Privacy Policy
ASPIRIUM LTD
Version: 2.0
Last Updated: 26 October 2026
Aspirium Ltd (“Aspirium”, “we”, “us” or “our”) is committed to protecting personal information and respecting individual privacy rights.
This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you visit our website, contact us, subscribe to our communications or purchase and use our services.
It also explains how our responsibilities differ when we process personal information on behalf of our business customers.
We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”) and Data Protection Act 2018.
1. Who We Are
1.1 Data Controller
Aspirium Ltd is a private limited company registered in England and Wales.
Company name: ASPIRIUM LTD
Company number: 16989063
Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Website: https://aspirium.co.uk
Aspirium is the data controller for personal information processed for its own business purposes, including customer relationships, account administration, billing, sales and marketing.
1.2 ICO Registration
Aspirium is registered with the Information Commissioner’s Office under registration number ZC245198.
1.3 Data Protection Contact
Questions, concerns and requests concerning personal information may be submitted to our dedicated email channel – privacy@aspirium.co.uk.
Alternatively, correspondence may be sent to our registered office, marked for the attention of the Data Protection Contact.
2. Scope of This Policy
2.1 Our Business Activities
This Policy applies to personal information processed by Aspirium in connection with:
Our website and online enquiries.
Customer registration and account management.
Hosting, domains and business email services.
Website Care and technical support.
Website design, development and migrations.
Marketing dashboards and analytics.
Email Marketing and Automation.
Design Studio and creative services.
AI Digital Assistant functionality.
Rewards, discounts and partner services.
Our own newsletters, promotions and marketing communications.
Supplier relationships and general business administration.
2.2 Aspirium as a Data Processor
Where a business customer uses Aspirium to host, store, manage or otherwise process personal information relating to its own customers, patients, employees or contacts, Aspirium will generally act as a data processor.
For example, where a healthcare clinic uses Aspirium’s Email Marketing service to send newsletters to its patients, the clinic will ordinarily determine the purposes and lawful basis of that processing.
Aspirium will process that information on the clinic’s instructions, subject to the applicable Data Processing Agreement.
2.3 Customer Privacy Notices
Where Aspirium acts as a processor, the relevant business customer is responsible for providing an appropriate privacy notice to the individuals whose information it controls.
This Privacy Policy does not replace the privacy notices or legal obligations of our customers.
2.4 External Websites
Our website and Services may contain links to external websites, platforms and integrations.
Where an external organisation independently determines how and why personal information is processed, its own privacy policy applies.
3. Personal Information We Collect
The personal information we collect depends on your relationship with Aspirium and the Services you use.
3.1 Identity and Business Information
We may collect:
Name and professional title.
Company or organisation name.
Business address.
Professional role.
Business registration information.
Contact details.
Account ownership and authorised-user status.
3.2 Account Information
When you register for Aspirium Services, we may process:
Account usernames and identifiers.
Authentication and login information.
Subscription details.
Service configurations.
Account preferences.
User permissions.
Account activity and relevant security records.
3.3 Billing and Transaction Information
We may collect:
Billing names and addresses.
Orders and subscription information.
Invoice records.
Payment amounts and dates.
Payment status.
Refund and cancellation information.
Payment-provider references and limited card information.
Payments are generally processed by authorised third-party payment providers.
Aspirium does not ordinarily receive or store complete payment-card numbers.
3.4 Communications and Support
We may retain information relating to:
Contact form enquiries.
Demonstration requests.
Support tickets.
Customer correspondence.
Feedback and complaints.
Technical support instructions.
Service configuration and migration requests.
Where support requires access to a customer’s systems, we may temporarily process relevant technical information, credentials or diagnostic records.
3.5 Website and Technical Information
When you access our website or Services, we may collect:
IP addresses.
Browser and device information.
Operating system information.
Pages visited.
Referral information.
Dates and times of access.
Login and authentication events.
Cookie identifiers.
Security and diagnostic logs.
3.6 Marketing Information
Where you subscribe to or receive Aspirium communications, we may process:
Name and email address.
Organisation and professional interests.
Marketing preferences.
Subscription and consent records.
Source of subscription.
Email delivery and bounce information.
Email opening information, where tracking is enabled.
Link interactions and campaign engagement.
Unsubscribe and suppression information.
Responses to marketing communications.
3.7 Information from Other Sources
We may receive relevant information from:
Business customers and authorised representatives.
Referral partners.
Domain registrars and registries.
Payment and fraud-prevention providers.
Connected service platforms.
Publicly available business sources.
Third-party services you authorise us to access.
We will process such information only where an appropriate lawful basis exists.
4. How We Use Personal Information
We process personal information for the following purposes.
4.1 Customer Enquiries
To respond to enquiries, arrange demonstrations, provide quotations and take steps requested before entering into a contract.
4.2 Service Delivery
To create accounts, process orders, configure Services, maintain subscriptions and provide contracted functionality.
4.3 Billing and Payments
To issue invoices, collect payments, administer renewals, process refunds and maintain financial records.
4.4 Technical Support
To investigate problems, provide assistance, maintain infrastructure, perform authorised changes and resolve support requests.
4.5 Security and Fraud Prevention
To protect accounts, identify suspicious activity, investigate misuse, prevent fraud and maintain the security of our systems.
4.6 Customer Communications
To send important information concerning:
Account registration.
Service activation.
Billing and renewals.
Planned maintenance.
Security incidents.
Service interruptions.
Contractual or policy changes.
Support requests.
These communications are generally administrative or contractual rather than promotional.
4.7 Marketing and Promotions
To send newsletters, relevant service information, promotional offers, product announcements and other business marketing where permitted by law.
4.8 Service Improvement
To analyse service usage, customer feedback and website performance to improve our Services and customer experience.
4.9 Legal and Regulatory Compliance
To meet legal obligations, maintain business records, respond to lawful requests and establish, exercise or defend legal claims.
5. Our Lawful Bases for Processing
We rely on one or more lawful bases under Article 6 UK GDPR, depending on the processing activity.
| Processing purpose | Lawful basis |
|---|---|
| Responding to an individual’s pre-contract enquiry | Contract or steps before entering a contract |
| Administering individual business subscriptions | Contract, where applicable |
| Managing organisational accounts and representatives | Legitimate interests |
| Billing and accounting | Contract, legitimate interests or legal obligation, as applicable |
| Technical support and service administration | Contract or legitimate interests, as applicable |
| Fraud prevention and security | Legitimate interests or legal obligation |
| Maintaining required business records | Legal obligation or legitimate interests |
| Improving our website and Services | Legitimate interests, subject to applicable cookie consent requirements |
| Sending marketing communications | Consent or legitimate interests where permitted, alongside PECR compliance |
| Non-essential cookies and tracking | Consent where required by law |
| Establishing or defending legal claims | Legitimate interests or another applicable lawful basis |
5.1 Legitimate Interests
Where we rely on legitimate interests, we consider the necessity of the processing, our business interests and the potential impact on individuals.
Our legitimate interests may include maintaining customer relationships, operating and improving our business, preventing fraud, securing systems and promoting relevant business services.
5.2 Consent
Where we rely on consent, you may withdraw it at any time.
Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
5.3 Special-Category Information
We do not ordinarily require special-category personal data for Aspirium’s own account administration or marketing.
Where such information is processed, an appropriate Article 9 condition and any other applicable legal requirements must be satisfied.
6. Payments, Fraud Prevention and Automated Tools
6.1 Payment Processing
Payments may be processed through Stripe or another payment provider identified during checkout.
These providers may process payment information, transaction details and fraud-prevention information in accordance with their applicable privacy terms.
Aspirium ordinarily receives transaction confirmations, payment references and limited payment-method information.
6.2 Automated Security Measures
We may use automated systems to detect suspicious activity, unusual login attempts, fraudulent transactions, spam and other security risks.
These measures may result in additional verification, temporary restrictions or manual review.
We do not intend to make solely automated decisions producing legal or similarly significant effects without complying with applicable legal requirements.
6.3 AI-Enabled Services
Where AI-enabled functionality is used, information entered into the relevant feature may be processed by authorised technology providers.
