How we collect, use and protect your personal data.

Version: 1.3 · Last updated: 2nd August 2026

This policy explains what personal data we collect when you enquire about, book or take part in our events, talks and services, or use our website, and how we look after it. We take your privacy seriously, and we only use your information to provide our services safely and to keep in touch where you have asked us to.

Who we are

Ricky Munday t/a Mental Toughness (a sole trader), of Claremont Street, Glasgow, G3 7HB, is the "data controller" responsible for your personal data. That means we decide how and why your data is used. If you have any questions about this policy or your data, contact us at privacy@rickymunday.com.

The information we collect

Depending on how you interact with us, we may collect:

• Identity and contact details — your name, date of birth, postal address, email address and phone number

• Emergency contact details — the name, relationship and phone number of a person we can contact in an emergency

• Health and medical information — details you give us on our Medical Declaration & Participation Agreement, including medical conditions, medication, allergies, dietary requirements and fitness to take part

• Booking and payment information — the event or service booked, correspondence with us, and records of payments or invoices (we do not store full card details)

• Marketing preferences — whether you have asked to receive our newsletter or updates

• Website and technical data — information collected automatically when you use rickymunday.com, such as your IP address, device and browser type, and how you use the site, collected through cookies and similar technologies

Special category (health) data

The health and medical information you provide is "special category" data under UK data protection law and is treated with particular care. We collect it for one reason only: to understand your health and fitness so we can keep you safe on the hill and respond appropriately in an emergency. We share it only with the mountain leader(s) and first aider who need it to look after you during your event, and we do not use it for any other purpose. Our lawful basis for processing it is your explicit consent, which you give when you complete the Medical Declaration & Participation Agreement, and — in a medical emergency where you cannot consent — the protection of your or another person's vital interests. You can withdraw your consent at any time, although we may then be unable to accept you onto an event where we cannot manage your safety.

Our lawful bases for processing

We rely on the following lawful bases under the UK GDPR, depending on the purpose:

• Contract — to take and manage your booking, deliver the event, talk or service you have booked, and deal with payments and cancellations

• Consent — to send you marketing emails where you have opted in, and to process your health information as described above

• Legal obligation — to keep financial records and to comply with health-and-safety and other legal requirements

• Legitimate interests — to respond to enquiries, keep records of our dealings with you, protect the safety of participants, and run and improve our business, in a way that does not override your rights

Who we share your information with

We do not sell your personal data. We share it only with trusted service providers who help us run our business, and only so far as they need it. These currently include:

Category of recipient & What we use it for

Website hosting and online forms - Hosting our website and handling contact, booking and registration forms

Email marketing platforms - Sending our newsletters, marketing campaigns and lead-magnet emails

Customer relationship management (CRM) - Managing enquiries and customer records

Psychometric assessment provider - Delivering and scoring the mental toughness assessment used in coaching

Cloud productivity and storage - Business email, documents and secure file storage

Website analytics providers - Understanding how many people visit our site and how they use it, including heatmap and session analytics

Advertising and retargeting platforms - Measuring our advertising and showing relevant ads to people who have visited our site

Event, challenge and prize-draw platforms - Running events, virtual challenges and prize draws (participant details)

Payment processor - Processing payments and invoices securely

Where an event is run as a fundraiser for a charity (for example the Moira Anderson Foundation), donations are made by you directly to the charity or its fundraising platform (such as JustGiving), and your donation and contact details are handled under that charity's and platform's own privacy policies, not ours. We may also disclose information where we are required to by law, or to protect someone's safety in an emergency.

International transfers

Some of our service providers are based outside the UK, which can mean your data is transferred internationally. Where that happens, we take steps to ensure your data is protected to UK standards — for example by relying on a UK "adequacy" decision for the country concerned, or on approved contractual safeguards such as the UK International Data Transfer Agreement.

How long we keep your information

We keep your personal data only for as long as we need it. As a general rule:

• Health and medical information is kept only for as long as needed to run your event safely, and is securely destroyed within [insert period, e.g. 3 months] of the event, unless we need to keep it longer for an insurance claim or legal reason

• Booking, contract and financial records are kept for up to 6 years after your event, to meet tax requirements and in case of any legal claim

• Marketing contact details are kept until you unsubscribe or ask us to remove them

• Website and technical data is kept for a short period in line with our cookie settings

Your rights

Under UK data protection law you have the right to:

• be told how your data is used (this policy)

• ask for a copy of the personal data we hold about you

• ask us to correct information that is wrong or incomplete

• ask us to delete your data, or restrict how we use it, in certain circumstances

• object to us using your data, or ask us to provide it in a portable format, in certain circumstances

• withdraw your consent at any time, where we rely on consent

To exercise any of these rights, email us at privacy@rickymunday.com. We will respond within one month.

Cookies

Our website uses cookies and similar technologies. Strictly necessary cookies keep the site working and are always on; all other (non-essential) cookies are only set after you accept them through our cookie banner, and you can change your choice at any time through the banner or your browser settings. The non-essential cookies we use fall into these categories:

• Analytics — Google Analytics 4 and Squarespace Analytics, to see how many people visit our site and which pages perform

• Behaviour and usability — Plerdy, which provides heatmaps and session recordings to help us improve the site (set to hide sensitive information)

• Advertising — the LinkedIn Insight Tag and the Meta Pixel, used to measure our ads and to show relevant ads to people who have visited our site

See our Cookie Notice for more detail.

Marketing

We will only send you marketing emails if you have asked us to. Every marketing email includes an unsubscribe link, and you can opt out at any time by clicking it or emailing us. Opting out of marketing does not affect the messages we need to send you about an event you have booked.

Changes to this policy

We may update this policy from time to time. The current version, and the date it was last updated, will always be shown at the top of this page.

How to contact us or complain

If you have any question about your data, or want to exercise your rights, contact us at privacy@rickymunday.com or by post at Claremont Street, Glasgow, G3 7HB.