Privacy Policy - Where the Mind Grows

www.wherethemindgrows.co.uk

Last updated: 6th January 2026

1. Who we are and what this policy covers

Where The Mind Grows ("WTMG", "we", "us", "our") is a nature-led life, career and wellbeing coaching, team well-being facilitator and leadership development consultancy based in North Yorkshire, run by Jennie-Kate McQuinn [trading as Where The Mind Grows — under sole trader status]

Where the Mind Grows are the "controller" of the personal information described in this policy, which means we decide how and why it is used. We are committed to protecting your privacy and handling your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR). This aims to inform you of that.

This policy applies when you visit our website, contact us, subscribe to our newsletter, book or take part in coaching, workshops, away days, retreats or events, listen to our podcast, or otherwise deal with us. Including work we carry out with you, referred to by a third party such as your employer.

• Email: info@wherethemindgrows.co.uk

• Telephone: 07537 922458

Where the Mind Grows is ICO registered. We are not required to appoint a specific data protection officer, as a sole trader myself (JK) leads on this with any contracted collaborator or virtual assistant aware of our data handling and privacy practices.

2. The information we collect

The information we hold depends on how you deal with us.

a) Website visitors

• Technical information such as IP address, browser type, device type, pages viewed and time spent on the site.

• Cookie and similar technology data (see section 9).

b) Enquiries and discovery calls

• Name, email address, telephone number, organisation and job title (if relevant).

• Anything you tell us in your message or when you book a free discovery call or workplace consultation.

c) Individual coaching clients (Life, Well-being and Career Coaching, including "Walk my dog" remote sessions)

• Contact details, billing details, and booking and payment records.

• Coaching agreements, session notes, goals, action plans and feedback.

• Information you choose to share with us about your life, work, relationships and well-being. Because our work can involve topics such as stress, anxiety, low mood, grief or loss, this may include information about your health, which is "special category data" under data protection law. We only process this where you have chosen to share it and given us your explicit consent (see section 4). Completed on the registration form and other documents and throughout session notes. This may include emergency contact details of third parties.

d) Organisations, teams and workplace clients (Nurtured Workplaces, away days, leadership programmes, employee coaching)

• Contact details of your organisation's representatives and of programme participants.

• Contracts, invoices and correspondence.

• Booking and appointment details (where applicable)

• Session notes, evaluation forms and feedback from participants.

• For employee coaching, we will agree with you and your organisation at the outset what (if anything) is reported back. Individual session content is confidential to the participant, subject to the limits in section 8.

e) Access to Work funded coaching

• Information needed to deliver and claim for funded support, which may include your name, contact details, Access to Work reference details and information about the support agreed. This may include information about a disability or health condition, which is special category data.

f) Newsletter and free resources

• Name and email address, and information about how you interact with our emails (for example whether they were opened or links clicked).

• Where you respond to a newsletter email, we may retain the content of that.

g) Retreats, events and Wild Workspaces co-working

• Name, contact details, payment details, dietary and accessibility requirements (which may include health information), emergency contact details, and any information needed for safety and risk management on site.

• Photographs or recordings only where you have been told and (where required) have agreed.

• Reasons for attending and any correspondence and questions we may have between each other as part of the retreat or event.

h) Podcast, social media and testimonials

• If you contact us through social media, we receive the information you send and your public profile details.

• If you give us a testimonial, we hold your name, role or organisation and your words, and only publish them with your permission.

• If you leave feedback about our podcast or services this may be visible depending on your own settings. This includes google reviews where you leave your name and details in association with Where the Mind Grows review.

3. How we get your information

Mostly directly from you, for example when you fill in a form, email or phone us, book through our online booking tools, subscribe to our newsletter, or take part in a session. We may also receive information from your employer or organisation (if they have commissioned our services), from a contracted lead (for example someone who funds and coordinates work or projects for you to attend and uses there own booking form), from Access to Work (where you are receiving funded support), and from technology providers that operate our website and booking systems.

4. Why we use your information and our lawful bases

Under UK GDPR we must have a lawful basis for using your personal information. Ours are set out below.

Lawful basis

Where we rely on consent, you can withdraw it at any time by contacting us. Withdrawing consent does not affect the lawfulness of what we did before you withdrew, and in a coaching relationship it may affect our ability to continue working together in the way we agreed.

Where consent is drawn for photography used we cannot guarantee that we can remove this or testimonial evidence, beyond that in our control to change remove.

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights and freedoms, and you have the right to object (see section 10).

5. Who we share your information with

We do not sell your personal information. We only share it where necessary, with:

• Service providers (processors) who help us run WTMG, under written terms requiring them to protect your data. These currently include:

◦ Wix.com: website hosting, forms and site analytics.

◦ Calendly: discovery call and consultation booking.

◦ MailerLite: newsletter delivery and contact forms.

◦ Zoom (or similar video-conferencing platforms): online coaching sessions.

◦ Payment providers and accountants or bookkeepers: taking payments and keeping accounts. [Stripe, PayPal, SumUp, Monzo, Xero, The Sustainable Bookeeper.]

