Privacy Policy
Version 1.0 | For blulotus.uk/legal/privacy | Prepared 12 October 2026
Last updated: October 13, 2026
Blulotus is committed to protecting your privacy. This policy explains what personal data we collect when you use our website at blulotus.uk and our Finance Pulse Check at pulse. blulotus.uk, how we use it, who we share it with, and the rights you have.
Who we are
Blulotus Limited is the data controller for the personal data described in this policy.
- Registered company name: Blulotus Limited
- Company number: 17221207
- Registered office: 66 Paul Street, London, EC2A 4NA
- Contact: contact@blulotus.uk
If you have any questions about this policy or how we handle your data, email us at the address above.
What data we collect
When you contact us
If you get in touch through our website or by email, we collect:
- your name and email address
- your company name, if you give it
- anything else you choose to include in your message
When you use the Finance Pulse Check
The Finance Pulse Check is a short online questionnaire about your finance function. If you complete it and ask for your report, we collect:
- your email address
- your answers to the questions
- your company’s annual revenue band and where it is in the investment cycle
- your score, maturity tier and the three areas we suggest you prioritise
- whether you have agreed to receive marketing from us
You can answer the questions and see your score without giving us any personal data. We only collect your email address if you choose to request the full report.
Collected automatically
When you visit our website or the Finance Pulse Check, we and our providers automatically collect:
- your IP address
- your browser type and version, device type and operating system
- the pages you visit, how long you spend on them, and the site that referred you
On our main website, this is collected through Google Analytics and cookies; see our Cookie Policy. On the Finance Pulse Check, your IP address is used to protect the form from spam and abuse, as described below.
How we use your data
We use your data to:
- respond to your enquiry or arrange a meeting with you
- email you your Finance Pulse Check report
- record your enquiry or Pulse Check result in our customer relationship management (CRM) system, so we can follow up about your results and judge whether our services may be relevant to you
- send you news, insights and information about our services, but only if you have opted in
- protect our website and forms from spam, bots and abuse
- improve our website using analytics
- comply with our legal obligations
Your Finance Pulse Check score
Your score, maturity tier and priorities are calculated automatically from your answers, using a fixed scoring method that treats every answer the same way. We use the result to write your report and to tailor any follow-up. We do not make any decisions about you based solely on automated processing that have legal or similarly significant effects.
Marketing
We only send you marketing if you tick the opt-in box on the Finance Pulse Check or otherwise agree to it. To unsubscribe at any time, email contact@blulotus.uk. Requesting your report does not sign you up for marketing.
Our legal basis for using your data
Under UK data protection law (the UK GDPR), we rely on the following:
| What we do | Legal basis |
|---|---|
| Sending the Finance Pulse Check report you asked for | Taking steps at your request (contract) |
| Responding to enquiries and taking steps before a possible contract | Contract, and our legitimate interest in responding to people who contact us |
| Recording enquiries and Pulse Check results in our CRM and following up about them | Legitimate interests: understanding who may benefit from our services and following up on their request |
| Protecting our website and forms from spam and abuse | Legitimate interests: keeping our services secure |
| Website analytics and non-essential cookies | Consent (see our Cookie Policy |
| Sending marketing | Consent, which you can withdraw at any time |
| Meeting legal, tax and accounting obligations | Legal obligation |
Where we rely on legitimate interests, we have considered your rights and do not use your data in ways you would not reasonably expect. You can object to this processing at any time (see “Your rights”).
Who we share your data with
We do not sell your personal data. We share it only with the service providers below, who process it on our behalf, under contract, and only for the purposes we set:
| Provider | What they do for us | Based in |
|---|---|---|
| Odoo SA | Our CRM: stores enquiries and Pulse Check results | Belgium (EU) |
| Resend | Sends Finance Pulse Check report emails | USA |
| Render Services, Inc. | Hosts the Finance Pulse Check | USA |
| Cloudflare, Inc. | Security check that protects the Pulse Check form from bots | USA |
| Microsoft | Our business email and documents (Microsoft 365) | UK / EU |
| Webflow, Inc. | Hosts our main website | USA |
| Google LLC | Website analytics (Google Analytics) and web fonts | USA |
| Calendly, Inc. / Cal.com | Meeting booking, if you book a call with us | USA |
We may also share data with our professional advisers, or where the law requires us to.
International transfers
Some of these providers are based outside the UK. Transfers to the EU are covered by UK adequacy regulations. For transfers to the USA and elsewhere, we rely on the UK-US Data Bridge where the provider is certified under it, or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
How long we keep your data
| Data | How long we keep it |
|---|---|
| Enquiries and Finance Pulse Check results | Up to 2 years from our last contact with you, unless we go on to work together |
| Client records | 6 years after our work ends, to meet tax and accounting rules |
| Marketing preferences | Until you unsubscribe; after that we keep a record that you opted out, so we don’t contact you again |
| Security logs (IP addresses) | Up to 30 days |
| Analytics data | Up to 14 months |
| Meeting booking data | In line with Calendly’s or Cal.com’s retention policy |
After these periods, we securely delete or anonymise your data.
Your rights
Under UK data protection law, you have the right to:
- access the personal data we hold about you
- correct data that is inaccurate or incomplete
- ask us to erase your data
- object to, or ask us to restrict, how we use your data, including objecting to marketing at any time
- receive your data in a structured, machine-readable format (data portability)
- withdraw your consent at any time, where we rely on it
To use any of these rights, email contact@blulotus.uk. We will respond within one month.
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.
Security
We use appropriate technical and organisational measures to protect your data. These include encrypted connections (HTTPS), access controls, two-step login on our business systems, and only allowing staff who need the data to see it.
Children
Our services are for businesses and are not aimed at children under 16. We do not knowingly collect children’s personal data.
Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. If we make significant changes, we will make that clear on this page.