Privacy & Data Protection Policy 

1. Introduction 

Minds That Work Ltd is committed to protecting the privacy and personal information of our clients,  website visitors, delegates, coaching participants and business contacts. 

We process personal information in accordance with the UK General Data Protection Regulation (UK  GDPR), the Data Protection Act 2018 and other applicable data protection legislation. 

This policy explains what information we collect, how we use it, how long we retain it, and the procedures  we follow to protect personal information. 

2. Privacy Notice 

Who We Are 

Minds That Work Ltd provides workplace wellbeing consultancy, training, facilitation, coaching and related  services to organisations and individuals. 

For the purposes of UK data protection legislation, Minds That Work Ltd is the Data Controller for the  personal information described in this notice. 

Contact Details 

Victoria Brookbank 

Director, Minds That Work Ltd 

Email: victoria@mindsthatwork.com

Address: 5 Ducketts Wharf, Hertfordshire, CM23 3AR, United Kingdom 

Company Number: 13998990 

Website: www.mindsthatwork.com

Information We Collect 

We may collect: 

• Name 

• Job title 

• Organisation name 

• Email address 

• Telephone number 

• Billing information 

• Training attendance information 

• Coaching appointment information 

• Website enquiry details 

• Information voluntarily provided through forms, surveys or questionnaires 

In limited circumstances, Minds That Work Ltd may process special category personal data, including  health and wellbeing information, where individuals voluntarily provide such information and where it is  necessary for the delivery of coaching, training, wellbeing or menopause-related services. 

Why We Process Personal Information

We process personal information to: 

• Respond to enquiries 

• Deliver training and consultancy services 

• Manage coaching appointments 

• Administer contracts and client relationships 

• Process payments and invoices 

• Send information requested by individuals 

• Improve our services 

• Comply with legal obligations 

Lawful Basis for Processing 

Depending on the circumstances, we process information under one or more of the following lawful bases:

Contract 

Legitimate interests 

Consent 

Legal obligation 

Sharing Information 

Minds That Work Ltd does not sell personal information to third parties. 

Personal information may be shared with carefully selected service providers where necessary to deliver services or operate the business.

These providers may include: 

• Microsoft Teams 

• Zoom 

• Squarespace 

• Stripe 

• Google Analytics 

• Professional advisers including accountants, insurers and legal advisers where required 

All third-party providers are expected to maintain appropriate security measures and process personal  information in accordance with applicable data protection legislation. 

Individual Rights 

Individuals have the right to: 

• Access their personal information 

• Request correction of inaccurate information 

• Request deletion of information where appropriate 

• Restrict processing in certain circumstances 

• Object to processing 

• Lodge a complaint 

Requests should be sent to victoria@mindsthatwork.com. 

3. Data Protection Complaints Procedure 

How to Make a Complaint 

If you have concerns about how your personal information has been handled, please contact: Email: victoria@mindsthatwork.com

Please provide: 

• Your name and contact details 

• Details of the concern 

• Any relevant dates or supporting information

What Happens Next 

Minds That Work Ltd will: 

• Acknowledge receipt of your complaint within 30 days 

• Investigate the matter promptly 

• Keep you informed where appropriate 

• Provide a written response once the investigation is complete 

Escalating a Complaint 

If you remain dissatisfied after receiving our response, you may contact the Information Commissioner's Office (ICO): 

https://ico.org.uk/make-a-complaint/

4. Data Retention Schedule 

- Website enquiries – 24 months 

- Client contact information – Duration of relationship plus 6 years 

- Consultancy contracts and proposals – 6 years 

- Training attendance records – 6 years 

- Coaching records and notes – 12 months after completion unless a longer period is required by contract - Wellbeing questionnaire responses – 12 months after programme completion 

- Marketing subscription records – Until consent is withdrawn 

- Financial records, invoices and payment information – 6 years 

- Website analytics data – In accordance with Google Analytics retention settings

5. Data Breach Procedure 

A personal data breach is any incident resulting in accidental or unlawful loss, destruction, alteration,  unauthorised disclosure of, or access to, personal information. 

If a Breach Occurs 

Minds That Work Ltd will: 

1. Identify and contain the breach. 

2. Assess the nature and extent of the incident. 

3. Record details of the breach. 

4. Assess potential risks to affected individuals. 

5. Notify the Information Commissioner's Office where required. 

6. Notify affected individuals where legally required. 

7. Take steps to prevent recurrence. 

Reporting to the ICO 

Where a breach is likely to result in a risk to individuals' rights and freedoms, Minds That Work Ltd will  report the breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. 

6. Policy Review 

This policy is reviewed annually and updated where necessary to reflect changes in legislation, ICO  guidance, technology, business operations and services delivered by Minds That Work Ltd. 

Version: 1.0 

Effective Date: July 2025 

Next Review Date: July 2026