How we handle your data.

This privacy policy explains what personal data WellBuilt. collects, how it is used, who it is shared with, and the rights you have under UK and EU data protection law. WellBuilt. is operated by Iconic CEO Limited, a company registered in England and Wales (Company No: 12223405).

Iconic CEO Limited is the data controller for any personal data collected through our WellBuilt. products and services, including the WellBuilt. Founder Reputation Operating System (the four-week course) and the WellBuilt. Founder Signal Strategy Session (the 1:1 strategic call). If you have questions about this policy or how your data is handled, email Papillon Luck directly at papillon@iamwellbuilt.com.

What we collect

The personal data we collect depends on how you interact with us.

If you sign up for our Educational Email Course or weekly newsletter: your name and email address are being collected. The Educational Email Course is delivered via Kit and includes consent to receive our weekly newsletter via Substack. You may unsubscribe from either at any time.

If you purchase a Founder Signal Strategy Session: your name, email address, phone number, billing address, answers to qualifying questions submitted via Typeform, and your timezone and chosen meeting time via Calendly are being collected. Payment is processed by Stripe; card details are handled directly by Stripe and never reach our systems.

If you purchase a WellBuilt. digital product (including the WellBuilt. programme): your name, email address, billing address, and the responses you provide at checkout are being collected. Card details are processed by Stripe (or Klarna or Clearpay if you choose to pay in instalments) and never reach our systems.

If you participate in the WellBuilt. community: your name, email address, and any content you post in the Slack community or share within the Kajabi learning platform.

If you email us directly: your email address and the content of the message.

Why we collect it and our lawful basis

We collect personal data only where there is a clear and lawful basis for doing so under UK GDPR.

• To deliver services you have purchased. Lawful basis: performance of a contract.
• To send the educational email course and weekly newsletter to people who have opted in. Lawful basis: consent.
• To process payments and prevent fraud. Lawful basis: performance of a contract and legitimate interest.
• To send marketing communications to past WellBuilt. buyers about new products, updates and related services. Lawful basis: legitimate interest, with an unsubscribe option in every email.
• To respond to direct enquiries. Lawful basis: legitimate interest.
• To comply with legal obligations, including HMRC record-keeping requirements. Lawful basis: legal obligation.

Who we share data with

We use trusted third-party service providers (data processors) to operate our services. Each provider processes data on our behalf under written data processing agreements that comply with UK GDPR. We do not sell your personal data to anyone.

International transfers

Several of the providers above are based outside the UK and EU, primarily in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards including the UK International Data Transfer Agreement and EU Standard Contractual Clauses approved by the European Commission. Each provider listed maintains UK GDPR-compliant practices through these mechanisms.

How long we keep your data

• Transaction records: retained for 7 years to comply with HMRC accounting requirements.
• Marketing list (email subscribers): retained until you unsubscribe, with periodic engagement-based cleaning to remove inactive contacts.
• WellBuilt. course content access: retained for as long as your enrolment remains active. Course materials remain accessible to you indefinitely through the Kajabi platform unless you request deletion.
• Slack community access: retained for as long as your membership is active.
• Personal data on request to delete: removed within 30 days of a verified request, except where retention is legally required (for example, transaction records).

Your rights under UK GDPR

You have the following rights regarding your personal data:

• The right to be informed about how we use your data, which this policy provides.
• The right of access to a copy of the personal data we hold about you.
• The right to rectification if any data we hold is inaccurate or incomplete.
• The right to erasure (the right to be forgotten), subject to legal retention obligations.
• The right to restrict processing in certain circumstances.
• The right to data portability for the data you have provided to us.
• The right to object to processing carried out on the basis of legitimate interest, including direct marketing.
• The right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of any prior processing.

To exercise any of these rights, email papillon@iamwellbuilt.com. We will respond to legitimate requests within one month. Occasionally it may take longer if your request is particularly complex or you have made a number of requests, in which case we will notify you.

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive, or refuse to comply with your request in those circumstances. We may also need to request specific information from you to confirm your identity before fulfilling a data request. This is a security measure to ensure personal data is not disclosed to anyone without the right to receive it.

Marketing communications

If you sign up for the educational email course, you consent to receive that course and our weekly newsletter. You can unsubscribe at any time using the link in every email.

If you purchase WellBuilt., we may send you occasional marketing emails about new products, updates and Founder Signal Strategy Session availability, under the lawful basis of legitimate interest. Every marketing email contains a clear unsubscribe option.

Security

We take the security of your personal data seriously. All data is held in encrypted form by our processors, who maintain SOC 2 or equivalent security standards. We do not store payment card details on our own systems at any point.

Children

WellBuilt. and our Founder Signal Strategy Session services are intended for business owners and founders aged 18 or over. By providing us with your data, you warrant that you are at least 18 years of age. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, please contact us so we can delete it.

Complaints

If you have a complaint about how your data is handled, please contact us first at papillon@iamwellbuilt.com and we will work to resolve it. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

Changes to this policy

We may update this privacy policy from time to time, particularly when we add new tools or change how data flows through our systems. Any material changes will be reflected in the effective date below, and registered subscribers will be notified by email where required.