Last updated: 17 September 2026
This policy explains how BAAMP LTD and BAAMP LLC (“BAAMP”, “we”, “us”) comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and sets out your rights over your personal data. It should be read together with our Privacy Policy and Cookie Policy.
Data controller and ICO registration
BAAMP LTD, a company registered in England and Wales under company number 16794021, with its registered office at Flat 102, Watermans Quay, William Morris Way, London SW6 2UW, is the data controller of your personal data. Our US affiliate, BAAMP LLC, supplies our programmes to customers in the United States.
BAAMP LTD is registered with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, under registration reference ZC229343. You can view our entry on the ICO’s public register at https://ico.org.uk/ESDWebPages/Search.
Our Data Protection Officer can be contacted at dpo@baampwellness.com or by post at the address above.
Our data protection principles
We are committed to processing your personal data in line with the UK GDPR. This means your data will be:
- processed lawfully, fairly and transparently;
- collected only for specified, explicit and legitimate purposes;
- adequate, relevant and limited to what is necessary;
- accurate and, where necessary, kept up to date;
- kept only for as long as necessary; and
- kept secure, using appropriate technical and organisational measures.
Our lawful bases for processing
We only process your personal data where we have a lawful basis to do so. The lawful bases we rely on are:
| Lawful basis | When we rely on it |
|---|---|
| Contract | To process and deliver your orders, manage your account, handle returns and refunds, and send service messages about your order. |
| Legitimate interests | To prevent fraud, keep the Website secure (including using Google reCAPTCHA on our forms), provide customer service, improve our products and services, and send marketing about similar products to existing customers (with an opt-out every time). |
| Consent | To send marketing emails to non-customers, send basket reminder emails, and use analytics and marketing cookies. |
| Explicit consent (health information) | To process your questionnaire answers and information you share during coaching, which may reveal information about your health and drinking habits. This is special category data and needs your explicit consent under Article 9 of the UK GDPR. |
| Legal obligation | To keep financial and transaction records for tax and accounting purposes, and to respond to lawful requests from authorities. |
Where we rely on legitimate interests, we have carried out a balancing test to make sure your interests and rights do not override ours. A copy is available on request from dpo@baampwellness.com.
Your rights
Under the UK GDPR you have the following rights. You can exercise any of them free of charge by emailing dpo@baampwellness.com.
The right to be informed
You have the right to clear information about how we use your personal data. That is the purpose of this policy, our Privacy Policy and our Cookie Policy.
The right of access
You have the right to obtain a copy of the personal data we hold about you. This is usually free of charge. If a request is manifestly unfounded, excessive or repetitive, we may charge a reasonable fee or refuse the request. If we refuse, we will explain why and tell you about your right to complain to the ICO.
The right to rectification
You have the right to have inaccurate, outdated or incomplete data about you corrected. You can update many of your details yourself in your account, or contact us to do it for you.
The right to erasure
You have the right to ask us to delete your personal data where there is no good reason for us to keep processing it. We will also tell any third parties we have shared it with, so they can delete it too. In some cases we cannot delete all of your data, for example where we must keep it for tax purposes.
The right to restrict processing
You have the right to ask us to restrict how we use your personal data, for example while we check whether it is accurate. We will tell any third parties we have shared it with.
The right to data portability
You have the right to receive the personal data you have given us in a structured, commonly used, machine-readable format, and to ask us to send it to another organisation where technically possible.
The right to object
You have the right to object to us processing your personal data where we rely on legitimate interests. You have an absolute right to object to direct marketing; if you do, we will stop sending you marketing.
The right to withdraw consent
Where we rely on your consent, such as for marketing emails or analytics cookies, you can withdraw it at any time. You can do this by unsubscribing from any of our emails, updating your account preferences, changing your cookie settings, or contacting us. Please allow a few days for our systems to update. Withdrawing consent does not affect processing that happened before you withdrew it. If you withdraw consent to us processing your health information, we will delete your questionnaire responses and coaching notes unless we are legally required to keep them.
Rights relating to automated decision-making
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
How we handle your requests
We will respond to your request without undue delay and within one month of receiving it. If your request is complex or you make several requests, we may extend this by up to two further months; if so, we will tell you within the first month and explain why.
To protect your data, we may need to ask you for proof of identity before we act on your request.
International transfers
Some of our service providers are located outside the UK, including in the European Economic Area, the United States, Canada and India. Where we transfer your personal data outside the UK, we make sure it is protected by at least one of the following safeguards:
- the destination country has been found by the UK Government to provide an adequate level of protection (for example the EEA and Canada);
- the recipient is certified under the UK Extension to the EU-US Data Privacy Framework (“UK-US Data Bridge”);
- we have put in place the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses; or
- another exception permitted by UK data protection law applies.
Details of our main service providers and the safeguards that apply are listed in the “Who we share your data with” section of our Privacy Policy. You can request a copy of the relevant safeguards by emailing dpo@baampwellness.com.
Data security and breaches
We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls and contracts with our service providers requiring them to keep your data secure.
If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will report it to the ICO within 72 hours of becoming aware of it, where required. If the breach is likely to put you at high risk, we will also tell you without undue delay.
Complaints
If you have a concern about how we have handled your personal data, we would like the opportunity to address it directly before you contact the ICO.
How to raise a complaint with us
Please email dpo@baampwellness.com and include:
- your name and contact details;
- a description of your concern; and
- any relevant reference numbers or correspondence.
What happens next
- We will acknowledge your complaint within 5 business days.
- We will investigate and give you a full response within 30 days of receipt, or explain why more time is needed if the matter is complex.
- Our response will set out our findings and, where applicable, any steps we will take as a result.
If you are not satisfied
If you are unhappy with our response, or we have not responded within the timeframe above, you have the right to lodge a complaint with the UK Information Commissioner’s Office. For more information, visit https://ico.org.uk/make-a-complaint/ or call 0303 123 1113.
Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last updated.
