence, share or otherwise commercialise anonymised and aggregated information derived from the operation of the Platform.

Before any information is used for these purposes, HolistiQ will take reasonable steps to ensure that individuals can no longer be identified directly or indirectly and that the information no longer constitutes Personal Data under applicable data protection legislation.

Such anonymised and aggregated information may be used for business intelligence, market analysis, benchmarking, statistical reporting, research, product development, artificial intelligence, commercial insights, tourism insights, consumer behaviour analysis, industry reporting and other lawful commercial purposes.

Anonymised and aggregated information may be shared with or licensed to Business Partners, research organisations, public authorities, commercial partners, investors, industry bodies and other third parties for lawful purposes.

This section applies only to information that has been anonymised so that it no longer identifies any individual. It does not permit HolistiQ to disclose Personal Data otherwise than in accordance with this Privacy Policy and applicable data protection legislation.

12. Payments and Financial Information

HolistiQ facilitates payments through third-party payment service providers appointed from time to time, including Stripe or any successor payment processor. When you make a payment through the Platform, payment card details and other financial information are ordinarily collected and processed directly by the relevant payment service provider in accordance with its own privacy notice and applicable payment industry standards.

HolistiQ does not ordinarily receive or store complete payment card numbers, card verification values (CVV), PINs or other sensitive payment authentication data. We may, however, receive limited payment information, transaction references, payment status, settlement information, billing addresses and other information necessary to administer transactions, provide customer support, detect fraud, reconcile payments and comply with legal and accounting obligations.

Business Partner payment information, including bank account details and settlement information, is processed solely for the purposes of administering subscriptions, commissions, settlements, refunds and other payments relating to the operation of the Platform.

HolistiQ may retain financial records where required to comply with applicable accounting, taxation, anti-money laundering, fraud prevention or other legal obligations.

13. Marketing Communications

HolistiQ may use your Personal Data to send communications relating to the Platform, including service announcements, account notifications, order updates, security notifications, customer support responses and other operational communications necessary for the administration of your Account or your use of the Platform.

Where permitted by applicable law, HolistiQ may also send marketing communications regarding new Platform features, participating Business Partners, promotions, rewards programmes, referral programmes, competitions, surveys, newsletters and other products or services that may be of interest to you.

Electronic marketing communications will only be sent where permitted by applicable data protection and electronic communications legislation, including where you have provided consent or where HolistiQ is otherwise entitled to rely upon a lawful marketing exemption.

You may withdraw your consent or unsubscribe from marketing communications at any time by using the unsubscribe mechanism contained within the relevant communication, updating your marketing preferences within your Account or contacting HolistiQ directly. Withdrawal of consent will not affect the lawfulness of any processing undertaken before consent was withdrawn.

HolistiQ may continue to send communications that are necessary for the administration of your Account, the fulfilment of Orders, compliance with legal obligations, the protection of Platform security or the operation of the Platform, even where you have opted out of receiving marketing communications.

14. Reviews, Ratings and User Content

Where you choose to submit reviews, ratings, comments, photographs, suggestions or other content through the Platform, HolistiQ will process the Personal Data contained within that content for the purpose of operating the Platform, displaying reviews, improving services, maintaining Platform integrity, preventing fraud and complying with applicable legal obligations.

Reviews submitted through the Platform may be displayed publicly together with your chosen display name or other information that you have elected to make publicly available. You should not include confidential information or unnecessary Personal Data within reviews or other publicly accessible content.

HolistiQ may monitor, moderate, remove, edit or restrict reviews, ratings or other user-generated content where it reasonably considers such content to be unlawful, misleading, fraudulent, abusive, defamatory, discriminatory, offensive, inaccurate or otherwise inconsistent with the Platform’s Terms of Use or applicable law.

HolistiQ may retain records relating to reviews, moderation decisions and associated communications where reasonably necessary to investigate complaints, resolve disputes, detect fraud, protect Platform integrity or comply with legal obligations.

15. Artificial Intelligence and Automated Processing

HolistiQ may use artificial intelligence, machine learning and other automated technologies in connection with the operation, administration, security and continuous improvement of the Platform.

Such technologies may be used to improve search functionality, recommend Business Partners, personalise Platform content, detect fraudulent activity, identify suspicious transactions, provide customer support, analyse Platform performance, improve operational efficiency, develop new Platform features and generate business intelligence.

