1. Information Collection And Use

We collect Personal Data when you provide it to us directly, when it is needed to assist with service requests, when third parties provide it to us in connection with the Programme, and when it is collected automatically through your use of the website, app, or related services.

We use Personal Data to:

• provide, administer, and improve the Programme;
• understand your needs, preferences, and interests;
• fulfil requests and manage service interactions;
• personalise your experience;
• send operational service announcements;
• provide relevant information and offers from Hey Jude, affiliates, and business partners;
• protect against fraudulent, harmful, unauthorised, or illegal activity; and
• comply with legal and regulatory obligations.

2. Types Of Information We Process

Contact information: details such as your name, physical address, email address, and telephone number.

Task information: information connected to requests you submit and the fulfilment of those requests by us or service providers.

Transaction information: information relating to purchases, bookings, subscriptions, or other transactions conducted through the Programme.

Member account information: account identifiers such as your username, email address, password credentials, and IP address.

Member content: information, comments, images, addresses, family details, preferences, or other content you provide so that we can serve you efficiently.

Technical information: device, browser, operating system, IP address, app store source, screen resolution, crash details, and related diagnostic data.

Cookies and analytics: we may use cookies or similar technologies to administer the website, understand usage trends, and improve the user experience. You can control cookies at browser level. The Programme does not currently respond to browser "Do Not Track" signals.

3. Justification Of Use

We process Personal Data only where a lawful basis applies. Depending on the context, this may include:

• Consent: where you have given clear consent and may withdraw it;
• Contract performance: where processing is needed to provide the Programme or respond to your requests;
• Legal obligation: where we must comply with applicable law;
• Legitimate interests: where our interests are not overridden by your privacy rights; and
• Legal claims: where processing is needed to establish, exercise, or defend legal claims.

If you provide information about another person, you must have the authority or permission required to share that information with us.

4. Storage And Retention

Personal Data may be processed and stored using secure cloud infrastructure and may be handled by authorised staff or service providers in other countries where necessary to operate the Programme.

We retain customer account data for as long as needed to provide services, operate our business, meet legal obligations, resolve disputes, enforce agreements, support audits, and maintain required financial or tax records. Customer account data is generally retained for up to seven years after account closure unless a longer period is required or permitted by law.

When Personal Data is no longer required, we will delete, destroy, or de-identify it where reasonably practicable. De-identified information may be used indefinitely for statistical, historical, research, or analytical purposes.

5. Disclosure Of Information

We do not sell or publicise member Personal Information. We may share information in limited circumstances and with appropriate safeguards, including with:

• employees and independent contractors who need the information to provide or support the Programme;
• affiliates, holding companies, subsidiaries, and approved business partners involved in providing the Programme;
• service providers needed to complete tasks, process payments, provide analytics, support infrastructure, or deliver communications;
• public authorities, courts, regulators, or other parties where required by law;
• parties involved in protecting our rights, property, users, service providers, or the public;
• a successor or purchaser in connection with a merger, acquisition, restructuring, or sale of business assets;
• third parties where you consent to, or direct, the disclosure; and
• aggregated or de-identified data that does not identify you.

Some organisations monitor employee internet traffic, including encrypted traffic. We cannot prevent such monitoring by your employer or network provider.

6. Security

We use commercially reasonable security measures appropriate to the nature of the data and processing activity, including controls such as encrypted transmission, access restrictions, and need-to-know principles.

Passwords are stored in encrypted form. You are responsible for keeping your password and account access secure. No internet or mobile transmission can be guaranteed as completely secure, so any transmission is at your own risk.

Where payment or financial account information is required, it is processed by PCI-compliant third-party payment providers. We do not store full financial account information, although limited payment details may be retained where required for authorisations, charges, chargebacks, accounting, or compliance.

7. Third-Party Sites And Embedded Content

This policy applies to the Programme. It does not apply to third-party products, services, websites, apps, or embedded content, even where those services are linked from or integrated with the Programme.

Third-party services may collect data, use cookies, apply their own tracking, and monitor your interaction with their content. Their privacy notices and terms apply to their processing. You use third-party services at your own risk.

8. Your Rights And Choices

You may ask us to access, correct, supplement, delete, restrict, or provide a copy of your Personal Data, subject to applicable law and identity verification. You may also object to certain processing, including marketing, or withdraw consent where consent is the lawful basis.

We may limit or refuse a request where permitted by law, for example if the request is frivolous, impractical, jeopardises the rights of others, or would involve a burden disproportionate to the privacy risk. We aim to respond to valid requests within 30 days.

You may close your account. If you ask us to delete information required to provide the Programme, your member account may be deactivated and you may lose access to some or all Programme services.

We usually do not charge for privacy requests. If requests are excessive, repetitive, or manifestly unfounded, we may charge a reasonable administration fee or refuse to act where allowed by law.

9. International Transfers

To provide the Programme, we may transfer, store, or process Personal Data outside your country of residence. Where required, we use appropriate safeguards, such as contractual controls or providers operating in jurisdictions with adequate data protection standards.

10. Changes To This Policy

We may update this Privacy Policy from time to time. We encourage you to review this page periodically for the latest information about our privacy practices.

If we make material changes, we may notify you by email, through the Programme, by posting an updated policy, or by another reasonable method. Continued use of the Programme after an updated policy is posted indicates acceptance of the updated policy where permitted by law.