1. Who we are
This Privacy Policy is issued on behalf of Free. Period. ("Free. Period.", "we", "us", or "our"), a business operating in the United Kingdom and providing brand-funded menstrual products to end users at no cost. For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), Free. Period. is the data controller in respect of personal data collected through our website, our supporter onboarding process, and our distribution programme. You can contact us at connect@free-period.co.uk for any privacy enquiry, subject access request, or to exercise any right described below.
2. Scope of this policy
This policy applies to all personal data we collect or process in connection with free-period.co.uk, any successor or associated domain, any campaign microsite operated by us, our supporter enquiry forms, our email correspondence, our pitch and supporter materials (including the downloadable supporter deck), and any product placement, vending, or in-venue distribution programme operated by or on behalf of Free. Period. It applies to prospective supporters, current supporters, end users of our products, venue operators, members of the public who contact us, and visitors to our website.
3. Personal data we collect
We collect only the personal data we reasonably need. This may include: identifying information such as your name and the brand or organisation you represent; contact information such as your email address, telephone number and business address; correspondence content, including the contents of enquiries submitted through our forms, by email, by direct message, or by any other channel; commercial information such as supporter terms, purchase orders, invoicing details and VAT particulars; technical information such as IP address, browser type, device identifiers, time-zone setting, operating system and platform; usage information such as pages viewed, referring URLs, interaction events and approximate location derived from IP address; and any other information you voluntarily provide. We do not knowingly collect special category data, and we ask that you do not submit it through our forms.
4. Children and young people
Our website and supporter onboarding flow are directed at adults and at brand representatives acting in a professional capacity. Although our products are made available in venues that may include schools, colleges, universities and youth-serving healthcare settings, we do not knowingly collect personal data directly from any individual under the age of 16 through this website. Where products are distributed in venues serving minors, distribution is operated through, and on the lawful basis of, the relevant venue operator, who remains the controller of any pupil or patient personal data processed in that environment.
5. How we use your data and our lawful bases
We process personal data only where we have a lawful basis under Article 6 UK GDPR. Specifically: (a) to respond to enquiries, prepare supporter proposals, negotiate and perform contracts, and provide our services, on the basis of performance of a contract or steps taken at your request prior to entering a contract; (b) to operate, secure, improve, and analyse our website, our campaigns and our distribution programme, on the basis of our legitimate interests in running a sustainable, brand-funded operation and in safeguarding it from misuse, fraud and abuse, balanced against your rights and freedoms; (c) to send service communications, supporter updates, campaign reports and, where permitted, marketing communications, on the basis of your consent or our soft opt-in under PECR where you are an existing business contact; and (d) to comply with legal, regulatory, tax, accounting, anti-money-laundering and audit obligations, on the basis of compliance with a legal obligation to which we are subject.
6. Marketing and your right to object
Where we contact brand or organisational representatives about supportership opportunities, we rely on the soft opt-in or on our legitimate interest in business development, and you may object or unsubscribe at any time by replying "unsubscribe" or emailing connect@free-period.co.uk. We do not sell your personal data, we do not share it with third-party advertisers for cross-context behavioural advertising, and we do not engage in automated decision-making producing legal or similarly significant effects under Article 22 UK GDPR.
7. Cookies and similar technologies
Our website uses a minimal set of cookies and similar technologies. Strictly necessary cookies are used to operate the site, remember your consent choices and protect the service from abuse; these do not require consent. Analytics and performance cookies, where used, are deployed only on the basis of your prior consent under PECR and may be withdrawn at any time. You may control cookies through your browser settings, including by blocking or deleting them, although doing so may affect the functioning of the site.
8. Sharing your data
We share personal data only where strictly necessary and only with recipients bound by appropriate confidentiality and data protection obligations. Recipients may include: our hosting, email, analytics, customer relationship management, payment, accounting and professional service providers acting as processors on documented instructions; our manufacturing, fulfilment, logistics and venue distribution partners, strictly to the extent required to produce, deliver and place co-branded product; our professional advisers, including lawyers, auditors, insurers and accountants, under duties of confidentiality; competent regulators, courts, law enforcement and public authorities, where we are legally required or permitted to disclose; and any actual or prospective purchaser of all or part of our business or assets, subject to appropriate confidentiality undertakings.
9. International transfers
We aim to host and process personal data within the United Kingdom or the European Economic Area wherever possible. Where personal data is transferred outside the UK to a country not covered by UK adequacy regulations, we put in place an appropriate transfer mechanism, including the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard recognised by the Information Commissioner's Office, and we carry out a transfer risk assessment where required.
10. Retention
We retain personal data only for as long as is necessary for the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, regulatory or reporting requirements, defending or bringing legal claims, and maintaining an accurate business record. Enquiry data is generally retained for up to 24 months from last contact; supporter contract data is generally retained for the duration of the relationship and for up to seven years thereafter for tax and accounting purposes; and website analytics data is retained for a shorter, proportionate period. Specific retention periods are available on request.
11. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, alteration, or disclosure. These measures include access controls, encryption in transit, segregation of environments, vendor due diligence, and staff confidentiality obligations. No method of transmission over the internet or method of electronic storage is, however, fully secure, and we cannot guarantee absolute security. Where required by law, we will notify the Information Commissioner's Office and affected individuals of any qualifying personal data breach without undue delay.
12. Your rights
Subject to applicable law, you have the right to request access to the personal data we hold about you; the right to request rectification of inaccurate or incomplete data; the right to request erasure in defined circumstances; the right to request restriction of processing; the right to data portability; the right to object to processing carried out on the basis of legitimate interests or for direct marketing; and the right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out prior to that withdrawal. You may exercise any of these rights by emailing connect@free-period.co.uk. We will respond within one month, subject to extension for complex or numerous requests. You also have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk, although we would appreciate the opportunity to address your concerns first.
13. Third-party content and links
Our website may contain links to third-party websites, plug-ins, social platforms, and applications, including Instagram. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. We encourage you to read the privacy policy of every website you visit.
14. Intellectual property and content use
All trade marks, logos, copy, photography, product mock-ups, the script "Free. Period." wordmark, supporter deck, campaign creative and other materials made available through this website are the property of Free. Period. or its licensors and are protected by applicable intellectual property laws. Nothing on this website grants any licence or right of use other than for the limited purpose of evaluating a potential supportership. Unauthorised reproduction, distribution, modification, or commercial use is prohibited.
15. Limitation of liability
To the fullest extent permitted by law, Free. Period. excludes all implied conditions, warranties, representations and other terms which may apply to this website or any content on it, and shall not be liable for any indirect, special or consequential loss, loss of profits, loss of business, business interruption, loss of business opportunity, or loss of anticipated savings arising out of or in connection with the use of, or inability to use, this website or any of the materials made available on it. Nothing in this policy excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded.
16. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The "Last updated" date at the top of this page indicates when the policy was most recently revised. Material changes will be notified through the website or, where appropriate, by email. Your continued use of the website or our services after the effective date of any revised policy constitutes your acknowledgement of the change.
17. Governing law and jurisdiction
This Privacy Policy, its subject matter and its formation are governed by the laws of England and Wales. You and Free. Period. agree to the exclusive jurisdiction of the courts of England and Wales in respect of any dispute arising out of or in connection with this policy, save that we retain the right to bring proceedings against you for breach of these terms in your country of residence or any other relevant country.
18. Contact
For any question, complaint, or request relating to this Privacy Policy or to our processing of your personal data, please contact us at connect@free-period.co.uk. We aim to respond to every enquiry promptly and in any event within the statutory time limits.