Where artificial intelligence is used to support decision-making, HolistiQ will implement appropriate safeguards designed to ensure that processing remains fair, proportionate and consistent with applicable data protection legislation.

HolistiQ may use artificial intelligence and automated technologies to support decision-making and improve the operation of the Platform. Where applicable law requires, decisions that produce legal or similarly significant effects on individuals will be subject to appropriate human oversight and safeguards.

16. Cookies and Similar Technologies

HolistiQ uses cookies, software development kits, local storage, tracking technologies and similar technologies to operate the Platform, maintain security, remember user preferences, improve functionality, analyse Platform performance, measure the effectiveness of marketing campaigns and provide an enhanced user experience.

Certain cookies and similar technologies are essential for the operation of the Platform and cannot be disabled without affecting core functionality. Other cookies, including analytics, advertising and personalisation cookies, will be used only where permitted by applicable law and, where required, with your consent.

You may manage your cookie preferences through our cookie consent mechanism or through your browser settings. Disabling certain cookies may affect the availability or functionality of some Platform features.

Further information regarding our use of cookies, similar technologies and your available choices is set out in our Cookie Policy, which forms part of this Privacy Policy.

17. Sharing Your Personal Data

HolistiQ may disclose Personal Data where such disclosure is necessary to operate the Platform, fulfil Orders, provide requested services, comply with legal obligations, protect the rights of HolistiQ or others, or otherwise where permitted by applicable law.

Depending upon the circumstances, Personal Data may be shared with Business Partners, payment service providers, cloud hosting providers, information technology service providers, customer support providers, identity verification providers, fraud prevention agencies, analytics providers, marketing service providers, professional advisers, insurers, auditors, regulators, law enforcement authorities, courts and other third parties providing services to or on behalf of HolistiQ.

HolistiQ may share Personal Data with carefully selected third parties where such sharing is necessary to operate the Platform, provide requested services, administer promotions, facilitate rewards, deliver marketing communications that you have requested or consented to receive, or otherwise where permitted or required by applicable data protection legislation. HolistiQ will not disclose Personal Data to third parties for their own direct marketing purposes unless you have provided any consent required by applicable law.

Where HolistiQ engages third-party service providers to process Personal Data on its behalf, such providers will be required to process Personal Data only in accordance with HolistiQ’s documented instructions, appropriate contractual safeguards and applicable data protection legislation.

HolistiQ may share Personal Data where reasonably necessary in connection with the proposed or completed sale, investment, merger, acquisition, restructuring, financing or transfer of all or part of its business. Any recipient of such Personal Data will be required to protect it in accordance with applicable data protection legislation and appropriate confidentiality obligations.

18. International Transfers

HolistiQ may store and process Personal Data within the United Kingdom or the European Economic Area. In certain circumstances, Personal Data may be transferred to or accessed from countries outside the United Kingdom where this is necessary to operate the Platform, provide services, process payments, deliver customer support, host data, maintain information technology systems or otherwise carry out the activities described in this Privacy Policy.

Where Personal Data is transferred outside the United Kingdom, HolistiQ will take appropriate steps to ensure that an adequate level of protection is maintained. Where required by applicable data protection legislation, we will implement appropriate safeguards, including the use of adequacy regulations, the International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission’s Standard Contractual Clauses or any other transfer mechanism recognised under applicable law.

HolistiQ will take reasonable steps to ensure that recipients of Personal Data outside the United Kingdom process such information securely, confidentially and only for lawful purposes consistent with this Privacy Policy.

19. Data Security

HolistiQ recognises the importance of protecting Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access. We maintain appropriate technical and organisational measures designed to safeguard the confidentiality, integrity and availability of Personal Data processed through the Platform.

Such measures may include access controls, authentication procedures, encryption where appropriate, network security controls, system monitoring, vulnerability management, penetration testing, backup procedures, disaster recovery arrangements, logging, audit trails, staff training and security policies designed to reduce the risk of unauthorised access or misuse.

Access to Personal Data is restricted to those employees, contractors, authorised Business Partners and service providers who require such access in order to perform their duties or provide services relating to the Platform. All persons with access to Personal Data are expected to maintain its confidentiality and process it only in accordance with applicable legal and contractual obligations.

Although HolistiQ takes reasonable steps to protect Personal Data, no method of transmitting information over the internet or storing electronic information can be guaranteed to be completely secure. Accordingly, HolistiQ cannot guarantee the absolute security of Personal Data, and users should also take appropriate precautions to protect their own accounts, passwords and devices.

Where HolistiQ becomes aware of a Personal Data Breach, we will respond promptly and, where required by applicable law, notify the Information Commissioner’s Office, affected individuals and other relevant authorities within the applicable statutory time limits.

20. Data Retention

HolistiQ retains Personal Data only for as long as is reasonably necessary to fulfil the purposes for which it was collected, including the provision of Platform services, the administration of customer and Business Partner accounts, compliance with legal obligations, the resolution of disputes, the prevention of fraud and the protection of HolistiQ’s legitimate business interests.

The length of time for which Personal Data is retained will depend upon the nature of the information, the purposes for which it is processed, applicable legal and regulatory requirements and the potential need to establish, exercise or defend legal claims.

Where Personal Data is no longer required for the purposes for which it was collected, HolistiQ will securely delete, anonymise or otherwise dispose of that information in accordance with our internal retention procedures and applicable data protection legislation.

Certain categories of information, including accounting records, taxation records, transaction records, fraud prevention records, audit records and information relating to legal proceedings, may be retained for longer periods where required by applicable law or where reasonably necessary to protect the rights and interests of HolistiQ, Business Partners, Customers or other individuals.

Where Personal Data has been anonymised so that individuals are no longer identifiable, HolistiQ may retain and use that anonymised information for statistical, analytical, commercial, research and business intelligence purposes without time limitation.

21. Your Rights

Subject to applicable data protection legislation, you may have a number of rights in relation to your Personal Data.

You may request confirmation as to whether HolistiQ processes your Personal Data and, where applicable, request access to that information.

You may request that inaccurate or incomplete Personal Data be corrected where it is appropriate to do so.

In certain circumstances, you may request that HolistiQ erase your Personal Data where there is no lawful reason for its continued processing.

You may request that HolistiQ restrict the processing of your Personal Data in certain circumstances prescribed by applicable law.

Where processing is based upon your consent, you may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of any processing undertaken before consent was withdrawn.

Where processing is based upon legitimate interests, you may object to such processing where you believe your rights and freedoms outweigh HolistiQ’s legitimate interests. HolistiQ will consider any such objection in accordance with applicable data protection legislation.

Where technically feasible and required by law, you may request that certain Personal Data be provided to you or transferred to another organisation in a structured, commonly used and machine-readable format.

You also have the right to lodge a complaint with the Information Commissioner’s Office if you believe that your Personal Data has been processed in breach of applicable data protection legislation. HolistiQ encourages individuals to contact us first so that we may have the opportunity to resolve any concerns promptly and fairly.

HolistiQ may request reasonable information to verify your identity before responding to requests concerning your Personal Data. Where permitted by law, requests that are manifestly unfounded, excessive or repetitive may be refused or may be subject to a reasonable administrative charge.

22. Children’s Privacy

The Platform is intended for individuals who are legally capable of entering into binding contracts under applicable law. HolistiQ does not knowingly collect Personal Data directly from children where such collection is prohibited by applicable legislation.

Where HolistiQ becomes aware that Personal Data relating to a child has been collected without the necessary legal basis or parental authority, we will take reasonable steps to investigate the matter and, where appropriate, delete the relevant Personal Data as soon as reasonably practicable.

Parents or legal guardians who believe that a child has provided Personal Data through the Platform are encouraged to contact HolistiQ so that appropriate action can be taken.

Nothing in this section prevents HolistiQ from processing Personal Data relating to minors where such processing is lawful and necessary in connection with reservations, family bookings, customer support or other legitimate Platform services provided in accordance with applicable law.

23. Third-Party Services

The Platform may integrate with or make available services provided by third parties where such integration is necessary or desirable for the operation of the Platform. These services may include payment processors, mapping and location services, cloud hosting providers, analytics providers, communication providers, customer support systems, identity verification providers, fraud prevention services, marketing platforms, social media platforms and other technology providers.

Where you choose to use services provided by third parties through the Platform, or where such services are necessary to facilitate Platform functionality, your Personal Data may be processed by those third parties in accordance with their own privacy notices and applicable legal obligations.

HolistiQ carefully selects third-party service providers and takes reasonable steps to ensure that they implement appropriate technical and organisational measures to protect Personal Data. Where a third party processes Personal Data on behalf of HolistiQ, appropriate contractual arrangements will be implemented to ensure that such processing is carried out only on HolistiQ’s documented instructions and in accordance with applicable data protection legislation.

HolistiQ is not responsible for the privacy practices, content or security of third-party websites, applications or services that are not owned or controlled by HolistiQ. Where the Platform contains links to third-party websites or services, users are encouraged to review the relevant privacy notices before providing Personal Data directly to those organisations.

The inclusion of a third-party service, website or integration within the Platform does not constitute an endorsement of that third party or its privacy practices by HolistiQ.

24. Changes to this Privacy Policy

HolistiQ may amend, update or replace this Privacy Policy from time to time in order to reflect changes in applicable legislation, regulatory guidance, judicial decisions, technological developments, business operations, Platform functionality or the manner in which Personal Data is processed.

Where changes are material, HolistiQ will take reasonable steps to notify affected individuals through the Platform, by email or by any other appropriate means before the revised Privacy Policy becomes effective, unless a shorter period is required by applicable law.

The revised Privacy Policy shall take effect on the date specified within the updated document. Continued use of the Platform after that date constitutes acknowledgement of the revised Privacy Policy, except where applicable law requires a different approach.

HolistiQ encourages all users to review this Privacy Policy periodically to remain informed about how Personal Data is collected, used, shared and protected.

Previous versions of this Privacy Policy may be retained by HolistiQ where necessary for legal, regulatory or evidential purposes.

25. Contact Details

If you have any questions regarding this Privacy Policy, the manner in which HolistiQ processes your Personal Data or your rights under applicable data protection legislation, you may contact us using the details below.

Email: info@holistiqlifestyle.co.uk

HolistiQ will endeavour to respond to all legitimate requests concerning Personal Data within the timescales prescribed by applicable data protection legislation. Where a request is particularly complex or numerous, HolistiQ may extend the time for responding where permitted by law and will inform the individual accordingly.

Where HolistiQ is unable to comply with a request, we will explain the reasons for our decision unless prohibited from doing so by applicable law.

26. Complaints to the Information Commissioner’s Office

HolistiQ is committed to processing Personal Data fairly, lawfully and transparently and encourages individuals to contact us in the first instance if they have any questions, concerns or complaints regarding the processing of their Personal Data. We will make every reasonable effort to investigate concerns promptly and work with individuals to achieve a fair and appropriate resolution.

If you believe that HolistiQ has processed your Personal Data in a manner that does not comply with applicable data protection legislation, you have the right to lodge a complaint with the Information Commissioner’s Office (“ICO”), which is the United Kingdom’s independent supervisory authority for data protection matters.

Further information regarding the ICO, including details of how to make a complaint, can be obtained from the ICO’s official website or by contacting the ICO directly.

Nothing in this Privacy Policy affects your statutory rights or your right to seek a remedy through the courts or any other competent authority where permitted by applicable law.

27. Additional Information for Business Partners

Business Partners participating in the Platform acknowledge that, depending upon the circumstances, they may act as independent data controllers in relation to Personal Data that they collect, receive or otherwise process for the purposes of fulfilling Orders, providing goods or services, communicating with Customers, complying with legal obligations or operating their own businesses.

Where Personal Data is made available to a Business Partner through the Platform, the Business Partner shall process such Personal Data only for lawful purposes, in accordance with applicable data protection legislation and any contractual obligations owed to HolistiQ.

Business Partners are responsible for implementing appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access and for ensuring that access to Personal Data is restricted to authorised personnel who require such access for legitimate business purposes.

Business Partners shall not use Personal Data obtained through the Platform for purposes that are incompatible with the purposes for which that information was originally collected, nor shall they disclose Personal Data to unauthorised third parties except where permitted or required by applicable law or expressly authorised by HolistiQ.

Where required by applicable law or by HolistiQ, Business Partners shall enter into a separate Data Processing Agreement or other data protection agreement governing the processing of Personal Data in connection with the Platform.

This Privacy Policy should be read together with the HolistiQ Customer Terms of Use, the HolistiQ Business Partner Terms, the Cookie Policy and any additional privacy notices or policies issued by HolistiQ from time to time.

This Privacy Policy constitutes the primary privacy notice governing the processing of Personal Data through the HolistiQ Lifestyle Platform and applies unless expressly supplemented or replaced by a more specific privacy notice relating to a particular product, service or processing activity.