Privacy & Data Protection Policy
Organisation: Minds That Work Ltd
Last Updated: June 18th, 2026
1. Introduction
Minds That Work Ltd is committed to protecting the privacy and personal information of our clients, website visitors, delegates, coaching participants and business contacts.
We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.
This policy explains what information we collect, how we use it, how long we retain it, and the procedures we follow to protect personal information.
2. Privacy Notice
Who We Are
Minds That Work Ltd provides workplace wellbeing consultancy, training, facilitation, coaching and related services to organisations and individuals.
For the purposes of UK data protection legislation, Minds That Work Ltd is the Data Controller for the personal information described in this notice.
Contact Details
Victoria Brookbank
Director, Minds That Work Ltd
Email: victoria@mindsthatwork.com
Address: 5 Ducketts Wharf, Hertfordshire, CM23 3AR, United Kingdom
Company Number: 13998990
Website: www.mindsthatwork.com
Information We Collect
We may collect:
• Name
• Job title
• Organisation name
• Email address
• Telephone number
• Billing information
• Training attendance information
• Coaching appointment information
• Website enquiry details
• Information voluntarily provided through forms, surveys or questionnaires
In limited circumstances, Minds That Work Ltd may process special category personal data, including health and wellbeing information, where individuals voluntarily provide such information and where it is necessary for the delivery of coaching, training, wellbeing or menopause-related services.
Why We Process Personal Information
We process personal information to:
• Respond to enquiries
• Deliver training and consultancy services
• Manage coaching appointments
• Administer contracts and client relationships
• Process payments and invoices
• Send information requested by individuals
• Improve our services
• Comply with legal obligations
Lawful Basis for Processing
Depending on the circumstances, we process information under one or more of the following lawful bases:
Contract
Legitimate interests
Consent
Legal obligation
Sharing Information
Minds That Work Ltd does not sell personal information to third parties.
Personal information may be shared with carefully selected service providers where necessary to deliver services or operate the business.
These providers may include:
• Microsoft Teams
• Zoom
• Squarespace
• Stripe
• Google Analytics
• Professional advisers including accountants, insurers and legal advisers where required
All third-party providers are expected to maintain appropriate security measures and process personal information in accordance with applicable data protection legislation.
Individual Rights
Individuals have the right to:
• Access their personal information
• Request correction of inaccurate information
• Request deletion of information where appropriate
• Restrict processing in certain circumstances
• Object to processing
• Lodge a complaint
Requests should be sent to victoria@mindsthatwork.com.
3. Data Protection Complaints Procedure
How to Make a Complaint
If you have concerns about how your personal information has been handled, please contact: Email: victoria@mindsthatwork.com
Please provide:
• Your name and contact details
• Details of the concern
• Any relevant dates or supporting information
What Happens Next
Minds That Work Ltd will:
• Acknowledge receipt of your complaint within 30 days
• Investigate the matter promptly
• Keep you informed where appropriate
• Provide a written response once the investigation is complete
Escalating a Complaint
If you remain dissatisfied after receiving our response, you may contact the Information Commissioner's Office (ICO):
https://ico.org.uk/make-a-complaint/
4. Data Retention Schedule
- Website enquiries – 24 months
- Client contact information – Duration of relationship plus 6 years
- Consultancy contracts and proposals – 6 years
- Training attendance records – 6 years
- Coaching records and notes – 12 months after completion unless a longer period is required by contract - Wellbeing questionnaire responses – 12 months after programme completion
- Marketing subscription records – Until consent is withdrawn
- Financial records, invoices and payment information – 6 years
- Website analytics data – In accordance with Google Analytics retention settings
5. Data Breach Procedure
A personal data breach is any incident resulting in accidental or unlawful loss, destruction, alteration, unauthorised disclosure of, or access to, personal information.
If a Breach Occurs
Minds That Work Ltd will:
1. Identify and contain the breach.
2. Assess the nature and extent of the incident.
3. Record details of the breach.
4. Assess potential risks to affected individuals.
5. Notify the Information Commissioner's Office where required.
6. Notify affected individuals where legally required.
7. Take steps to prevent recurrence.
Reporting to the ICO
Where a breach is likely to result in a risk to individuals' rights and freedoms, Minds That Work Ltd will report the breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it.
6. Policy Review
This policy is reviewed annually and updated where necessary to reflect changes in legislation, ICO guidance, technology, business operations and services delivered by Minds That Work Ltd.
Version: 1.0
Effective Date: July 2025
Next Review Date: July 2026