Last updated: 24-Oct-2025
Who we are
WARM™ is the trading name of Workplace Addiction & Recovery Movement CIC (“WARM”, “we”, “us”). We are the data controller for the personal data described here.
How to contact us
Please use the website Contact form and select the relevant topic. For data protection requests, choose “Data protection request.” We may need to verify your identity.
What this policy covers
This policy explains what we collect when you register and use the WARM platform, how we use it, and your choices. It applies to member-only areas, events and service communications.
Personal data we collect
- Registration data: full name, role/title, organisation, work email (and confirmation), country of work; ERG name if applicable.
- Account data: verification status, role type, organisation membership.
- Service data: event registrations/attendance, content viewed, and non-identifying engagement metrics.
- Communications: messages you send us via the Contact form; your preferences.
We do not require special-category health data to deliver our service. Please do not share personal medical information.
Why we use your data (lawful bases)
- To create and administer your account and provide member services (contract).
- To send service communications such as event reminders and platform updates (legitimate interests/contract).
- To keep the service secure, prevent abuse and troubleshoot (legitimate interests).
- To analyse aggregate usage to improve content and to provide organisations with aggregate, anonymised insights (legitimate interests). We do not share your personal data with other members or with your employer.
Marketing
We do not send third-party marketing. If we offer optional newsletters, we will request your consent separately.
Sharing your data (processors)
We use trusted vendors for hosting, email, video and analytics under data-processing agreements. Where processors are outside the UK/EEA, we use appropriate safeguards (e.g., IDTA/SCCs). We may disclose information if required by law.
Retention
Registration data is kept while your organisation remains a member and for up to 24 months after account closure, unless law requires a different period. Aggregated analytics may be retained for trend analysis.
Your rights
Under UK GDPR you have the rights of access, rectification, erasure, restriction, objection and portability. To exercise these rights, submit a request via the Contact form and choose “Data protection request.” You may complain to the ICO (ico.org.uk).
Security
We use technical and organisational measures appropriate to the risk. No system is 100% secure.
Children
WARM is for adults in employment; we do not knowingly allow under-18s to register.
Changes
We may update this policy and will post the latest version here.