The applicable processing arrangements depend on whether Aspirium is acting as a controller or processor.
Customers must not submit identifiable patient records, sensitive health information or other restricted information unless the particular Service has been expressly authorised for such processing.
7. Who Receives Personal Information
We share personal information only where reasonably necessary for the purposes described in this Policy or where otherwise permitted or required by law.
Recipients may include the following providers and categories.
7.1 Hosting and Infrastructure
Stablepoint and its applicable contracting and infrastructure entities may provide hosting, server management, DNS, email, storage, backup and related technical services.
7.2 Customer Accounts and Billing
Upmind may process account, subscription, billing and service administration information.
Stripe and other authorised payment providers may process payment and transaction information.
7.3 Email Marketing
ActiveCampaign may process contact information, subscription preferences, campaign engagement information and related records when Aspirium sends its own newsletters, promotions and automated communications.
ActiveCampaign may also provide underlying technology for email marketing services purchased by Aspirium customers, as described in Section 10.
7.4 Analytics and Creative Tools
Depending on the Services used, providers may include:
AgencyAnalytics for marketing reporting.
Polotno for Design Studio functionality.
Website-building and creative technology providers.
Connected analytics and advertising platforms.
7.5 Security Providers
Cloudflare, including Turnstile where deployed, and other authorised security providers may process technical information to protect our website and Services.
7.6 Technical Support Providers
Authorised website maintenance, migration, troubleshooting and security providers may receive information necessary to complete approved work.
7.7 AI Technology Providers
Where AI functionality is enabled, relevant information may be processed by OpenAI or another authorised AI technology provider, depending on the feature and configuration.
7.8 Domain Services
Domain registrars, registries, ICANN, Nominet and related providers may process information necessary for domain registration, verification, renewal and administration.
7.9 Professional and Legal Recipients
Information may be shared where necessary with professional advisers, accountants, auditors, insurers, debt-recovery providers, courts, regulators or law-enforcement authorities.
7.10 Corporate Transactions
Information may be disclosed where reasonably necessary in connection with a legitimate merger, acquisition, restructuring or business sale, subject to appropriate confidentiality and legal safeguards.
7.11 Independent Controllers
Some recipients, including payment providers and domain registries, may act as independent data controllers for their own legal or operational purposes.
Their respective privacy policies will apply to those activities.
7.12 No Sale of Personal Information
Aspirium does not sell personal information to third parties.
8. International Transfers
Some of our technology providers operate internationally or use personnel and infrastructure outside the United Kingdom.
This may involve international access to or processing of personal information.
Where a transfer is restricted under UK data protection law, Aspirium will ensure that an appropriate lawful transfer mechanism applies.
Depending on the circumstances, this may include:
UK adequacy regulations.
The UK International Data Transfer Agreement.
The UK Addendum to the EU Standard Contractual Clauses.
Another valid mechanism permitted under applicable law.
Where required, we will assess relevant transfer risks and supplementary safeguards.
Individuals may contact us to request further information about the safeguards applicable to their personal information.
Specific arrangements depend on the relevant provider, processing activity and contractual terms.
9. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, accounting, security and dispute-resolution requirements.
Our intended retention approach is as follows.
9.1 Enquiries and Prospective Customers
Enquiry and demonstration records will normally be retained for up to two years after the last meaningful contact, unless a longer period is justified or deletion is required sooner.
9.2 Customer and Contract Records
Account, contract, order, invoice and payment records may ordinarily be retained for up to six years after the relevant financial period or customer relationship ends, where necessary for tax, accounting and legal purposes.
Longer retention may apply where legally required.
9.3 Support Records
Support tickets and operational correspondence are retained for periods appropriate to service delivery, security and potential legal claims, normally no longer than six years after the customer relationship ends unless a longer period is justified.
9.4 Temporary Credentials
Temporary access credentials obtained for support or migration should be removed when no longer required.
Protected backup copies or technical logs may remain for a limited period according to applicable retention schedules.
