Privacy Policy

Mundo’s Mud Monsters Privacy Policy for Parents and Carers

Data Protection and Privacy Notice

Version 1.4 | 30 October 2026 | Review due October 2027

1 Who we are

Mundo’s Mud Monsters is operated by Mundo Enterprise LTD, registered in England and Wales, company number 16291658. Our registered office is 18 Douglas House, Brine Street, Winsford, Cheshire, CW7 3TH.

Mundo Enterprise LTD is the data controller responsible for the personal information described in this notice. Dean Mundy, Director, is our data protection contact.

Email: admin@mundosmudmonsters.co.uk

Telephone: 07496137998

Post: Dean Mundy, at our registered office above.

This notice explains how we use information about children, parents, carers, emergency contacts and authorised collectors for our indoor football and physical development sessions for children aged 2–7. It should be read alongside our Terms and Conditions for Parents and Carers, Version 1.2, and our safeguarding and photography policies. It does not cover staff employment records.

We handle information under the UK GDPR and the Data Protection Act 2018, as amended. Accepting our terms or acknowledging this notice does not give consent to photography or marketing.

2 Information we collect

We collect information needed to register your child, deliver sessions safely and manage our relationship with your family. Depending on your circumstances, this includes:

• Your child’s name, preferred name, date of birth, address, bookings and attendance.
• Parents’ and carers’ names, contact details, relationship to the child and parental responsibility.
• Emergency contacts, authorised collectors and the collection password.
• Relevant court orders or restrictions affecting contact or collection.
• Health conditions, allergies, medication, disabilities, special educational needs and support or reasonable adjustments your child needs.
• Relevant GP or emergency medical information. An NHS number, if requested, is optional.
• First aid, accident, incident and medication records, and safeguarding concerns where necessary.
• Payment amounts, dates, methods, references, prepaid session balances, refunds and offer eligibility. Payment references may contain your child’s name and session date, as set out in our terms.
• Enquiries, complaints, messages and records of your consent choices.
• Photographs or videos only for the uses you have separately agreed to.

We do not routinely need a child’s full medical history. Please give us information relevant to safe participation. We do not store full payment card numbers; card payments are handled by the payment provider.

3 Where information comes from

Most information comes from you through registration and consent forms, bookings, payments, conversations, email or WhatsApp. Staff also create attendance and care records during sessions. We may receive relevant information from another person with parental responsibility, an authorised contact, medical professionals, children’s social care or the police.

If you give us another adult’s details, please tell them and share this notice with them. We provide privacy information directly where required, unless a lawful exception applies.

Please keep contact, health and collection information accurate and tell us promptly when it changes.

4 Why we use information and our lawful bases

We use the following lawful bases for the purposes described below:

PurposeLawful basisManage a parent’s booking, payments, prepaid sessions, refunds and essential session messagesContract with the booking parent or carer, Article 6(1)(b)Use a child’s details to organise suitable activities, registers, safe attendance and collection; contact emergency contactsLegitimate interests, Article 6(1)(f): providing safe, appropriate sessions and protecting childrenMaintain required accounting and tax recordsLegal obligation, Article 6(1)(c)Plan health and additional support arrangementsLegitimate interests, Article 6(1)(f), with explicit consent under Article 9(2)(a) for health and other special category informationRespond to an emergency threatening life or safetyVital interests, Article 6(1)(d); for special category information, Article 9(2)(c) where the person is physically or legally incapable of consentingRecord and handle accidents, medication, complaints and insurance mattersLegitimate interests in safe care, accountability and resolving concerns; legal obligation where a specific reporting duty applies. Special category information is handled under the applicable condition, including explicit consent for routine care records or Article 9(2)(f) where necessary for legal claimsRecord and share safeguarding concernsLegitimate interests in protecting children, or legal obligation where a specific duty applies. For special category information, Article 9(2)(g) and the Data Protection Act 2018 Schedule 1 paragraph 18, where its safeguarding conditions are metTake and use photographs and videosSeparate consent, Article 6(1)(a), for each agreed useSend promotional emails or other direct marketingSeparate consent, Article 6(1)(a)

Where we rely on legitimate interests, we consider necessity, your rights and the child’s interests, giving particular weight to children’s privacy. You may ask us about this assessment or object to the processing.

We ask separately for explicit consent to routine processing of health and relevant additional needs information. Consent to administer medication or provide first aid is a separate care permission. If you withdraw data consent, we will discuss safe arrangements with you. We may be unable to offer a place if essential information cannot lawfully be processed to keep your child safe. Withdrawal does not prevent processing necessary under another applicable lawful basis and special category condition, such as safeguarding or legal claims.

5 Who can see information

We never sell personal information. We share only what is necessary with:

• Staff who need it for their role. Young volunteers do not have access to personal records.
• Children’s social care, the Local Authority Designated Officer, police or other relevant safeguarding agencies where necessary to protect a child or meet a legal duty.
• Medical professionals and emergency services where needed for care or an emergency.
• Our insurer, Insure4Sport, and professional advisers where needed for incidents, claims, accounts or legal advice.
• Banks, payment and booking providers for transactions and session administration.
• IT, email, cloud storage and communication providers that support our service, including WhatsApp where used.
• HMRC, courts and regulators where legally required.
• The Den only where necessary, such as an emergency or missing child incident.

Providers acting as our processors must process information under appropriate contractual terms and security requirements. Banks, authorities and some platform providers may act as independent controllers for their own functions; their privacy notices explain those uses. You can ask us which providers handle your information.

For safeguarding, we may share information without parental consent. We normally explain this unless doing so would increase risk, prejudice an investigation or otherwise be inappropriate or unlawful. Safeguarding records are kept separately, with internal access restricted to Kelsey Hough, DSL, and Dean Mundy, Deputy DSL.

6 Session messages and marketing

We use your contact details for essential messages such as booking confirmations, cancellations, changes, payment queries and safety information. These are service communications and do not require marketing consent.

Marketing emails, promotional WhatsApp messages and other direct marketing require a separate opt-in. You can unsubscribe or withdraw consent at any time by contacting admin@mundosmudmonsters.co.uk. This will not affect your child’s place or essential session messages.

If you choose to join a parent WhatsApp group, your phone number, profile details and messages may be visible to other members according to WhatsApp’s settings. Group participation is optional; contact us to arrange essential updates privately. Please do not post children’s health information, collection passwords or safeguarding concerns in a group. Send these privately through our official contacts.

7 Photographs and videos

We only take and use your child’s image in line with the separate choices recorded on the Registration and Parental Consent Form. Choices cover internal records and sharing with parents, our website, social media, and printed promotional material.

Refusing photography consent does not affect participation. Staff check permissions before taking or using images. We do not publish children’s full names alongside images. Staff must use company devices and company accounts, never personal devices, to take or store children’s images.

You can change or withdraw consent at any time by emailing admin@mundosmudmonsters.co.uk. We stop future use and remove images from our own website and social media where possible. We cannot guarantee retrieval of printed material already distributed or copies independently shared by others. Online publication can make images accessible worldwide; platforms may process them under their own privacy notices.

Images are deleted when no longer needed, when consent is withdrawn, or at the latest when the child leaves, unless a parent has separately agreed to longer use. A necessary record of consent and withdrawal may be retained to demonstrate our compliance.

Parents may photograph or film their own child only. Do not photograph or film other children, or share images containing them, without their parents’ permission.

