MOSAIC ACADEMY
Get in touch
Policies

Privacy Policy

Last updated: 20 October 2026

This privacy notice tells you what to expect us to do with your personal information.

Contact details

Email: katie@mosaicacademy.co.uk
Telephone: 07708 082838
ICO registration number: ZC243351 (registered 09 September 2026, expires 08 September 2027)

What information we collect, use, and why

We collect or use the following information to provide and improve products and services for clients:

  • Names and contact details
  • Occupation
  • Transaction data (including details about payments to and from you and details of products and services you have purchased)
  • Usage data (including information about how you interact with and use our website, products and services)
  • Information relating to compliments or complaints
  • Audio recordings (eg calls)
  • Records of meetings and decisions
  • Website user information

We collect or use the following personal information for information updates or marketing purposes:

  • Names and contact details
  • Website and app user journey information

We collect or use the following personal information for photography, testimonials and marketing content:

  • Photographs and images of individuals taken at training sessions or events
  • Testimonials and quotes, including name and organisation where provided

We collect or use the following personal information for dealing with queries, complaints or claims:

  • Names and contact details
  • Purchase or service history

Lawful bases and data protection rights

Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:

  • Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    • We collect and use client contact details (name, email address, phone number, job role and company name where relevant) to deliver AI training courses and workshops, communicate about bookings, and improve the quality and relevance of our services over time. This processing benefits clients directly - it allows us to tailor training to their needs, follow up with relevant course information, and provide a more effective learning experience. It also allows us to develop and refine our course content based on what we learn from working with clients. We only collect the minimum information needed. The data involved is not sensitive, and clients would reasonably expect us to hold and use their contact details in connection with a service they have engaged with. The benefits to both parties outweigh any minimal risk to individuals.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for information updates or marketing purposes are:

  • Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    • We use contact details to send relevant updates about courses, workshops, and AI training resources to three groups: existing clients; individuals who have expressed an interest in our services or been introduced through a mutual contact with their permission; and organisations we contact directly as part of outreach to potential corporate clients. For individuals, we only make contact where there is a prior connection or expressed interest. For corporate outreach, we contact organisations where we have a legitimate business reason to believe our services may be relevant to them. This is a standard and expected practice in a B2B context. We do not purchase contact lists. People can opt out of any communications at any time and we honour all such requests promptly. The data involved is limited to professional contact information. The potential benefit (access to relevant AI training that supports professional development and organisational capability) is proportionate to the minimal privacy impact of receiving a single outreach communication.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful basis for collecting or using personal information for photography, testimonials and marketing content is:

  • Consent - we ask for your permission before publishing photographs taken at our sessions or before publishing a testimonial in your name. Testimonial consent is collected via our post-session feedback form. For photography, participants are informed at the start of sessions and given the opportunity to opt out. You can withdraw your consent at any time by contacting katie@mosaicacademy.co.uk and we will remove the relevant content promptly.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

  • Contract - we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
  • Legitimate interests - we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
    • When individuals or organisations contact us with queries, complaints, or claims, we need to retain their contact details and the details of their communication in order to respond effectively and resolve the matter. For existing clients, this is closely connected to our contractual relationship. For prospective clients or other contacts who have not yet engaged our services, we retain only the information necessary to address their specific query and would reasonably expect to do so. It allows us to provide a timely, accurate response and resolve issues fairly and accurately. The information involved is limited to professional contact details and the content of the communication itself. It is not shared beyond what is necessary, and it is not retained once the matter is resolved unless there is an ongoing reason to keep it.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Automated decision-making

We do not make any automated decisions about you or use profiling.

Where we get personal information from

  • Directly from you
  • Publicly available sources
  • Third parties:
    • Mutual contacts or professional connections who have introduced an individual to us and confirmed that the individual is happy to be contacted.

How long we keep information

  • Enquiries that don't turn into work: 12 months
  • Client records: In order to comply with HMRC sole trader business record retention rules, client records will be held for 6 years.
  • Analytics data: 14 months, in line with our Google Analytics settings. For more information on how we use cookies and analytics tools, please see our cookie policy.
  • Photos and testimonials: retained for as long as consent remains in place. Removed promptly on withdrawal of consent.

Who we share information with

Data processors

Google LLC and Notion Labs Inc

This data processor does the following activities for us: Google LLC provides email, calendar and video conferencing services used to communicate with clients. Notion Labs Inc stores and manages our client contact information. Both are US-based companies and operate under appropriate data transfer safeguards for UK personal data.

Sharing information outside the UK

Where necessary, our data processors will share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

Organisation name: Google LLC
Category of recipient: Cloud technology and productivity services provider
Country the personal information is sent to: USA
How the transfer complies with UK data protection law: UK adequacy regulations: Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge), with Active status covering HR and Non-HR data. Verified at dataprivacyframework.gov.

Organisation name: Notion Labs Inc
Category of recipient: Cloud technology and productivity services provider
Country the personal information is sent to: USA
How the transfer complies with UK data protection law: Appropriate safeguards: UK International Data Transfer Agreement (UK IDTA), as set out in Section 4.2.2 of Notion's Data Processing Addendum.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: katie@mosaicacademy.co.uk

If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO.

The ICO's address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint