Privacy Policy

Flow State Freediving Last updated: May 2026

Who we are

Flow State Freediving is run by Imogen Hunter and Joe Laurie, trading as Flow State Freediving ("we", "us", "our"). We are the data controller responsible for your personal information.

If you have any questions about this policy or how we handle your data, you can contact us at:

Email:immy@flowstatefreediving.co.uk

We are not currently required to register with the Information Commissioner's Office (ICO) as a data controller, but we are committed to handling your personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What data we collect

Depending on how you interact with us, we may collect the following:

Contact and identity information

  • Name

  • Email address

  • Phone number

  • Country of residence

Booking and course information

  • Course or trip enquiry details

  • Freediving certification level

  • Medical information relevant to freediving participation (where you provide it voluntarily)

  • Emergency contact details

Payment information

  • Payment records (we do not store full card details — payments are processed via third-party providers)

  • Transaction amounts and dates

Communications

  • Messages you send us via email, WhatsApp or contact forms

  • Your email marketing preferences

Website usage data

  • IP address

  • Browser type and version

  • Pages visited and time spent

  • Referral source

  • Cookie data (see our Cookie section below)

How we collect your data

We collect data when you:

  • Enquire about a course, training session or group trip

  • Register interest in or book a group trip

  • Sign up to our mailing list

  • Contact us by email, WhatsApp or via our website contact form

  • Make a payment to us

  • Visit our website (automatically, via cookies and analytics tools)

  • Interact with us on social media and then make direct contact

Why we collect your data and our legal basis for doing so

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

Contractual necessity When you book a course, training session or group trip with us, we need your personal data to fulfil that contract — to confirm your booking, communicate logistics, process payment and ensure your safety as a participant.

Legitimate interests We process some data based on our legitimate interests as a small business, where we have assessed that our interests are not overridden by your rights. This includes following up on enquiries, sending occasional relevant updates to people who have contacted us, and analysing how our website is used to improve it.

Consent Where you have signed up to our mailing list, we process your email address on the basis of your consent. You can withdraw this consent at any time by unsubscribing from any email we send or by contacting us directly.

Legal obligation In some cases we may need to retain data to comply with our legal obligations, for example for financial record-keeping purposes.

How we use your data

We use the information we collect to:

  • Respond to enquiries and provide information about our courses, trips and services

  • Process bookings, deposits and payments

  • Communicate course logistics, dates, locations and preparation information

  • Ensure your safety as a participant — including awareness of any relevant health information you share with us

  • Send you our mailing list updates, where you have signed up to receive them

  • Improve our website and understand how people find and use it

  • Meet our legal and financial record-keeping obligations

We do not use your data for automated decision-making or profiling.

Who we share your data with

We do not sell your personal data to third parties. We may share it in the following limited circumstances:

Service providers We use a small number of trusted third-party services to operate our business. These may include:

  • Squarespace — our website platform, which may collect usage data via cookies and analytics

  • Mailer Lite— to manage and send our mailing list

  • Revolut / Paypal — to process payments

  • WhatsApp / Meta / Instagram / Tiktok — if you contact us via socials

  • Google Analytics — to understand website traffic (see Cookie section)

These providers process data only as necessary to provide their services and are required to handle it securely.

Legal requirements We may disclose your data if required to do so by law, or to protect the rights, safety or property of Flow State Freediving or others.

Trip co-hosts and local partners For group trips, we may share relevant participant information (such as name, certification level and emergency contact) with local instructors or trip partners who are directly involved in delivering the experience. We will only share what is necessary for safety and logistics purposes.

International transfers

Some of our third-party providers may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place in line with UK GDPR requirements — for example, by using providers that have adopted standard contractual clauses or equivalent protections.

How long we keep your data

We keep your data only for as long as necessary for the purposes for which it was collected:

  • Enquiries that did not result in a booking: up to 36 months

  • Booking and course records: up to 8 years for financial and legal compliance purposes

  • Mailing list: until you unsubscribe or ask us to remove you

  • Website analytics data: in line with the retention settings of the relevant platform (typically 26 months for Google Analytics)

Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

The right to access You can request a copy of the personal data we hold about you.

The right to rectification You can ask us to correct any inaccurate or incomplete data we hold.

The right to erasure You can ask us to delete your personal data in certain circumstances — for example, if we no longer need it or if you withdraw your consent.

The right to restrict processing You can ask us to limit how we use your data in certain circumstances.

The right to data portability Where we process your data by automated means on the basis of consent or contract, you can ask us to provide it in a portable format.

The right to object You can object to our processing of your data where we rely on legitimate interests. We will consider your objection and cease processing unless we have compelling grounds to continue.

The right to withdraw consent Where we process your data on the basis of consent (such as for our mailing list), you can withdraw that consent at any time by unsubscribing or contacting us directly. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal.

To exercise any of these rights, please contact us. We will respond within one month. We may need to verify your identity before processing your request.

Cookies

Our website uses cookies — small text files stored on your device — to help the site function and to understand how it is used.

Strictly necessary cookies These are essential for the website to work and cannot be switched off. They include cookies set by Squarespace for site functionality and security.

Analytics cookies We use Google Analytics to understand how visitors find and use our website. This collects anonymised data including pages visited, time on site and approximate location. You can opt out of Google Analytics tracking by using the Google Analytics Opt-out Browser Add-on.

Third-party cookies Third-party services embedded in our site (such as social media buttons or embedded video) may set their own cookies. We do not control these.

You can manage or disable cookies through your browser settings. Please note that disabling cookies may affect how some parts of our website function.

Health and safety information

For certain courses and group trips, we may ask you to share relevant health information — for example, conditions that may affect your ability to freedive safely. This is sensitive data under UK GDPR.

We collect this information only where it is necessary for your safety and the safety of others, on the basis of your explicit consent. It is not shared beyond those directly involved in delivering your course or trip and is not retained beyond the period of participation unless required by law.

Links to other websites

Our website may contain links to third-party websites, including social media platforms. This privacy policy applies only to Flow State Freediving. We are not responsible for the privacy practices of other sites and encourage you to read their policies.

Changes to this policy

We may update this policy from time to time. The most current version will always be available on our website with the date it was last updated. Where changes are significant, we will let our mailing list know

Contact us

If you have any questions about this privacy policy or how we handle your data, please get in touch:

Email: immy@flowstatefreediving.co.uk

Website: www.flowstatefreediving.co.uk