9.5 Security Logs
Security, authentication and technical logs are retained for periods proportionate to their purpose, then deleted, overwritten or anonymised.
9.6 Marketing Information
Marketing contact information may be retained while you remain subscribed or while a lawful marketing relationship continues.
Where you unsubscribe or object, we may retain a minimal suppression record to prevent further unwanted marketing.
9.7 Cookies
Cookie and tracking retention periods are described in our Cookie Policy and consent management tools.
9.8 Customer-Controlled Data
Where Aspirium acts as a processor, retention and deletion are governed by the applicable Data Processing Agreement, contractual arrangements and lawful customer instructions.
10. Email Marketing and ActiveCampaign
Aspirium uses ActiveCampaign in two distinct capacities.
10.1 Aspirium’s Own Marketing
Aspirium uses ActiveCampaign to manage and deliver its own business communications.
These may include:
Newsletters.
Product announcements.
Promotional offers.
Educational content.
Customer onboarding sequences.
Automated marketing communications.
Service-related campaigns.
For these activities, Aspirium generally acts as the data controller and ActiveCampaign processes information on our behalf, subject to the applicable contractual arrangements.
10.2 Marketing Permissions
We send electronic marketing only where permitted by applicable law, including the Privacy and Electronic Communications Regulations 2003.
Depending on the recipient and circumstances, we may rely on consent or another permitted marketing route, alongside an appropriate UK GDPR lawful basis.
We distinguish between individual subscribers, sole traders and corporate business contacts when assessing the applicable requirements.
We will not treat a business email address as automatically exempt from electronic marketing rules.
10.3 Marketing Preferences
Recipients may unsubscribe from promotional communications at any time using the unsubscribe facility provided in relevant emails or by contacting Aspirium.
We will maintain appropriate suppression information to honour marketing objections.
10.4 Email Engagement Tracking
Where enabled and lawful, our marketing communications may contain tracking technologies that help us understand:
Whether an email was delivered.
Whether it was opened.
Whether a link was selected.
Whether a recipient unsubscribed.
Whether a campaign resulted in a relevant website interaction.
This information may be used to evaluate campaigns, improve content and understand subscriber interests.
Tracking is subject to applicable privacy and electronic communications requirements and available consent or preference controls.
Email opening information may be incomplete or inaccurate because of privacy features, image blocking and automated email systems.
10.5 Automated Marketing
We may use contact preferences, business interests, previous enquiries, subscription information and engagement activity to tailor relevant communications.
We do not use these marketing automations to make solely automated decisions producing legal or similarly significant effects.
10.6 Customer Email Marketing Services
Aspirium also supplies ActiveCampaign-powered Email Marketing and Automation services to business customers.
When a clinic or other business imports its own contact list, creates campaigns or manages subscriber information, that business ordinarily determines the purposes and lawful basis of the processing.
In those circumstances:
The business customer ordinarily acts as data controller.
Aspirium ordinarily acts as data processor.
ActiveCampaign may act as Aspirium’s subprocessor, subject to the relevant contractual arrangements.
The business customer’s privacy notice should explain how it uses personal information for marketing.
Aspirium’s Data Processing Agreement governs its obligations when processing personal data on the customer’s behalf.
10.7 Healthcare Contact Information
Aspirium’s Email Marketing services must not be used to upload, store, infer or use identifiable health information or other special-category personal data. This includes clinical records, symptoms, diagnoses, treatment histories, clinical correspondence, and tags, segments, scores or automations that reveal or infer an identifiable person’s health condition or treatment.
Ordinary contact details may be used for lawful mailing-list management, provided the list’s name, selection criteria, associated information and use do not themselves reveal or infer special-category data. Removing clinical fields does not make a list permissible if its membership or segmentation still reveals a health condition.
Customers must configure website forms, booking systems and other integrations to prevent prohibited information from entering the Email Marketing services.
11. Cookies and Similar Technologies
11.1 Website Cookies
Our website may use essential cookies and other technologies necessary for security, authentication, shopping, account management and basic functionality.
11.2 Optional Technologies
Where enabled, optional technologies may include:
Analytics cookies.
Functional preference cookies.
