Otta ("Otta", "we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, share, and protect your personal information when you visit our website or get in touch with us, and it explains your rights under data protection law. Otta is a trading name of Flux Agency, a general partnership established in England and Wales, and we are the controller of the personal information described in this policy.

This policy covers personal information we handle as a controller, mainly information about visitors to our website and people who contact or work with us. Where we process personal information on behalf of our clients in delivering our services, we act as a processor, and that processing is governed by our services agreement with the client. See section 11.

1. Who We Are

Otta is a specialist social media agency for health brands, operated by Flux Agency. We are the controller responsible for your personal information as described in this policy.

2. The Information We Collect

We collect personal information in three main ways:

• Information you give us directly. When you complete a contact or enquiry form, request a proposal, sign up to our mailing list, apply for a role, or otherwise communicate with us, we may collect your name, email address, phone number, company name, role, and the content of your messages.

• Information we collect automatically. When you visit our website, we and our partners collect technical and usage information through cookies and similar technologies, such as your IP address, device and browser type, operating system, the pages you view, the links you click, and how you reached and moved through our site. See section 4.

• Information from third parties. We may receive information from analytics and advertising providers, social media platforms, and other sources, for example where you interact with our ads or content, and we may combine this with information we already hold.

We do not seek to collect special category data, such as health information, from website visitors. Please do not send us sensitive personal information through our website forms.

3. How We Use Your Information and Our Lawful Bases

We use your personal information to run our website, respond to your enquiries, provide and improve our services, manage our relationship with you, send you marketing where permitted, and meet our legal obligations. Under the UK GDPR we must have a lawful basis for each use. Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, we have weighed those interests against your rights, and you can object as set out in section 10.

4. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. Some are essential to make the site work. Others are optional and help us understand how the site is used and make our advertising more relevant. We use:

• Essential cookies, which are needed for the site to function.

• Analytics cookies, such as Google Analytics, which help us measure traffic and usage.

• Advertising cookies, such as those from Meta and Google, which help us deliver and measure advertising.

We ask for your consent to non-essential cookies through our cookie banner when you first visit, and you can change your choices at any time through the banner or your browser settings. Blocking some cookies may affect how the site works.

5. How We Share Your Information

We do not sell your personal information. We share it only as follows:

• Service providers that process information on our behalf, such as website hosting, analytics, email and CRM, and payment providers, under contracts that require them to protect it.

• Advertising and social media partners, where you have consented to advertising cookies, to deliver and measure advertising.

• Professional advisers, such as our accountants and lawyers, where needed.

• Authorities or other third parties where required by law, to enforce our terms, or to protect the rights, property, or safety of Otter or others.

• A buyer or successor in the event of a sale, merger, or reorganisation of our business.

We may also share information in aggregated or anonymised form that does not identify you.

6. Marketing and Communication Preferences

Where we send you marketing, you can opt out at any time using the unsubscribe link in our emails or by contacting us. You cannot opt out of service messages that we need to send about your engagement, such as account or security notices.

7. International Data Transfers

We are based in the UK. Where your personal information is transferred outside the UK, for example because a service provider is located elsewhere, we make sure it is protected by an appropriate safeguard recognised under UK data protection law, such as an adequacy decision or the UK's International Data Transfer Agreement or Addendum.

8. How Long We Keep Your Information

We keep personal information only for as long as we need it for the purposes set out in this policy, including to meet legal, accounting, or reporting requirements. When we no longer need it, we delete or anonymise it. Enquiry and marketing data is generally kept while you remain engaged with us and for a reasonable period afterwards.

9. How We Protect Your Information

We use appropriate technical and organisational measures to protect your personal information, including access controls and encryption in transit. Payment information is handled by our payment provider and is not stored by us. No system is completely secure, but if a breach affects your information we will take the steps required by law, including notifying you and the ICO where appropriate.

10. Your Rights

Under UK data protection law you have the right to access your personal information, have it corrected, have it erased in certain circumstances, restrict or object to our processing, obtain a copy in a portable format, and withdraw consent where we rely on it. To exercise these rights, contact us, and we will respond within the time limits set by law. You also have the right to complain to the ICO at ico.org.uk, though we would welcome the chance to address your concerns first.

11. Information We Process on Behalf of Clients

When we deliver our services, we process personal information on behalf of our clients, for example in managing their social media and advertising. In that case our client is the controller and we act as a processor on their documented instructions, under the data protection terms in our services agreement. This policy does not govern that processing, and any requests about it should be directed to the relevant client. Where any special category data, such as health information, is involved, it is processed only on the client's instructions and under those terms.

12. Children's Privacy

Our website and services are intended for businesses, not for children. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us their information, contact us and we will delete it.

13. Links to Other Websites

Our website may link to third-party websites and platforms that we do not control. We are not responsible for their privacy practices, and we recommend you read their policies before sharing your information with them.

14. Changes to This Policy

We may update this policy from time to time. When we make a material change, we will update the date at the top and, where appropriate, let you know. Continuing to use our website after a change means you accept the updated policy.

15. How to Contact Us

If you have any questions about this policy or about how we handle your personal information please contact us.