◦ Email, cloud storage and IT providers: for example [Google Workspace / Microsoft 365/remarkable]. Password protection is used.

◦ Event Collaborators [ following contracted agreement of our policies and procedures for compliance]

Whatsapp & Messenging services Where you contact us/exchange messaging and notes via these means.

• Your employer or commissioning organisation, where they have arranged coaching or a programme for you, but only what we have agreed with you and them in advance. It is unlikely we will discuss your session unless you gave us permission or there is a safeguarding need and your employer/funded is part of the duty of care decision making.

• Access to Work / the Department for Work and Pensions, where you receive funded coaching, to the extent needed to deliver and claim for the support. We do not share the session content.

• Professional bodies and supervisors. As a coaching professional I may discuss my work with a qualified coaching supervisor & mentor for reflective practice and quality assurance. Client details are anonymised wherever possible and never shared in a way that identifies you without your consent, unless section 8 applies.

• Professional advisers and insurers, where needed for advice, insurance or legal claims.

• Regulators, law enforcement or other authorities, where we are legally required to or the law permits.

• Social media platforms, if you interact with us on them. Their own privacy policies apply to that activity.

6. International transfers

Some of our providers (for example Wix, Calendly, MailerLite and Zoom) may process data outside the UK, including in the United States or the EU. Where they do, we rely on safeguards recognised under UK law, such as the UK's adequacy regulations for the country concerned, the UK-US Data Bridge (for certified US organisations), or the ICO's International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. You can contact us for more information about the safeguards in place.

7. How long we keep your information

We keep information only for as long as we need it for the purposes above. Our current approach is:

We then securely delete or anonymise the information.

8. Confidentiality and its limits

What you share with us in coaching is confidential. There are limited situations in which I may need to share information without your consent. These are where I believe there is a serious risk of harm to you or someone else, where a child or vulnerable adult may be at risk, or where I am legally required to (for example a court order or in connection with the prevention or detection of serious crime). Where possible and safe, I will talk to you first. We will also cover this in your coaching agreement. This may also be required where the information is requested by the police for legal reasons, with consent required to release this where possible.

9. Cookies and similar technologies

Our website is built with Wix, which uses cookies and similar technologies to make the site work, keep it secure, remember preferences, and (where you agree) analyse how the site is used and support marketing. Embedded content such as our podcast player (Spotify), booking widgets and social media links may also set their own cookies.

• Strictly necessary cookies do not need your consent.

• Analytics, functional and marketing cookies are only used with your consent, except where the law allows otherwise (for example certain low-risk analytics used to improve the site). You can accept, decline or change your choices using the cookie banner on the site and you can also block or delete cookies in your browser settings.

[ Wix Analytics, Google Analytics.]

10. Your rights

Under UK data protection law you have the right to:

• Be informed about how your data is used (this policy).

• Access a copy of the personal information we hold about you.

• Rectification: ask us to correct inaccurate or incomplete information.

• Erasure: ask us to delete your information in certain circumstances.Please do this in writing/email.

• Restrict how we use your information in certain circumstances.

• Data portability: receive certain information you provided in a structured, machine-readable format.

• Object to processing based on legitimate interests or for direct marketing (we will always stop direct marketing if you ask).

• Withdraw consent at any time where we rely on it.

• Not be subject to solely automated decisions with legal or similarly significant effects. We do not carry out this type of decision-making.

To exercise any of these rights, contact us using the details in section 1. We may need to verify your identity, and we will respond within one month (this can be extended by up to two further months for complex requests, in which case we will tell you). There is normally no charge.

11. Marketing and newsletters

We will only send you our newsletter and marketing emails if you have subscribed or (for existing clients) if it relates to similar services and you have not opted out. Every email includes an unsubscribe link, and you can also email us at any time to opt out.

12. Keeping your information secure

We take appropriate technical and organisational steps to protect your information, including using reputable providers, access controls and strong passwords, [encryption and two-factor authentication where available], keeping paper records (if any) locked away, and limiting access to those who need it. No system is completely secure, so if you have any concerns about the security of your information, please contact us. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office and, where required, you.

13. Children

Our services are aimed at adults and organisations. We do not knowingly collect personal information from anyone under 18. If you believe we have done so, please contact us and we will delete it. Where we provide support to a young person, we seek consent for data sharing and provision from the care giver. We do not add young people to our marketing lists.

14. Links to other websites

Our website links to other sites and services (for example social media, Spotify, Calendly and partner or membership organisations). We are not responsible for their content or privacy practices, so please read their privacy policies.

15. Complaints

If you are unhappy with how we have handled your information, please contact us first at info@wherethemindgrows.co.uk so we can try to put things right. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk/make-a-complaint/

• Telephone: 0303 123 1113

• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

16. Changes to this policy

We may update this policy from time to time. The latest version will always be on our website with the "last updated" date at the top. If we make significant changes, we will let you know where appropriate (for example by email to subscribers or clients).

Many Thanks

JK McQuinn - Where the Mind Grows

You can download a copy of this here.