8 How long we keep information

Our retention periods follow our existing Data Protection and Privacy Notice:

RecordRetention periodRegistration and consent forms and routine booking recordsWhile your child attends, plus one yearAccident and incident records involving a childUntil the child turns 21Medication recordsUntil the child turns 21Safeguarding recordsAccording to the applicable local safeguarding partnership guidance, the nature of the concern and any investigation or legal requirement; reviewed separately and securelyPayment and accounting recordsSix years from the end of the financial year concerned, or longer where law requiresPhotographs and videosAs explained in section 7Marketing contact lists and preferencesUntil you unsubscribe or ask us to stop; a minimal suppression record may be retained to respect your choiceRoutine email and WhatsApp messagesNormally no longer than one year after they are no longer needed; messages forming part of another record follow that record’s retention period

Records may be kept longer where necessary for an ongoing complaint, safeguarding concern, investigation, insurance matter or legal claim. We review the need and do not retain information indefinitely without justification. Where a form contains several record types, we retain only the parts needed for the longer period where practicable.

Paper records are securely shredded and electronic records securely deleted when no longer required. Backup copies are protected from routine use and removed through the backup deletion cycle.

9 Security and overseas processing

We keep paper records in locked storage and electronic records in protected company systems and accounts. Access is limited to people who need it. Staff follow confidentiality and data protection procedures. Essential registers, medical information and emergency contacts are kept secure during sessions and removed afterwards by the Session Lead or Director.

Some communication, booking or cloud providers may process information outside the UK. Where a restricted international transfer occurs, we use the safeguards required by UK law, such as adequacy regulations or approved contractual safeguards, including the UK International Data Transfer Agreement or UK Addendum where applicable. Contact us for details of relevant destinations and safeguards or a copy of applicable safeguards, subject to necessary redactions.

If a personal data breach occurs, we assess the risk and take action. Where required, we notify the ICO within 72 hours of becoming aware of it and inform affected people without undue delay where the breach is likely to create a high risk to their rights and freedoms.

10 Your rights and your child’s rights

Depending on the circumstances, you and your child have rights to access personal information, correct inaccuracies, request deletion, restrict processing, object to processing based on legitimate interests, and receive certain information in a portable format. You can always object to direct marketing and withdraw consent for processing that relies on it. Withdrawal does not affect the lawfulness of earlier processing.

These rights are subject to legal limits. For example, we may need to retain information for safeguarding, legal obligations or legal claims, and protect other people’s information when responding to an access request.

Children’s information rights belong to the child. A person with parental responsibility can usually act for a young child, subject to the child’s understanding, best interests, any relevant restrictions and our checks on authority. We can explain privacy matters in a simple, age-appropriate way.

Contact admin@mundosmudmonsters.co.uk or use the telephone or postal details in section 1. You do not need a special form. We may need proportionate proof of identity or authority. We normally respond within one month and free of charge. Where the law allows extra time, a pause for necessary clarification, a fee or refusal, we explain the reason and your options.

We do not use automated decision-making or profiling to make decisions about your child’s place or participation.

11 Questions and complaints

Please contact Dean Mundy at admin@mundosmudmonsters.co.uk, by telephone on 07496137998, or by post at our registered office if you have a privacy concern. You can also speak to the session lead.

In line with our parent terms, we aim to resolve informal concerns immediately or within five working days. For a formal written complaint, email dean.mundy@mundosmudmonsters.co.uk. We will acknowledge it within three working days and aim to provide a written response within 14 working days, explaining if more time is needed. We investigate without undue delay, keep you informed and explain the outcome. You may request a review meeting with the Director.

You also have the right to complain to the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/ or 0303 123 1113. Our internal process does not remove that right.

For a safeguarding concern, contact safeguarding@mundosmudmonsters.co.uk. Call 999 if a child is in immediate danger.

12 Changes and acknowledgement

We review this notice at least annually and when our services, systems or legal requirements change. We make the current version available to parents and explain material changes by email or another appropriate direct message. We explain any new purpose before starting that use and obtain fresh consent where required. Changes to contractual terms follow the notice arrangements in those terms.

An acknowledgement of this notice records that privacy information has been provided. It is not blanket consent. Photography, marketing and explicit consent for relevant health information are recorded separately.