Draft Privacy Notice — under pre-launch review. This notice is not a statement of independent legal approval.

Privacy Notice

This notice explains how Phoenix in Bloom uses personal information connected with this informational website and general correspondence.

Website forms are disabled: public enquiry forms are hidden and their submission process is blocked. No website payments, bookings or sensitive client-intake features are active. Gmail and our official Facebook page are the only public enquiry routes.

All historical website enquiry submissions were test records created by the owner or Lovable and have been deleted from the active database. No genuine client enquiries were submitted through the website. This does not confirm deletion from provider backups or technical logs; their contents and retention remain unverified.

Last updated: 12 October 2026.

Who we are and how to contact us

Jade Holland, sole trader trading as Phoenix in Bloom. Jade is the data controller, responsible for deciding why and how Phoenix in Bloom uses your information.

Our business website domain is phoenixinbloom.uk.

Phoenix in Bloom has submitted its data protection fee registration application to the Information Commissioner's Office (ICO). The ICO has issued a security number for correspondence, and Direct Debit payment and official registration confirmation are currently pending. The business's registration number will be added once confirmed.

For privacy questions, access requests, corrections, deletion requests or complaints, email Jade at the address above. You can also message the official Phoenix in Bloom Facebook page. Please identify your message as a privacy request or data protection complaint. A Facebook account is not required to contact us by email or post.

Please do not send children's records, diagnoses, health details, safeguarding histories, identity documents or other sensitive case information in an initial email or Facebook message. If detailed information is required, we will explain an appropriate information-sharing arrangement first.

Information we receive and why we use it

• General correspondence: your name, reply details, message and information you choose to share, to answer questions, discuss requested support or collaboration, and manage correspondence. Facebook may also make your profile information available to us.
• Website delivery and protection: providers may process IP addresses, browser/request information and technical logs to deliver, secure and troubleshoot the website. External font requests are described below.
• Privacy requests and complaints: contact details, the request or concern, proportionate identity-verification information where needed, investigation notes and our response, to handle your request and meet applicable data protection duties.

Information is received from you or generated through correspondence and website use. We do not sell enquiry information or use it for marketing. No automatic enquiry replies or owner email notifications are enabled.

Website forms and submissions will remain disabled after publication or domain connection. Reactivation requires Jade's explicit instruction and a review of the necessary data-protection arrangements; ICO confirmation alone will not reactivate them.

Lawful bases

The basis depends on the purpose and circumstances, not simply on receiving a message. The following purpose-specific arrangements remain subject to final pre-launch assessment:

• Requested steps before a contract — Article 6(1)(b): processing necessary to explore a purchase of support at the prospective contracting person's request. This does not automatically cover every enquiry or information about someone else.
• Legitimate interests — Article 6(1)(f): appropriate general correspondence and partnership discussions, retaining a necessary correspondence history, and proportionate website protection. The relevant interests are responding to people who approach the business and operating a safe, reliable website. Purpose, necessity and the balance with people's rights must be documented; this is not a blanket basis for all processing.
• Legal obligation — Article 6(1)(c): processing necessary to meet an identified duty, including handling applicable data protection rights and complaints. Other record-keeping duties, including financial or safeguarding duties, require their own assessment; this does not justify keeping all enquiries indefinitely.

Final bases for website technical processing, retained correspondence and each actual enquiry purpose, together with the relevant legitimate interests assessments and any specific record-keeping duties, are still being verified. This notice will be updated before it is finalised.

Detailed support and sensitive information

This notice covers the website and general contact, not detailed client support. Phoenix in Bloom provides reflective, educational, non-diagnostic services, not clinical or statutory assessments. Detailed client work requires separate privacy information, agreed sharing arrangements and assessment of the actual processing, including any required Article 9 condition for health or other special-category information.

An ordinary Privacy Notice acknowledgement is not consent to process sensitive information or children's records. Not all information about children is special-category data, but it requires particular care. Sending sensitive information without being asked does not itself establish a lawful basis or special-category condition. Arrangements for handling unexpected sensitive information remain part of the pre-launch review.

Facebook and Gmail correspondence

Facebook and Messenger process messages, profile and technical information under Meta's Privacy Policy and service terms, including for Meta's own purposes. Phoenix in Bloom remains responsible for its own use of your messages. Meta and a Page administrator may also have joint-controller responsibilities for Page Insights under the applicable terms.

Our Facebook buttons are ordinary external links, not embedded plugins or a marketing pixel. The current pages do not load Meta content; following a link takes you to Meta's service.

Email sent to or from our Gmail address is processed by Google under the terms applying to that account and Google's Privacy Policy. We have not verified Google Workspace status or a Workspace data-processing agreement for this account and do not assume these apply.

Using Facebook or Gmail does not remove Jade's data protection responsibilities. Provider roles, account terms, access security and international processing arrangements remain subject to review.

Storage, service providers and international processing

• Lovable and Lovable Cloud: development and the managed website/database service, with technical information processed to operate and troubleshoot it.
• Supabase: the managed service's database and authentication technology. Project configuration identifies the primary database region as London, UK; this does not establish the location of all backups, logs, support access or other processing.
• Cloudflare: the configured hosting/delivery infrastructure. Its global network may process connection and request information to deliver and protect the site; the final hosted service and locations require confirmation.
• Google Fonts: pages request fonts from Google, disclosing connection/request information such as IP address, requested URL and browser headers. Google states that its Fonts API does not set or log cookies or use this information for targeted advertising.
• Google and Meta: email and Facebook correspondence as described above.

No enquiry records remain in the active database. Database access rules remain in place and owner access remains restricted to the authorised account; the database is not publicly accessible. Provider personnel may have access under their service arrangements, including to any retained backups or logs. Appropriate access protection and provider arrangements must be reviewed; no security measure guarantees absolute security.

Providers operate internationally, including in the United States. Their published documentation is not proof that a particular agreement or transfer safeguard applies to this business. Applicable processor agreements, subprocessors, access arrangements, log/backup retention and UK international-transfer safeguards remain unverified. We do not claim UK-only processing. Before finalisation, this notice must identify applicable safeguards and how to obtain information about them by contacting Jade. Publishing this notice does not establish or replace any required processor agreement or transfer safeguard.

How long we keep information

Non-client enquiries: normally 12 months after the last meaningful contact, unless another appropriate, documented lawful reason requires longer retention. This covers Gmail correspondence and relevant Messenger conversations that do not develop into client relationships. There are no historical website enquiry records in the active database to which this period currently applies.

Jade will manually review correspondence retention approximately every three months. Correspondence is not automatically deleted. The last meaningful contact must be checked against the correspondence and a private review record, rather than assumed from the date of an initial message.

Client relationships: enquiries that become paid client work are considered with the client records under separately agreed retention arrangements. Safeguarding records need a separate assessment of applicable responsibilities and retention reasons. Financial records follow applicable statutory requirements, not the general 12-month enquiry period. Privacy-request and complaint records also need a separately documented retention decision. No unverified fixed periods are assigned to these categories here.

Deletion across email, Messenger, exported copies and provider backups needs to be addressed in the retention process. Backup and technical-log periods remain to be confirmed.

Cookies, browser storage and technical privacy

The website contains no advertising pixels or configured visitor analytics. Our checks of public pages found no cookies and no visitor sign-in information stored in the browser. Our hosting provider may use essential security technologies to protect the website.

Session storage remembers scroll positions for navigation and normally lasts for the browser tab's session. Owner sign-in uses persistent browser storage on the owner's own device. Public visitors do not need to sign in and cannot access the owner dashboard.

Google Fonts requests occur when pages load, even without cookies. Our website and hosting providers may process limited technical information, such as error details, to keep the website working and secure; this is not used for marketing or visitor analytics. No cookie banner is used, because we do not use cookies or similar technologies that require consent. Any such technology would be assessed before it was introduced.

Your data protection rights

You can request access and a copy of your information, correction of inaccurate information and completion of incomplete information. You may request erasure or restriction where the legal conditions apply, and object to processing based on legitimate interests. We will consider an objection and stop unless an applicable overriding ground or exception permits continued processing.

Where applicable, you may request a portable copy of information you provided when automated processing is based on consent or contract. If a separate activity relies on consent, you can withdraw it without affecting earlier lawful processing. Rights are not absolute; an identified legal duty may require some information to be retained.

Contact Jade using the email or postal address above, or Facebook. Requests are normally free and handled without undue delay, usually within one calendar month. A permitted extension of up to two further months may apply to complex or multiple requests; we will explain it within the initial period. We may ask for proportionate identity verification or necessary clarification and explain any effect on the response or any applicable exception. Please do not send identity documents initially.

Data protection complaints

You can complain directly to Jade using the published email or postal address, or through Facebook. We will acknowledge your data protection complaint within 30 days, investigate appropriately without undue delay and communicate the outcome, with progress updates where appropriate.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. The ICO provides guidance on raising concerns with the organisation first and escalating unresolved concerns.

Automated decisions

We do not use enquiry information for profiling or solely automated decisions with legal or similarly significant effects. The paused form's validation and spam checks do not assess eligibility for support.

Not an emergency service

Phoenix in Bloom is not an emergency or crisis response service. If someone is at immediate risk, call 999. For urgent support, contact NHS 111 or your local crisis service.

Back to Get in Touch