Marketing and advertising cookies.
Conversion tracking.
Embedded third-party content.
11.3 Consent
Non-essential cookies and similar technologies are used only in accordance with applicable consent requirements.
Where consent is required, users must be given appropriate information and a genuine choice before those technologies are activated.
11.4 Managing Preferences
Users may manage or withdraw applicable cookie consent through our website’s consent management facilities.
11.5 Further Information
Our Cookie Policy provides additional information about the technologies used, their purposes and available controls.
12. Information Security
12.1 Security Measures
We implement technical and organisational measures appropriate to the nature and risks of the personal information we process.
These may include:
Access controls.
Authentication and account security.
Encryption in transit.
Appropriate storage security.
Security monitoring and logging.
Malware protection.
Software maintenance.
Backup and recovery arrangements.
Supplier security controls.
Incident response procedures.
Confidentiality obligations.
12.2 Supplier Security
Where providers process personal information on our behalf, we require appropriate contractual and security safeguards in accordance with applicable law.
12.3 Customer Responsibilities
Customers must protect their own credentials, devices, access permissions and service configurations.
12.4 Security Incidents
We maintain procedures for investigating and responding to suspected personal data breaches.
Where required, we will notify affected individuals or relevant authorities in accordance with applicable law.
No internet-connected system can be guaranteed completely secure.
13. Children and Sensitive Personal Information
13.1 Business Services
Aspirium provides services primarily for business and professional use and does not knowingly offer customer accounts directly to children.
13.2 Sensitive Information
We do not ordinarily require health information, biometric information, criminal offence information or other sensitive personal data for our own account administration and marketing activities.
13.3 Healthcare Customers
Some customers may operate healthcare websites or systems containing information relating to patients or children.
Where Aspirium processes such information solely on behalf of those customers, the applicable Data Processing Agreement governs our processing obligations.
13.4 Restrictions
Customers must not submit sensitive or patient-identifiable information to Services that are not expressly authorised and appropriately safeguarded for that processing.
14. Your Data Protection Rights
Depending on the circumstances, you may have the following rights under UK data protection law.
14.1 Access
You may request access to personal information we hold about you and information about how it is used.
14.2 Rectification
You may request correction of inaccurate or incomplete personal information.
14.3 Erasure
You may request deletion of personal information where the relevant legal conditions apply.
14.4 Restriction
You may request restriction of processing in certain circumstances.
14.5 Objection
You may object to processing based on legitimate interests where the applicable conditions are met.
You have the right to object at any time to processing of your personal information for direct marketing.
14.6 Data Portability
Where applicable, you may request certain personal information in a structured, commonly used and machine-readable format.
14.7 Withdrawal of Consent
Where processing relies on consent, you may withdraw that consent at any time.
14.8 Automated Decision-Making
You may have rights relating to qualifying decisions based solely on automated processing.
14.9 Exercising Your Rights
To exercise your rights, please contact Aspirium using the details in Section 1.
We may request information reasonably necessary to verify your identity and authority.
We will normally respond within one month, subject to applicable legal extensions and exemptions.
14.10 Customer-Controlled Information
If your request concerns information controlled by an Aspirium customer, such as information submitted to a clinic website or included in a clinic’s mailing list, you should ordinarily contact that business directly.
Aspirium will assist the relevant customer where required by our Data Processing Agreement.
15. Complaints
If you have concerns about how Aspirium handles personal information, please contact us so that we can investigate.
You also have the right to complain to the Information Commissioner’s Office.
Information Commissioner’s Office
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
If you live or work outside the United Kingdom, you may also have rights to contact another relevant supervisory authority.
16. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in:
Applicable law.
Our Services.
Technology providers.
Data processing activities.
Security arrangements.
Business operations.
The current version will be published on our website with its effective date.
Where changes materially affect how personal information is processed, we will provide additional notice where appropriate or legally required.
Previous versions may be requested where available.
Related Legal Documents
Contact Information
ASPIRIUM LTD
Company number: 16989063
ICO registration: ZC245198
71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom
Website: https://aspirium.co.uk
End of Privacy Policy.