Privacy and Data Protection Policy

Last updated: October 2026

Who we are

Money First Aid Ltd ("we", "us") is a company registered in England & Wales (No. 15597372) at 27 Old Gloucester Street, London WC1N 3AX. We are registered with the Information Commissioner's Office (No. ZB674878).

We provide financial wellbeing training and workshops/webinars to organisations and individuals. We take the privacy and security of personal data seriously and process it in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For any privacy questions, contact us at support@moneyfirstaid.net.

What personal data we collect

We collect only what we need to deliver our services:

  • Website visitors: IP address, browser and device information, and pages visited, collected through cookies (see below).

  • Customers and client contacts: name, job title, organisation, email address, phone number, billing details, and correspondence with us.

  • Learners: name, email address, login details, course progress, quiz or assessment results, completion certificates and any feedback they give.

  • Newsletter subscribers: email address and subscription preferences.

We do not ask learners to share details of their personal financial circumstances in order to take our courses.

We do not store payment card details. Card payments are handled directly by our payment providers.

How we use your data and our lawful basis

Purpose: Lawful basis

  • Delivering training and course access: Contract, or our legitimate interest in delivering services our client organisation has purchased

  • Managing client relationships, invoicing and support: Contract, and legal obligation for financial records

  • Money First Aider® community newsletters and invitations to community calls: Legitimate interests (supporting qualified Money First Aiders in their role). They can opt out at any time using the link in any community email.

  • Keeping Money First Aiders' contact details up to date if they change organisation (we may contact them via LinkedIn or another professional channel to ask if they'd like to update their email address): Legitimate interests

  • Sending service updates about an account or course: Contract / legitimate interests

  • Sending our newsletter and marketing emails: Consent (can unsubscribe at any time)

  • Reporting anonymised or aggregated course completion and feedback to client organisations: Legitimate interests

  • Improving our website and courses: Legitimate interests

  • Complying with the law: Legal obligation

When we deliver training on behalf of an employer

When an organisation buys training for its employees, it may give us learner names and work email addresses so we can enrol them. In these cases we process that data to deliver the training, to report on completion as agreed with the organisation, and, for Money First Aider® courses, to welcome learners into the Money First Aider community. Where required, we will enter into a data processing agreement with the client organisation.

Who we share data with

We do not sell personal data. We share it only with trusted service providers who help us run our business, under contracts that require them to protect it:

  • Teachable: hosts our online courses and learner accounts

  • Squarespace: hosts our website, newsletter delivery and online shop

  • Google Workspace: email and file storage

  • Novabooks: financial records and accounting

We may also disclose data where the law requires us to.

International transfers

Some of our providers, including Teachable and Squarespace, are based in the United States. Squarespace transfers UK data under the UK Extension to the EU–US Data Privacy Framework, backed by the ICO-approved International Data Transfer Addendum. Teachable transfers UK data under the ICO's International Data Transfer Agreement.

How long we keep data

  • Learner accounts and completion records: Learners keep ongoing access to course content after completing a course, so we keep their account and completion records while their access continues. Learners can ask us to close their account and delete their data at any time by emailing support@moneyfirstaid.net. Where a client organisation's contract requires a different retention period, we follow that. Accounts inactive for 5 years may be deleted.

  • Money First Aider® community: for as long as you remain a member, or until you opt out.

  • Client and financial records: 6 years, as required by UK tax law

  • Newsletter data: until you unsubscribe

  • Enquiries that don't lead to business: 3 years

After these periods, we securely delete or anonymise the data.

How we protect your data

We are a small team and apply security measures proportionate to the data we hold:

  • Access to personal data is restricted to our two directors.

  • Multi-factor authentication is enabled on all business accounts.

  • Business devices are encrypted, password-protected and kept up to date.

  • Passwords are managed through a password manager.

  • We use established platforms (Teachable, Squarespace) that encrypt data in transit and maintain their own security programmes.

  • We do not store client learner data on local devices.

  • If a personal data breach occurs, we will assess it promptly, notify affected clients without undue delay, and report it to the ICO within 72 hours where required.

Cookies

Our website uses cookies to function properly and to understand how visitors use it. We use analytics cookies to measure site performance. You can manage cookies through your browser settings. Blocking some cookies may affect how the site works.

Your rights

Under UK GDPR, you have the right to:

  • access the personal data we hold about you

  • correct inaccurate data

  • ask us to delete your data

  • restrict or object to how we use it

  • receive your data in a portable format

  • withdraw consent at any time, where we rely on consent

To exercise any of these rights, email support@moneyfirstaid.net. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to resolve your concern first.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised.