Privacy Policy

1. Who we are

The Mood Booster Ltd ("we", "us", "our") is the data controller responsible for your personal data.

• Company: The Mood Booster Ltd, registered in England and Wales, company number 16899651.
• Registered office: 23 Western Gardens, London, England, W5 3RS.
• ICO registration number: [ICO registration number].
• Contact for data matters: hello@themoodbooster.co.uk.

2. The short version

We only collect data we genuinely need: to send our newsletter if you ask for it, to handle certification enquiries and applications, to run our certification programme for the businesses we work with, and to reach out to organisations who may be a good fit. We do not use tracking or advertising cookies, we do not sell your data, and you can ask us to show, correct or delete your data at any time.

3. What we collect, why, and our lawful basis

Newsletter subscribers

If you sign up to our newsletter we collect your email address, and your name if you provide it. We use this to send you updates about The Mood Booster. Our lawful basis is your consent, which you can withdraw at any time using the unsubscribe link in any email or by emailing us. Newsletter delivery is handled by Beehiiv (see section 5).

Certification enquiries and applications

When you apply for certification or get in touch about it, we collect your business name, your name, your industry, your contact details, and the information you choose to share about your workplace and why you want to be certified. We use this to respond to you and to assess your application. Our lawful basis is taking steps at your request before entering into a contract, and our legitimate interests in running and improving our certification programme.

Managing certified businesses

For businesses we work with, we keep records needed to run the programme: application details, assessment status and notes, the tier awarded, verification and re-verification dates, and payment records once payments go live. Our lawful basis is performance of our contract with you and our legitimate interests in administering certification.

Outreach to organisations

We keep a record of organisations we contact or plan to contact about certification, including a business contact name, business contact details, and how we reached out. This is business-to-business contact activity and our lawful basis is our legitimate interests in growing the certification programme. You can object to this at any time and we will stop.

Emails and enquiries

If you email us, we keep your message and contact details so we can reply and keep a record of the conversation. Our lawful basis is our legitimate interests in responding to you.

Community activities

Some community activities, such as the Run Club, may ask you to sign a waiver or provide details separately. Where that applies, you will be told what is collected and why at the point you provide it.

Administrative access

Our private admin area uses a login and short-lived security codes to protect the data described above. This processing is based on our legitimate interests in keeping personal data secure.

4. Cookies and similar technologies

We use only essential and functional cookies and browser storage. We do not use analytics, tracking or advertising cookies. Full details are in our Cookie Policy.

5. Who we share your data with

We do not sell your personal data. We share it only with service providers who process data on our behalf under contract, and only as needed:

• Cloudflare, for website hosting, our database, and security.
• Beehiiv, for newsletter delivery, if you subscribe.
• Resend, for sending transactional and notification emails.
• Microsoft 365, for our own email accounts.
• Stripe, for handling certification payments once payments are live.

We may also disclose data where we are required to by law. Some of these providers may process data outside the UK. Where that happens, we rely on appropriate safeguards such as UK-approved standard contractual clauses or adequacy decisions.

6. How long we keep it

• Newsletter data: until you unsubscribe or ask us to remove you.
• Certification enquiries and applications: for the duration of the enquiry and for a reasonable period afterwards, then deleted if no relationship follows.
• Certified business records: for as long as the business is certified, and for up to six years afterwards to meet legal, tax and accounting obligations.
• Outreach records: until the organisation asks us to remove them, or we no longer have a business reason to keep them.
• Emails: kept only as long as needed for the matter they relate to.

7. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances;
• restrict or object to our processing;
• data portability, where it applies;
• withdraw consent at any time, where we rely on consent.

To exercise any of these, email hello@themoodbooster.co.uk. We will respond within one month. You will not usually have to pay a fee.

8. Complaints

If you have a concern, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Data security

We use appropriate technical and organisational measures to protect your data, including access controls, encryption in transit, restricted admin access, and two-step login for our admin area. No system is completely secure, but we take these responsibilities seriously.

10. Children

Our services are intended for adults and for organisations. We do not knowingly collect data from children. If you believe we have, please contact us and we will remove it.

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the date at the top of this page. Significant changes will be made clear.

12. Contact us

For anything relating to your data or this policy, email hello@themoodbooster.co.uk.