Privacy Notice

This is the privacy notice of The House of Lavender (‘we’, ‘our’, or ‘us’). We are a company registered in England and Wales, UK, 15576147

Our registered office is 236 Mary Vale Road, Bournville, Birmingham B30 1PJ

At The House of Lavender, we respect your privacy and are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (“GDPR”), the Data Use and Governance Act 2025 and Data Protection Act 2018, and other applicable laws such as the Privacy Electronic Communications Regulation (“PECR”) 2011.

Introduction

This privacy notice is to inform you of how we use your personal data when you interact with us.

We outline what personal information we collect, why we collect it, how we collect it, where we get it from, what we do with it, our lawful basis for using it, how we store it, who we share it with, how long we keep it, what rights you have, how to complain and how to contact us.

This privacy notice does not create any contractual rights or obligations. We may change this privacy notice from time to time. If we make any significant changes in the way we treat your personal information, we will make this clear on the website or by contacting you directly.

If you have any questions about this privacy notice or any data protection related matters relevant to The House of Lavender, you can send an email to: accounts@houseoflavender.co

It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy notice supplements the other notices and is not intended to override them.

When we refer to personal data, we mean any information that can be used either on its own, or with other information we have access to, that can identify you.

Who this privacy notice applies to

1. Clients that we provide a service directly to (‘Client Services’/’Client Contracts’)
2. Individuals we discover through our marketing activities as prospective clients (‘Marketing’).
3. Employees and associates of organisations that supply services to The House of Lavender (‘Suppliers’).
4. Individuals who are considering taking a role with us as either a full-time, part-time, apprentice or work-experience member of The House of Lavender staff whilst we conduct recruitment activities (‘Recruitment’).
5. Users of our website (www.houseoflavender.co)

The House of Lavender will be the data controller for all individuals (under GDPR an individual/person is known as a data subject) apart from when we are providing services to you through a third party . In that scenario we are the data processor and will have a data processing agreement in place with our supplier, who is the data controller.

Client Services

The following information is based on The House of Lavender acting as a data processor in the performance of its duties with a client.

What personal data do we collect?
In the fulfilment of providing a service to a client (Client Service) we will collect the following personal data:

• Contact name, email, telephone number

How we collect your personal data
We collect personal data in the fulfilment of a Client Contract in the following ways:

• Within documentation shared from a client or a third-party that has been requested or commissioned by the client to share such documentation with us.
• When you have made contact with us through our website or sent an email to us or telephoned us.

What we use your personal data for and the lawful basis.

The use of personal data will be in the fulfilment of the services purchased from The House of Lavender. The lawful basis for any use of personal data within a Client “Contract” will be upon the basis of a contract entered into by the data subject. This means where The House of Lavender is a data processor for the client (data controller), any use of personal data will be based on the permission supplied by the client

Uses of personal data to fulfil a “Client Contract” will include:

• Setting up appointments and communicating with you about that service
• Passing your personal data to other collaborating organisations as required by the client
• Sharing relevant documentation with you which may contain personal data which belongs to you or others working with us to provide that service to you

Where you are in need of a service that may be more suited to one of our suppliers (also under the House of Lavender brand), we will provide you with contact details for you to make contact should you so wish. Please refer to that company’s privacy notice if you decide to move forward with them.

We may also share your personal data if we choose to sell, transfer, or merge parts of our business or our assets in the future. We may seek to acquire other businesses or merge with them. During any such process, we may share your data with other businesses.

We will only do this if they agree to keep your data safe and private. If a change to our group happens, then other parties may use your data in the same way as set out in this notice. This relates to any instance where The House of Lavender merges or gets acquired by another organisation, and all documents including any personal data change ownership (organisational ownership).

How long we keep your personal data
We will retain your personal data for the duration of our service to you.

Marketing

What personal data do we collect?

In order to achieve our objectives, we will collect one or more of the following categories of your personal data within the Marketing work we conduct:

• Name(s), Email Address, Phone number
• Opinions you have expressed to us
• Publicly available personal information (e.g. from websites and social media platforms)
• Social media handles and publicly expressed content

How we collect your personal data

Collection of your personal information within Marketing work will be via one or more of the following ways:

• When you become a client
• When you register or sign up to the House of Lavender mailing list, events, newsletters or publications on our website or via direct contact from yourself
• From publicly available sources which include from the internet and social media accounts
• From yourself when you submit a digital form on our website or on social media platforms directed to us
• During our work to monitor content and communications with us via each of the platforms and technologies we employ in our Marketing work
• From individuals who have referred you to us and you are aware we are going to make contact with you

What we use your personal data for and the lawful basis

The reasons we use your personal data for our Marketing work, which will depend on how we capture your personal information, includes:

• To add you to the House of Lavender marketing list to send you our newsletter and relevant materials including our latest news, blogs, updates, event details, and any offers we may be running
• To identify you in our data lists and take any required actions where we have received a data subject rights request from you
• To use in promotional collateral and material as still images or videos where we have either sought your permission to do so or you have verbally agreed to have an ad hoc photo taken or to participate in an on-camera interview at a House of Lavender event you may be attending (you may also appear in the background and be recognisable)
• To help us improve upon previous marketing work and activities
• Adding your contact information and any related project scoping information into our digital systems when you become a client – at that point we are no longer the data controller for your personal data and the House of Lavender will become the data processor on your behalf (please refer to the Client Contract section of this privacy notice when this happens)

Through certain actions when otherwise there is no contractual relationship between us, such as when you browse our website or ask us to provide you more information about our business, including our products and services, we will ask for your consent to use your personal data.

Wherever possible, we aim to obtain your explicit consent to process this information, for example, we ask you to agree to our use of non-essential cookies when you access our website.

If you have given us explicit permission to do so, we may from time to time pass your name and contact information to selected associates whom we consider may provide services or products you would find useful.

If you no longer want to receive marketing communications from us, you can unsubscribe from our mailing list at any time by emailing accounts@houseoflavender.co detailing your name and email address and indicating that this is in relation to unsubscribing.

We aim to obtain and keep your consent to process your information. However, while we take your consent into account in decisions about whether or not to process your personal data, the withdrawal of your consent does not necessarily prevent us from continuing to process it. The law may allow us to continue to process your personal data, provided that there is another basis on which we may do so. For example, we may have a legal obligation to do so.

How long we keep your personal data

When you are already a House of Lavender client or have been a client in the past we will keep your personal data for at least 10 years based on the average lifecycle of the products and services we offer

Where you are a prospective client, if you have provided consent for us to use your information for our Marketing work, we will retain your information until you have not interacted with us for at least 2 years at the time we conduct our annual audit of our Marketing lists or until you withdraw that consent, whichever is earliest.

Also, if we are confident that you no longer wish to receive emails from us, we will take you off our mailing list and delete your information.

Suppliers

What personal data do we collect?

The type of personal information we collect from you will depend on the product or service you are supplying to us and the context in which we interact with you. In general, this will include, but is not limited to:

• Name and job title
• Contact information including the company/organisation you work for, telephone numbers and email addresses, where provided
• Payment information
• Information that you provide to us as part of scoping or providing services to us
• Relevant information as required by any applicable Know Your Client and/or Anti-Money Laundering regulations (which may include request for identity information such as passports and information collected from publicly available sources e.g. Companies House)

How we collect your personal data

We have gathered your information in one or more of the following ways (the list is non-exclusive):

• When you have approached us to become a supplier
• An industry or business event we are both attending
• When you or the organisation you work for has submitted a proposal to become a supplier and/or entered into a contract of work with us
• Where it is given to us by one of our business partners or related associates or employees
• Public facing websites including social media during our review of applicability to provide a service to us
• When you communicate with us or submit information via our website
• Referral from an organisation where you already act as a supplier

What we use your personal data for and the lawful basis

We use your personal data in the context of you or the organisation you work for providing a service to us. Personal data will be used for the following purposes (the list is non-exhaustive):

• Review your applicability to provide your services to us
• Conduct business operations with you
• Request feedback from you
• Conduct Equality, Diversity and Inclusion monitoring activities
• Resolve queries or complaints
• Provide you access to digital or physical infrastructure as appropriate
• Prevent or detect fraud or money laundering including fraudulent payments
• Establish, defend, or enforce legal claims or regulatory investigations
• Contact you to agree on a contract or a purchase order with you
• Process the payment of invoices, expense claims or relevant claims

Processing your (“Data Subject”) personal data is necessary for the performance of a contract to which you are a party, or in order to take steps at the request of the Data Subject prior to entering into a contract.

How long we keep your personal data

We will only keep personal information for as long as it is needed to fulfil the purpose for which it was collected.

Recruitment

What personal data do we collect?

Where you have applied for a job or work experience with us we will collect the following personal data. This list is non-exclusive:

• Contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Preferred method of contact
• Copies of driving licence, passport, birth certificates and proof of current address, such as bank statements and council tax bills
• Notice period, preferred start date,
• Evidence of how you meet the requirements of the job, such as application forms, CVs, covering letters, references, assessment outputs, employment history, academic qualifications/history, professional training/certifications, skills, and work experience or apprenticeships
• Evidence of your current and/or future work eligibility status, immigration status, including visa type, and visa expiry date
• Diversity and equal opportunities monitoring information – this can include information about your race or ethnicity, religious beliefs, sexual orientation, disability and other ‘special category data’ information about your health, including any medical needs or conditions
• Other information required for some applications
• If you contact us regarding your application, a record of that correspondence including, but not limited to, the content and attachments of emails
• Details of your use of our recruitment tools and services, such as your candidate profile, the source of your application, the date/time, the role(s) you applied for, salary history/expectations, alerts for vacancies, the status of your application and updates on how it moves forward
• Derived data about you, that is, data that includes our staff’s opinion of you such as, but not limited, to the stages you complete of the recruitment process and those you do not, records of interviews, interview notes/feedback, assessment feedback, rejection stage, rejection reason, and job offer details

We may also collect, store and use the “special categories” of more sensitive personal information including, but not limited to:

• Information about your physical or mental health, or disability status
• Information about your health and medical conditions for health and safety reporting purposes
• Criminal records information
• Personal information related to the Equality Act 2010 inclusive of data known as ‘Protected Characteristics’ (age, disability, gender reassignment, marriage or civil partnership (in employment only), pregnancy and maternity, race, religion or belief, sex, sexual orientation)
• Personal information related to our internal equality and diversity monitoring policy (geographical location, organisation, socio-economic class, caring responsibilities, educational background)

How we collect your personal data

We have gathered your personal data in one or more of the following ways:

• Via publicly available sources such as social media, where we have identified you as an individual we would like to approach as a good fit for employment, work experience or apprenticeship at The House of Lavender.
• From a reference of a sectoral relevant individual where they have gained permission from you to be introduced to us
• From a current or former employee where they hold a previously established relationship with you and sharing your personal information with House of Lavender would not be unexpected
• From yourself via a recruitment web advert we have developed which may also mean we have received your personal data via a recruitment platform or website
• From a recruiter, recruitment agency or other applicant tracking system or recruitment website
• From yourself where you have responded to an advert on our website, completed our contact us page on our website or sent an unsolicited prospective email to us
• From publicly available websites and social media platforms
• From former employers and people named by candidates as references
• Where relevant, the Disclosure and Barring Service (DBS)

What we use your personal data for and the lawful basis

We use your personal data in the recruitment process for employment or work experience at House of Lavender in the following ways:

• To reply to you about the position you have applied for or inquired about
• To approach you as a good fit for employment or work experience
• To check you are the right candidate for the role
• To move your application forward including making changes in applicant tracking systems or dedicated recruitment-based software and websites
• To receive a reference from a sectoral relevant individual where they have gained permission from you to be introduced to us
• To send you notifications for other jobs, work experience or maybe internship vacancies
• To inform you about the status of your application
• To gain your permission to retain your personal data for longer than statutory requirements where you have not been successful but we would like the opportunity to invite you to apply again in the future or notify you about upcoming roles that might be suitable

Please be reassured that House of Lavender limits access to your recruitment personal data to those who have a genuine need to access it:

• the recruiting manager for the role in question
• interviewers/assessment reviewers for the role in question
• the director of the team where the role in question sits
• the managing director who has final authority for appointment (note that there may be overlap between the people in those positions)

We maintain a reserve list of candidates who met our requirements but were not successful in securing the specific post they applied for. We’ll ask for your permission to be added to this list. We will refer to the list when other roles are advertised and will contact you if you match the role. We will ask for your permission before putting you forward for the role.

If you are successfully recruited, we will upload your details to our digital systems. We will also share your data for statistical analysis (it will be anonymised first) if we are required to do so by law – for example, by court order, or to prevent fraud or other crime.

For the purposes of reporting on and improving the effectiveness and efficiency of our recruitment systems and processes, we may retain a handful of personal data points about you (the source of your application, the stage you reached in the process, and the overall reason you were rejected), however, none of these data points are personally traceable to you.

We process personal data throughout the recruitment application process based on different legal bases:

• Contract: Processing your data is necessary to move your application forward before signing a contract of work. This concerns employment or pre-employment checks.
• Legal: Complying with applicable law with regard to personal data necessary to satisfy our legal and regulatory obligations, including with regard to public health and workplace safety, entitlement to work and when applicable security checks.
• Legitimate Interest: Evaluating your application and to manage our relationship with you, to ensure that we recruit appropriate employees, and to evaluate and maintain the efficacy of our recruiting process more generally. We will also process your personal data to invite you to participate in projects which may be, or similar to, surveys, questionnaires, events, interviews or other research projects where the work we are conducting is for societal benefit.

How long we keep your personal data

We will only keep personal information for as long as it is needed to fulfil the purpose for which it was collected.

We will store your information for the duration of the recruitment process. Where you have not been successful, we shall retain your personal data for up to 6 months in accordance with the UK Limitation Act 1980. We will only retain your personal data longer than 6 months where we have gained your permission to do so.

If you have been successful in the recruitment process, we will provide you with an Employee Privacy Notice outlining the retention period of your personal information.

Website

What personal data do we collect?

