Effective date: 12th June 2026
Website: https://assessment.mindedgrowth.com/
Contact: team@mindedgrowth.com
Data controller: MindedGrowth / [Insert full legal entity name, company number and registered address if applicable]

MindedGrowth provides organisational audits, diagnostic assessments, operational reviews, leadership support, coaching, implementation roadmaps and related consulting services.

We understand that the Organisational Audit may involve sensitive business information, including details about leadership, team performance, internal processes, accountability gaps, systems, workflow issues, operational risks and organisational challenges.

We treat all assessment responses, reports, business information, documents, meeting notes and related client materials as confidential. We do not sell, disclose, publish, reuse or repurpose identifiable client information without permission, except where required to deliver the service, comply with the law, protect our rights, or meet a lawful regulatory obligation.

This policy explains how we collect, use, store, protect and share personal data and organisational information when you use the MindedGrowth Organisational Audit, including:

the online assessment, diagnostic questions, payment or enquiry forms, email communications, audit reports, follow-up consultations, implementation support, and any related services delivered after the audit.

This policy should be read alongside our main Privacy Policy, Terms and Conditions, and any client agreement or proposal issued for MindedGrowth services.

The ICO says privacy notices should clearly explain what personal data is collected, where it came from, why it is used, the lawful basis, who it is shared with, how long it is kept, and the rights available to individuals. 

We may collect the following categories of information.

This may include:

Name, work email address, phone number, job title, organisation name, department, seniority level, billing contact, and the name of the person completing the assessment.

This may include:

Company size, sector, operating model, team structure, reporting lines, business priorities, strategic goals, workflows, meeting rhythms, accountability structures, process maturity, operational issues, systems used, implementation challenges, and areas where support may be required.

This includes answers submitted through the Organisational Audit, including scores, free-text responses, selected options, diagnostic outcomes, maturity indicators, comments, internal observations, perceived blockers, risks, and areas identified for improvement.

This may include:

Assessment scores, audit findings, prioritised recommendations, operational maturity analysis, 30-day, 60-day or 90-day roadmap recommendations, implementation notes, coaching recommendations, and any follow-up report created from the assessment.

This may include:

Emails, meeting notes, enquiry forms, consultation notes, call summaries, support requests, scheduling information, and correspondence relating to your assessment, report or related services.

Where payment is required, payment information may include billing name, billing email, invoice details, transaction records, payment status and payment confirmation. Payment card details are handled by third-party payment providers and are not stored directly by MindedGrowth unless expressly stated.

When you use our website or assessment platform, we may collect:

IP address, device type, browser type, operating system, referral source, pages viewed, session activity, form completion events, timestamps, and cookie or analytics data where applicable.

The Organisational Audit is designed to assess organisational systems, execution maturity, leadership rhythms, accountability, workflow and operational structure. It is not designed to collect unnecessary personal details about individual employees.

Unless expressly required for the service, you should not submit:

Health information, medical information, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric information, sexual orientation, criminal offence data, personal grievance details, disciplinary records, or confidential HR case files.

Special category data receives additional protection under UK GDPR because of its sensitive nature. The ICO explains that special category data includes information such as health, ethnicity, religious beliefs, political opinions, trade union membership, genetic or biometric data, sex life or sexual orientation. 

If such information is submitted accidentally, we may delete, redact or return it where it is not necessary for the audit.

We collect information when you:

complete the Organisational Audit, submit an enquiry form, purchase an audit or related product, book a consultation, communicate with us by email, attend a call or workshop, provide documents or business context, respond to follow-up questions, or use our website.

We may also collect information from authorised representatives of your organisation, such as a founder, director, senior leader, operations lead, HR lead or project sponsor.

We use your information for the following purposes:

PurposeData usedLawful basisTo provide the Organisational AuditContact details, organisation information, assessment responses, report dataContract or steps before entering into a contractTo produce diagnostic results and recommendationsAssessment responses, scoring data, business context, operational informationContract and legitimate interestsTo communicate with you about your assessmentContact details, email correspondence, booking detailsContract and legitimate interestsTo provide reports, coaching or implementation supportAssessment data, meeting notes, business information, roadmap informationContractTo process payments and invoicesBilling information, transaction records, invoice detailsContract and legal obligationTo maintain business recordsClient records, contracts, payment records, correspondenceLegal obligation and legitimate interestsTo improve our servicesAggregated, anonymised or de-identified assessment trendsLegitimate interestsTo protect the platform and prevent misuseTechnical data, security logs, IP address, usage dataLegitimate interestsTo send relevant service updates or follow-up informationContact details and engagement historyLegitimate interests or consent, depending on the communication 

We only rely on legitimate interests where we have considered the impact on individuals and where our interests do not override their rights and freedoms.

The Organisational Audit may use automated scoring, structured logic, templates or digital tools to generate initial diagnostic outputs.

The assessment is intended to provide operational insight, not to make legally binding, employment-related, financial, disciplinary or regulatory decisions about any individual.

MindedGrowth may review, interpret, refine or contextualise the assessment results before providing strategic recommendations or implementation advice.

You should not use the audit output as the sole basis for employment decisions, disciplinary action, redundancy selection, performance sanctions, promotion decisions or any decision that could significantly affect an individual employee.

Where AI-supported tools, templates or automated systems are used to assist with analysis, drafting, summarisation, scoring, reporting or service delivery, MindedGrowth remains responsible for reviewing the output before using it in client-facing advice.

We do not knowingly use identifiable client assessment data to train public AI models.

Where third-party tools are used to support the service, we aim to use appropriate business, privacy and security settings.

We may share information with trusted third parties only where necessary. This may include:

website hosting providers, assessment platform providers, email service providers, CRM or client management systems, cloud storage providers, payment processors, accounting systems, scheduling tools, analytics providers, professional advisers, subcontractors or team members supporting the delivery of MindedGrowth services, and regulators or legal authorities where required by law.

We do not sell personal data.

We do not share identifiable assessment results with third parties for their own marketing purposes.

We do not publish client names, company names, audit findings, testimonials, case studies, screenshots or identifiable outcomes without written permission.

The ICO checklist says privacy information should explain recipients or categories of recipients, details of international transfers where applicable, retention periods, individual rights, and the right to complain to a supervisory authority. 

Some of the tools we use may process or store data outside the United Kingdom or European Economic Area.

Where this happens, we aim to rely on appropriate safeguards, such as:

UK adequacy regulations, standard contractual clauses, international data transfer agreements, data processing agreements, approved transfer mechanisms, or provider-level safeguards.

We keep information only for as long as reasonably necessary for the purpose for which it was collected.

Our standard retention periods are:

Data typeRetention periodIncomplete assessment submissionsUp to 90 daysCompleted assessment responsesUp to 24 months after completionAudit reports and recommendationsUp to 24 months after deliveryClient communication and service recordsUp to 24 months after the last active engagementFinancial, invoice and tax recordsUp to 6 or 7 years where required for accounting or tax purposesAnonymised or aggregated dataMay be retained indefinitely where individuals and organisations are not identifiableMarketing consent recordsUntil consent is withdrawn or the record is no longer requiredSecurity logs and technical recordsUsually up to 12 months unless needed for security investigation 

Where a contract, legal obligation, dispute, audit, accounting requirement or regulatory matter requires longer retention, we may retain relevant data for longer.

When information is no longer required, we delete, anonymise, archive or securely dispose of it.

We may use anonymised or aggregated assessment data to:

improve the Organisational Audit, identify common operational patterns, develop benchmarks, improve our services, create internal insights, publish general market observations, or support research and product development.

This will not identify you, your organisation, your employees or your specific assessment unless you have given written permission.

Examples of anonymised use may include statements such as:

“Many founder-led teams struggle with ownership clarity during growth.”

or

“Across assessed organisations, meeting rhythm and accountability are common operational maturity gaps.”

We will not publish specific scores, company names, report findings or identifiable case studies without consent.

Depending on the circumstances, you may have the right to:

access the personal data we hold about you, request correction of inaccurate data, request deletion of your data, object to certain processing, restrict processing, request transfer of your data, withdraw consent where consent is the lawful basis, and complain to the Information Commissioner’s Office.

To make a request, contact:

team@mindedgrowth.com

We may need to verify your identity before responding.

If an organisational representative submits information that identifies another individual, that information should be relevant, proportionate and necessary for the audit.

Organisations using the audit are responsible for ensuring that their employees, contractors or team members are informed where their personal data may be included in an organisational review.

MindedGrowth recommends that clients avoid naming individual employees in assessment responses unless there is a clear business need. Use roles, teams or functions wherever possible, for example “Operations Manager,” “Finance Lead,” or “Client Delivery Team.”

We use appropriate organisational and technical measures to protect information, including:

restricted access to client files, password-protected systems, two-factor authentication where available, secure cloud storage, access controls, use of reputable third-party providers, limited internal access on a need-to-know basis, confidentiality expectations for team members and contractors, secure deletion where appropriate, and periodic review of tools and access.

No online system can be guaranteed completely secure. However, we take reasonable steps to protect the information entrusted to us.

If we become aware of a personal data breach, we will assess the risk and take appropriate action.

Where legally required, we will notify the Information Commissioner’s Office and affected individuals within the required timeframe.

We will also take reasonable steps to contain the issue, investigate the cause, reduce further risk and document the incident.

We may send service-related emails about your assessment, report, payment, booking, consultation or implementation support.

We may send marketing emails only where we have a lawful basis to do so. You can unsubscribe from marketing emails at any time.

Unsubscribing from marketing does not stop essential service emails relating to a product, assessment, payment, report or active engagement.

Our website may use cookies, analytics tools or similar technologies to understand website performance, improve user experience, monitor traffic, and support security.

Where required, we will ask for cookie consent before placing non-essential cookies.

You can manage cookies through your browser settings or any cookie controls provided on the website.

If you complete the Organisational Audit on behalf of an organisation, you confirm that:

you are authorised to provide the information, the information is accurate to the best of your knowledge, you will avoid submitting unnecessary personal or sensitive data, you will not submit confidential employee case files unless expressly agreed, and you will use the audit output responsibly.

The audit is intended for organisational improvement, not for individual blame, disciplinary processes or performance sanctions.

The Organisational Audit is intended for business users and is not designed for children. We do not knowingly collect personal data from children through this assessment.

If you have concerns about how we use your data, contact us first at:

team@mindedgrowth.com

You also have the right to complain to the UK Information Commissioner’s Office.

Website: https://ico.org.uk/
Postal address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We may update this policy from time to time to reflect changes in our services, systems, legal obligations or data protection practices.

Where changes are material, we will take reasonable steps to notify users or make the updated policy clearly available.