Privacy Policy
Last updated: June 2026 · Compliant with UK GDPR and the Data (Use and Access) Act 2025
1. Who we are
Mind Body and Sea CIC (Companies House no. 15745696) is the data controller responsible for the personal data described in this notice.
- Registered office: 28 Birchwood Drive, Rushmere St Andrew, Suffolk, IP5 1EB
- Email: info@mindbodyandsea.co.uk
- Phone: 01394 773 027
- Senior Responsible Individual (under the Data (Use and Access) Act 2025): the named director of Mind Body and Sea CIC. Contact via the email above.
- ICO registration: we are in the process of registering with the UK Information Commissioner’s Office. Our registration number will be added here once issued.
2. What personal data we collect, and why
We collect personal data only in the situations below.
| Activity | Data collected | Lawful basis (UK GDPR Art. 6) | Retention |
|---|---|---|---|
| Referral form | Name, contact details, information about the referred participant | Art. 6(1)(b) — performance of an agreed service; Art. 9(2)(g) — substantial public interest where health information is shared | 12 months |
| Volunteer enquiry | Name, contact details, background information | Art. 6(1)(b) — pre-contractual steps at your request | 12 months |
| Post-session feedback | Comments and any optional contact details | Art. 6(1)(f) — legitimate interest in improving the service | 12 months |
| Direct contact (email or phone) | Whatever you choose to share | Art. 6(1)(f) — legitimate interest in responding to enquiries | Up to 24 months |
| Visit-counter tracking pixel (only with your consent) | IP address, browser type, page visited | Art. 6(1)(a) — your consent, withdrawable at any time | Aggregated stats kept indefinitely; raw logs purged by Metricool within 14 months |
3. Cookies and tracking
This site uses one small tracking pixel — Metricool — to count how many people visit each page. We do not load this pixel unless you click “Accept” in the cookie banner shown on your first visit. If you choose Decline, no tracking happens, and the site continues to work normally.
You can change your mind at any time using the Cookie preferences link in the footer of every page.
The Metricool pixel does not set any cookies on your device. It records your IP address, browser type, and the page you visited, so we can understand which content is helpful and which isn’t.
4. Who we share your data with
We do not sell your data to anyone. We share it only with the following processors, all bound by written data processing agreements (DPAs) with us:
- Tally (tally.so) — based in Belgium (EU). Hosts our referral, volunteer, and feedback forms. Tally privacy policy.
- Metricool — based in Spain (EU). Visit-counter only, and only with your consent. Metricool privacy policy.
- Cloudflare — the CDN that delivers this website. May briefly log IP addresses for security and abuse prevention. Cloudflare privacy policy.
5. International transfers
All of our service providers above are based in the European Union or operate under transfer mechanisms recognised by the UK (UK adequacy decisions, Standard Contractual Clauses, or the EU–US Data Privacy Framework where applicable). We do not knowingly transfer your personal data outside the UK or the EEA without an appropriate safeguard.
6. Your rights
Under the UK GDPR and the Data Protection Act 2018, you have the right to:
- Ask for a copy of the personal data we hold about you (right of access)
- Ask us to correct inaccurate data (right to rectification)
- Ask us to delete your data when there is no good reason for us to keep it (right to erasure)
- Ask us to restrict our use of your data while a dispute is being resolved
- Ask for your data in a portable format (right to data portability)
- Object to our use of your data where we rely on legitimate interests
- Withdraw consent at any time, where consent is the lawful basis (including the tracking pixel)
To exercise any of these rights, email info@mindbodyandsea.co.uk. We will respond within one calendar month.
7. Automated decision-making
We do not use any form of automated decision-making, profiling, or AI to make decisions about you.
8. Marketing
We do not send marketing emails or SMS. If we ever begin to in the future, we will only contact people who have given specific, freely-given opt-in consent at the point of collection, and every message will carry a working unsubscribe link.
9. Children’s data
Where a referral concerns a child or young person, the referral is made by an adult professional (a teacher, carer, social worker, parent, or guardian). We process this data only for the purpose of delivering the agreed activity, in accordance with our published Safeguarding Children policy.
10. Right to complain
If you are concerned about how we have handled your data, please contact us first so that we can try to resolve it. You also have the right to complain directly to the UK Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
11. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top of this page reflects the most recent revision. Significant changes will be flagged on the homepage for at least 14 days.