Privacy Policy

1. Who we are

MEAN IT is operated by Mean It Ltd. Mean It Ltd is the controller responsible for the personal information described in this policy.

This policy covers our website, enquiries, applications and accountability programmes. External services may also provide their own privacy notices for processing they carry out independently.

2. Information we collect

The information we collect depends on how you interact with us and the programme you choose.

• Contact and application details: your name, email address, telephone number, country and information you provide when enquiring or applying.
• Programme information: your goal, agreed commitments, programme dates, check-in arrangements, agreement and preferences.
• Progress and evidence: check-in messages, results, photographs, screenshots or documents you submit to demonstrate progress.
• Eligibility information: answers needed to assess whether a programme is suitable for you. Some answers may contain health information, as explained in section 4.
• Payment and accounting records: amounts, payment status, transaction references, deposits, refunds, penalties and donation records, together with relevant billing details.
• Communications: emails, WhatsApp conversations, enquiries, complaints and records of consent or contact preferences.
• Technical information: information such as your IP address, browser, device information and website security logs. Additional tracking is described in section 10.

Most information comes directly from you. We also receive payment confirmations and transaction information from payment providers, and technical information from the services used to operate our website.

Card details entered into a payment provider’s checkout are processed by that provider. Please do not send full card details or security codes by email or WhatsApp.

Where information is needed to assess your application, arrange payment or deliver your agreed programme, we may be unable to proceed without it. We will explain which information is required when we ask for it.

3. How and why we use your information

Data protection law requires us to identify a lawful basis for using personal information. The basis depends on the purpose.

Enquiries and applications

We use your details to respond to requests, assess your application and discuss a proposed programme. Where you ask us to take steps towards an agreement, we rely on taking steps at your request before entering a contract. For general enquiries, we rely on our legitimate interest in responding to people who contact us.

Delivering your programme

We use necessary contact details, commitments, evidence and check-in records to deliver your programme, assess progress and administer the agreed payment arrangements. Our lawful basis is performance of our contract with you. Health information also requires the additional condition explained in section 4.

Accounting and legal obligations

We keep records needed to meet applicable tax, accounting and other legal requirements. Our lawful basis is compliance with a legal obligation.

Security, disputes and business administration

We use relevant information to protect our systems, prevent fraud, investigate complaints and establish, exercise or defend legal claims. Where appropriate, we rely on our legitimate interests in operating a secure business and resolving disputes, balanced against your rights and interests.

Optional marketing and publicity

Where we ask permission to send promotional messages or publish an identifiable testimonial, photograph or customer story, we rely on your consent. You can withdraw that consent as explained below.

4. Health and sensitive information

Weight records, health-related eligibility answers and some programme evidence may reveal information about your physical or mental health. This is special category personal data and receives additional legal protection.

Where we need health information to assess suitability or deliver your chosen programme, we ask for your separate, explicit consent for those specific purposes under Article 9(2)(a) of the UK GDPR. For the necessary application and programme administration, our Article 6 basis is taking steps at your request or performing our contract.

Agreeing to general terms or reading this policy does not, by itself, provide explicit consent to process health information.

You can withdraw your health-data consent at any time by emailing support@mean-it.org. Withdrawal does not affect processing that was lawful before you withdrew it.

We will stop processing that relies on your consent. If the programme cannot be delivered without the information, we will discuss whether it can be adapted or needs to end. We do not impose a charge merely for withdrawing data-protection consent.

Where particular information is necessary for an actual legal claim, we may retain the relevant information on the separate legal-claims condition under Article 9(2)(f), for that purpose only.

Please do not send medical records or other sensitive information beyond what we specifically request.

5. Messages and marketing

WhatsApp is our programme communication channel. We use your number to contact you about your application, agreed commitments, evidence and check-ins. We also use email for relevant administration and support.

Messages needed to deliver your programme are service communications. Providing your telephone number or joining a programme does not automatically sign you up to promotional messages.

If you opt in to marketing, you can unsubscribe using the method provided in the message or contact us at support@mean-it.org. Opting out of marketing does not prevent necessary service communications.

We ask separately before using identifiable customer evidence, photographs or stories in publicity.

6. Who receives your information

Information is made available to the people and service providers who need it for the purposes described here. This includes:

• Your Commitment Controller and staff responsible for customer support, administration and finance.
• Website hosting, form-processing and IT support providers.
• Email, messaging and business-record storage providers.
• Payment and banking providers handling fees, deposits, refunds and related transactions.
• Professional advisers, insurers, regulators or public authorities where disclosure is necessary and lawful.

Some providers process information on our instructions. Others, including payment or messaging providers, may also act as independent controllers for their own legal, security or service purposes.

7. International transfers

Some technology providers may store or access information outside the United Kingdom. The arrangements depend on the provider, its service configuration and the locations of its support teams and subprocessors.

You can contact support@mean-it.org for information about relevant transfer safeguards and how to obtain a copy, subject to appropriate redaction of confidential information.

8. How long we keep information

We keep information for the period needed for its stated purpose, taking account of legal obligations, complaints and relevant claims. Different types of records have different retention periods.

• Enquiries and unsuccessful applications: One year
• Agreements and core programme records: One year
• Health information and raw evidence: One month after programme end
• Payments and accounting records: Seven years
• Email and WhatsApp conversations: Reviewed after one year
• Technical logs and backups: One year

Records relevant to an unresolved complaint or legal claim may need to be retained until it is resolved and any applicable retention requirement has ended. This does not mean retaining all programme evidence indefinitely.

We may retain a minimal record of a marketing opt-out so that we can continue to respect your preference.

9. Keeping information secure

We are responsible for using appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or disclosure.

No online service or communication method can be guaranteed completely secure. Please protect your own devices and accounts, and tell us promptly if you believe information shared with us has been compromised.

10. Cookies and tracking

Websites may use cookies and similar technologies for functions such as security, remembering preferences, measuring visits and advertising.

Where consent is required, these technologies must only operate after you have given it. You can withdraw consent through the relevant cookie settings. Reading this policy or continuing to browse does not, by itself, provide consent.

You can also manage cookies through your browser, although blocking cookies needed for a requested function may prevent that function from working.

11. Your privacy rights

Depending on the circumstances and the lawful basis used, you may have the right to:

• Request access to your personal information.
• Ask us to correct inaccurate or incomplete information.
• Request deletion of your information.
• Ask us to restrict how we use your information.
• Receive certain information in a portable format or have it transferred to another provider.
• Withdraw consent where processing relies on consent.

To exercise a right, email support@mean-it.org. We may need proportionate information to verify your identity before releasing or changing records.

We normally respond within one month. If a lawful extension or exception applies, we will explain it. Requests are normally free of charge.

These rights are not absolute. For example, we may need to retain information to meet a legal obligation or deal with a legal claim. We will explain any restriction that applies to your request.

12. Decisions about your programme

Your programme involves assessing evidence against the commitments agreed with you. Eligibility decisions, evidence assessments and decisions to apply penalties are made with meaningful human involvement.

If you think an assessment is based on inaccurate information, contact your Commitment Controller or email support@mean-it.org.

13. Questions and complaints

Please contact support@mean-it.org if you have a privacy question or are unhappy with how we have handled your information.

You also have the right to complain to the UK Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint. You do not have to complain to us first.

If you live outside the UK, you may also have the right to contact your local data protection authority.

14. Changes to this policy

We may update this policy to reflect changes in our services, systems or legal requirements. The date at the top shows when it was last updated.

Where a change materially affects how we use your information, we will bring it to your attention as appropriate. If a new use requires consent, updating this policy alone will not provide it.