When you visit our website, we will collect the following information about you:

• Information about the device used to access our website, your visits and use of the website including your IP address, internet log information, location, browser type and version, referrer and activity, and details of visitor behaviour patterns
• We record your activity and preferences when visiting our website through the use of cookies (see the section on “Cookies” below)
• IP address, operating system and browser information

How we collect your personal data

We collect data about you from your device and via third-party website analytics services such as Google Analytics and cookies (see section on Cookies below) when you visit our website. We do not make, and do not allow our Google Analytics settings to make any attempt to find out the identities of those visiting our website.

What we use your personal data for and the lawful basis

The personal information we collect when you visit our website goes toward helping us:

• Monitor the website and keep it secure, it helps us understand how we might improve the website through number of visits, visitor patterns and behaviour
• Promote and develop services and grow our organisation
• Run our organisation, provide administration and IT services, ensure network security and prevent fraud
• To keep our website updated and relevant, to develop our organisation and to inform our marketing strategies
• To add you to Marketing activities contact lists where you have indicated your consent for us to do so

We process the personal data of visitors to our website based on our legitimate interest as the data controller.

Cookies we use tell us how you use the site and what pages you have visited. We request your consent for the use of cookies when you first visit our website. You can opt to refuse cookies that are not necessary, and you are able to update cookie collection preferences through browser settings (see the section on “Cookies” below).

How long we keep your personal data

We will only keep personal information for as long as it is needed to fulfil the purpose for which it was collected.
Depending on your reason for visiting the website and how you decide to interact with our website will determine the amount of time we retain your personal information outlined above. You are able to delete Cookies (see the section on “Cookies” below).

Automated decisions made using your personal data

The House of Lavender does not make any automated decisions using your personal data.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with professional services). In this case, we may have to cancel a service you have with us, but we will notify you if this is the case at the time.

Data sharing and international data transfers

Your personal data will be stored with specific third-party services for the minimum period necessary to perform activities with your personal data. Not all of the service providers used by The House of Lavender offer the same level of protection as if your personal data is based in the UK although each third-party service provider is subject to contractual and security reviews to ensure an adequate level of protection for your personal data, we’d expect for ourselves, and is proportionate to the levels of risk related to the data.

The types of third-party providers we use and their data location include:

• Digital communications and storage providers (UK, EEA, global location including the US)
• Mass email services and Client Relationship Management (CRM) services (UK, EEA, global location including the US)
• Website services and platform providers (EEA and global locations)

Whenever we transfer your personal data out of the UK, we work toward ensuring a similar degree of protection afforded to you were the data based in the UK by implementing one or more following contractual, technical or organisational safeguards:

• Having the default data location based in countries that have been deemed to provide an adequate level of protection for personal data by the UK (the UK also recognises the European Commission list of adequate countries. For further details, see European Commission: Adequacy of the protection of Personal Data in non-EU countries)
• Specific contracts/agreements approved by the UK which give personal data the same protection it has in the UK. For further details, see UK International Data Transfer Agreements. We will also assess in-country standards as part of this process.
• Specific agreements may also include non-disclosure, data processing and memorandum of understanding.

Cookies

As you interact with our website, we automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies to enhance your experience of our website.

Our website uses cookies for collecting user information which may include IP address, operating system, and browser information. We use persistent cookies to track returning visitors. They expire after 12 months and enable us to compare website traffic from month to month.

Cookies are text files, which identify a user’s computer to our servers. Cookies in themselves do not identify the individual user, just the computer used. You can learn more about cookies by visiting http://www.allaboutcookies.org/.

You can manage and delete cookies through your web browser. Each browser manages cookies differently, but you can learn more about cookie settings in the most common browsers using the links below:

• Chrome
• Firefox
• Safari for Mac
• Safari for iOS
• Edge
• Internet Explorer

You can also prevent your data from being used by Google Analytics by using the Google Opt-out Browser Add-on, available at this link.

Links to other websites

Our website contains links to other websites run by other organisations. This privacy notice applies only to the House of Lavender website and House of Lavender services. When you visit other websites please refer to their privacy notice(s).

Your data protection rights

You have the following rights in respect of your personal data:

• Your right of access– You have the right to ask us for copies of your personal information.
• Your right to rectification– You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure– You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing– You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing– You have the right to object to the processing of your personal information in certain circumstances including where we are processing your data based on consent.
• Your right to data portability– You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at accounts@houseoflavender.co  if you wish to make a request.

Complaints

If you have any concerns about our use of your personal information, you can make a complaint to us by contacting accounts@houseoflavender.co

You also have the right to complain to the UK Information Commissioner’s Office (ICO) using the details below if you are unhappy with how we have used your data. We kindly request you allow us the opportunity to address your complaints when they arise.

The ICO’s address:  Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://ico.org.uk/make-a-complaint/

Last update to this Privacy Notice

This privacy notice was last updated in  2026.