Privacy Policy

Last updated: October 2026

Mayvin Ltd is committed to protecting your privacy and handling your personal data responsibly. This policy explains what information we collect when you engage with us or use our website, how we use it, how long we keep it, and your rights.

If you have any questions, contact our Data Privacy Lead at dataprotectionlead@mayvin.co.uk. 

Who we are

Mayvin Ltd (company number 7460957) is the data controller for personal data collected through its website and in connection with our services. Our registered address is 1a City Gate, 185 Dyke Road, Hove, BN3 1TL.

We are registered with the Information Commissioner's Office (ICO). Registration number: ZA681652.

We process personal data in accordance with UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025.

What information we collect and why

Website enquiries

If you contact us through our website, by email, or by phone, we collect your name, email address, phone number, and company name. We use this to respond to your enquiry. We keep this information for up to 18 months after we last had contact with you, after which it is deleted. You can ask us to delete it sooner.

Newsletter subscribers

If you sign up to our newsletter, we will use your email address to send you updates, event invitations, and information about our programmes. We process this on the basis of consent. You can unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us at dataprotectionlead@mayvin.co.uk. 

We will retain your email address and subscription preferences for as long as you remain subscribed. If you unsubscribe, we stop emailing you straight away. We keep your email address for 12 months so that we do not email you again by mistake, and then delete it. You can ask us to delete it sooner. 

Events

If you register or RSVP for one of our events, we collect your name, email address, organisation and anything else you tell us when you register. We use this to run the event and to follow up with you about it. We keep this information for three years. Registering does not add you to our newsletter. We only send you marketing if you sign up for it separately. Where we record or photograph an event, we only keep recordings and photographs with your consent.

Clients and programme participants

If you engage with Mayvin's services, we will hold personal data relevant to delivering those services. The information we hold depends on the nature of the engagement. Where you share information about your health, ethnicity, religious beliefs, or other special category data as part of a programme or research activity, we will ask for your explicit consent before processing it. We retain client and participant data for five years after the end of an engagement, unless a longer period is required by law or by contract, or is necessary for legal claims.

Where you take part in a programme or event arranged by your employer, they may give us your name, job title and work email address so that we can deliver the programme.

Where AI tools are used in connection with your engagement, the Use of AI tools section of this policy sets out how we handle that processing and what safeguards are in place.

Job applicants

If you apply for a role with Mayvin, we collect your name, contact details, qualifications, employment history, references and whether you have the right to work in the UK. If you tell us you need reasonable adjustments, we record that too. We use this to assess your application. We keep the details of unsuccessful applicants for six months, or for a further six months if you agree. If you are successful, your details move to your HR file.

Our lawful basis for processing

Legitimate interests - to respond to enquiries, manage client relationships, deliver our services, run our events, and improve our operations. This includes the use of approved AI tools to support service delivery.

Contract - to fulfil our obligations to clients and suppliers.

Consent - for newsletter subscriptions and optional marketing.

Legal obligation - where we are required to process data by law.

Use of AI tools

Mayvin uses artificial intelligence (AI) tools to support the delivery of our services. These tools may assist with tasks such as drafting documents, analysing data, generating content, or summarising information. 

We only use AI tools that have been assessed and approved through our internal governance process. Each tool is assessed for data protection compliance before use, including completion of a Data Protection Impact Assessment where required.

Where AI tools are used in connection with personal data, we confirm that:

• Only professional-capacity personal data, such as names and job titles of client stakeholders, may be incidentally present in materials processed through AI tools.
• We do not enter special category data, financial data, criminal offence data, or children's data into AI tools under any circumstances.
• Government contract data is not entered into AI tools unless processed through a tool specifically approved for that purpose in accordance with our AI Governance Policy.
• We only enter personal data into AI tools that have a Data Processing Agreement in place with the provider and do not use submitted data to train their models. Tools without those protections are not used with personal data.
• All AI-assisted outputs are reviewed by a Mayvin team member before being relied upon, submitted, or shared.

If you have any questions about how AI tools are used in connection with your personal data, please contact dataprotectionlead@mayvin.co.uk. 

International transfers

Some of the tools we use to deliver our services involve the transfer of personal data outside the UK. Where this happens, we make sure the transfer is lawful under UK GDPR Chapter V. For US providers, this is either because the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), or because we have an appropriate safeguard in place. For AI tools, transfers are made on the basis of the UK Addendum to the EU Standard Contractual Clauses. A Transfer Impact Assessment has been completed and is available on request. You can also ask us for a copy of the safeguards we rely on.

Sharing your information

We do not sell your personal data. We may share it in the following circumstances:

• With Associate Consultants engaged to deliver work on our behalf. Associates operate as freelance contractors and are subject to data processing agreements requiring them to handle personal data appropriately.
• With third-party suppliers who support our operations, including IT, marketing, and AI tool providers. Where they process personal data on our behalf, we have a Data Processing Agreement in place.
• With your employer or sponsor where relevant to the delivery of our services.
• Where we are required to do so by law.

Keeping your data secure

We protect personal data with technical and organisational measures, including access controls and encryption. Mayvin holds Cyber Essentials Plus certification.

Cookies

Our website uses cookies to understand how visitors use the site and to improve it. We only set non-essential cookies if you accept them through our cookie banner, and you can change your choice at any time. Declining cookies may affect some features of the site. For details of the cookies we use, see our Cookie Policy.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate or incomplete data
• Ask us to delete your data in certain circumstances
• Object to processing where we rely on legitimate interests - we will stop unless we can demonstrate compelling grounds that override your interests
• Object to direct marketing at any time, and we will stop
• Ask us to restrict processing of your data in certain circumstances
• Receive your data in a portable format
• Request human review of, and contest, significant decisions made about you solely by automated means
• Withdraw consent at any time where consent is the basis for processing

To exercise any of these rights, contact us at dataprotectionlead@mayvin.co.uk. We will respond within one calendar month.

How to make a complaint

If you have a concern about how we have handled your personal data, please contact our Data Privacy Lead in the first instance at dataprotectionlead@mayvin.co.uk. We will acknowledge your complaint within 30 calendar days. We will investigate without undue delay and keep you informed of progress.

If you remain dissatisfied after we have responded, you have the right to complain to the Information Commissioner's Office at https:\\ico.org.uk

Contact us

Data Privacy Lead
Mayvin Ltd
1a City Gate, 185 Dyke Road, Hove, BN3 1TL
dataprotectionlead@mayvin.co.uk

Changes to this policy

We review this policy annually and whenever our data practices change. The current version is always available on our website.