Privacy Notice – The WillsFlower App
Effective date: 9 August 2026
Data controller: Willsflower Society Management
Address: First Floor, The Urban Building, Albert Street, Slough, SL1 2BE, United Kingdom
Telephone: 01753 255592
Willsflower Society Management is responsible for the personal information described in this Privacy Notice.
Where a property owner or managing entity independently decides why and how certain information is processed, that organisation may also act as a data controller.
Registered users can submit and track privacy requests securely through Privacy & Data within The WillsFlower App.
We collect only the information reasonably required to verify eligibility, operate the app and provide property services. Required and optional fields are identified during registration and use.
This may include:
Your name, verified mobile number, work email address and employee or company identifier.
Your property, company, floor, office or unit, job title and approved user role.
Guest invitations, guest-pass details and entry decisions.
Amenity, meeting-room and service-booking information.
Maintenance requests, descriptions, photographs and completion records.
Community posts, replies, reports and moderation records.
Announcements, notifications and service communications.
Membership plan, subscription status, payment amount, invoice and payment references.
SOS category, time, workplace information and location when you choose to send an emergency alert.
Session, security, device-platform, push-token and limited diagnostic information required to protect and operate the service.
Willsflower does not receive or store complete payment-card details. These are processed by the authorised payment provider.
We do not use one blanket consent for all processing. The applicable UK GDPR lawful basis depends on the purpose.
We may process information:
To perform a contract or take requested pre-contractual steps: to provide account access, bookings, memberships, payments, confirmations, cancellations and requested services.
For legitimate interests: to operate the property securely, control access, prevent fraud, administer services, moderate the community and improve building services. These interests are balanced against your rights.
To comply with legal obligations: including accounting, regulatory, safety, data-rights and legal-claims obligations.
To protect vital interests: where SOS information or location may be needed to help protect somebody’s life during an emergency.
With your consent: for optional promotional emails or SMS messages. These choices are separate, optional and switched off by default. You may withdraw consent through Privacy & Data in the app.
Operational messages relating to your account, safety, bookings, payments or requested services are not marketing communications.
Access is restricted according to each user’s approved role.
Property administrators may access information required to verify users and manage property services.
Security personnel may access relevant guest and SOS information.
Service providers may access assigned maintenance work and relevant emergency alerts.
Office managers may access employee-approval and company information required for their organisation.
Tenants cannot access other users’ private workplace records.
We also use carefully selected providers for services such as secure hosting, authentication, file storage, payments, transactional email and SMS, push notifications, application distribution and technical support.
These providers may process information only as necessary to supply their contracted services and subject to appropriate data-protection obligations.
Information may also be disclosed where required by law, to emergency services, regulators, professional advisers, insurers or in connection with a lawful corporate transaction.
Core service information is hosted in the United Kingdom. Certain service providers or their support teams may process information outside the UK.
Where required, safeguards may include UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, contractual protections, encryption and access controls.
You may request further information through Privacy & Data in the app.
We keep identifiable information only for as long as necessary for its stated purpose, unless a legal obligation, legal claim or preservation requirement applies.
Our principal retention approach is:
Community posts, replies and associated reports: normally six weeks.
Ordinary announcements and associated notifications: normally fourteen days after publication or earlier deletion.
Guest-pass and access records: retained for the operational and security period established by property management.
Maintenance requests and supporting evidence: retained while the request is active and for the period needed for service history, disputes and legal claims.
Booking information: retained for administration, booking history, dispute resolution and applicable accounting requirements.
Payment, invoice and membership records: retained for applicable accounting, taxation, fraud-prevention and legal obligations.
Incomplete membership checkouts: normally marked expired after fifteen minutes. The payment provider may retain its own records under its applicable obligations.
Account and workplace information: retained while the account remains active and afterwards only where required for security, legal obligations or claims.
Privacy acknowledgements, consent history, rights requests and breach records: may be retained for up to six years to demonstrate compliance and manage legal claims.
At the end of an applicable period, information is deleted or anonymised unless continued retention is legally required.
Depending on the circumstances, you may have the right to:
Request access to your personal information.
Request correction of inaccurate or incomplete information.
Request deletion of information where the relevant conditions apply.
Request restriction of processing.
Object to processing based on legitimate interests.
Object at any time to direct marketing.
Request portable information where processing is automated and based on consent or contract.
Withdraw optional consent without affecting processing that occurred before withdrawal.
Complain to the UK Information Commissioner’s Office.
Registered users should use Privacy & Data inside the app to submit and track requests. We may need to verify your identity and normally respond within one month.
You may contact the Information Commissioner’s Office through ico.org.uk or telephone 0303 123 1113.
The app requests camera, photograph, location and notification permissions only when required by a relevant feature. A short explanation is provided before or when permission is requested.
Permissions can be managed through your device settings. Refusing a permission may prevent the associated feature from working but should not prevent unrelated features from being used.
We use safeguards including encrypted communications, secure authentication, role-based access controls, least-privilege access and protected administrative operations.
No system can be guaranteed completely secure. Suspected personal-data incidents are investigated and handled under our incident and data-breach procedures.
The current app does not use behavioural advertising, cross-app advertising tracking or advertising cookies. It does not request platform advertising-tracking permission.
If these practices change, this notice and any required user choices will be updated before the relevant processing begins.
We may update this notice when services, legal requirements or processing practices change. Material changes will receive a new version and date, with an appropriate in-app acknowledgement where required.
Registered users should submit privacy questions and rights requests securely through:
The WillsFlower App → Menu → Privacy & Data
For general assistance:
Telephone: 01753 255592
Address: First Floor, The Urban Building, Albert Street, Slough, SL1 2BE, United Kingdom
Privacy and community safety contact
Email: privacy@willsflower.com
You can contact us about privacy rights, account deletion, community safety, objectionable content or misuse. Privacy and deletion requests can also be submitted from Privacy & Data inside the WillsFlower App.