Version 1.2. Effective date: 5 November 2026
1. About this notice
This notice explains how we, Media Zoo Limited, collect, use and protect your personal information when you take part in an Uncertainty Experts programme, the Leadership Lab, the State of Uncertainty Survey or the assessments in your online course. It also explains your rights and how to exercise them.
This notice applies wherever you are. If you are in the European Union or European Economic Area, Canada or the United States, the annex for your location also applies.
2. Who we are
Uncertainty Experts and Finer Vision are part of Mediazoo Group. In this notice, "we", "us" and "our" mean Media Zoo Limited, a company registered in England and Wales (company number 04655948), whose registered office is at 8 The Boulevard, London SW6 2UB. We are registered with the Information Commissioner's Office under registration number ZA676458.
Our two roles
- When we run your programme on behalf of your organisation, we act as its service provider (a "processor"). Your organisation decides why you are taking part and is responsible for that use of your information. Its own privacy notice also applies.
- When we use your information for research and analysis (understanding how people respond to uncertainty and improving our programmes), and when we send you your own results or retain and anonymise your information after your programme ends, we are responsible for it (the "controller"). This notice explains those uses.
Data Protection Officer: you can contact our Data Protection Officer at [email protected] or by writing to the address above, marked "Data Protection Officer".
3. What information we collect
| Where | What we collect |
|---|---|
| Leadership Lab | A random six-character code instead of your name; an optional nickname for the session; your organisation, age group, how you identify (gender), your job level and tenure (earlier Labs also asked your sector); your answers to questions and reflections; your results from the balloon task; whether you have agreed to be quoted |
| Leadership Lab: results by email | If you ask us to email your results or your code, we use your email address to send them, and you may give a name for your certificate. To send the email, our email provider receives your email address, any name you give for your certificate, your organisation's name, the date of your Lab, your written reflections and a code for your Lab record. We do not store your email address or your certificate name. We keep only a masked hint (such as a***@example.com) and a one-way fingerprint created from your address with a secret key, so that we can link your answers over time without keeping your address |
| State of Uncertainty Survey | No name or email address. Your answers, including your organisation, job level, tenure and how you identify, and when you sent them |
| Online course and assessments | Your answers, scores and progress, saved to your course account, which holds your name and work email address |
| From your organisation | To set up your course account, your organisation may give us your name, work email address and the programme you are joining |
| Technical information | Access and security logs from our systems |
Required and optional questions. Some background questions are required. In the Leadership Lab pre-work survey, these are your organisation, tenure, job level and how you identify, with a "Prefer not to say" option. In the first assessment of your online course, these are your gender, age group and job level, each with a "Prefer not to say" option; we also ask for your full name, filled in from your course account, which you can change or leave blank. Other background questions are optional, and the neurodiversity question is asked only if you consent.
4. Sensitive information
Some information is given extra protection by law because it is sensitive, including information about your health.
- Neurodiversity. We ask whether you identify as neurodiverse only if you give your explicit consent first, on the step before the question. The question is optional. We use the answers only as combined counts of five or more people, never individually, and we never try to infer it from your other answers. You can withdraw your consent at any time: on the screen until you send your answers, and after that by emailing us (section 11). Some questions ask about your feelings, your fears or how uncertainty affects you, and your answers may reveal information about your health. Please do not include medical details or the names of other people. We do not analyse your written reflections for research. The only exception is the State of Uncertainty Survey, which collects no name or email; its written answers may be analysed for research, so please do not include anything that could identify you or anyone else. We delete written answers from your online course when your organisation's licence ends, and written answers from the Leadership Lab and the State of Uncertainty Survey six months after the Lab (section 9).
- Wellbeing check (Leadership Lab). To keep everyone safe, written answers in the Lab are automatically checked for words suggesting someone may be at risk of harm. If a match is found, a member of our team is alerted so the session presenter can offer support, following the route agreed with your organisation. A person always reviews the alert; no automated decision is made about you.
5. How we use your information and our legal basis
Data protection law requires us to have a legal basis for each use of your information. For sensitive information, we also need an additional condition.
| Purpose | Legal basis |
|---|---|
| Running your session or programme on behalf of your organisation | We act on your organisation's instructions. Its privacy notice explains its legal basis |
| Sending you your own results, code and certificate when you ask | Our legitimate interests in providing the service you have requested |
| Research into how people and teams handle uncertainty, and improving our programmes | Our legitimate interests in research and in developing evidence-based programmes. You can object at any time (section 11) |
| Asking whether you identify as neurodiverse, and using the combined answers | Your explicit consent |
| Quoting your words, at the level you choose | Your consent, which you can change or withdraw at any time |
| The wellbeing check in the Leadership Lab | UK: our legitimate interest in safeguarding individuals at risk, and the safeguarding condition in the Data Protection Act 2018. EU: see Annex A |
| Anonymising your information when it is no longer needed in identifiable form | Our legitimate interests in retaining research data in a form that cannot identify you |
| Keeping our systems secure, and keeping records of access | Our legitimate interests in protecting your information and our systems |
| Responding to your requests and complaints, and meeting our legal obligations | Compliance with our legal obligations |
Our legitimate interests. Where we rely on legitimate interests, we have assessed that our use is necessary and balanced against your rights. In particular, we have considered that you are taking part through your employer, and we have built in safeguards: your organisation never sees your individual answers, research uses your answers without your name or email, and you can opt out at any time. You can ask us for a copy of this assessment.
6. Research and anonymisation
Our research looks at how people and teams respond to uncertainty and whether our programmes make a difference. For research, your answers are held under a random code, with your name and email address removed. This is known as pseudonymisation: while the key exists, the code can be linked back to you, so we continue to treat this information as personal information and protect it accordingly. Only a small number of authorised researchers can access it.
Research findings are published or shared only as combined results from groups of five or more people, so that no individual can be identified.
When your organisation's licence ends, we anonymise your online course information. For the Leadership Lab and the State of Uncertainty Survey, which are not covered by a licence, we do this six months after the Lab. We remove every link to you, delete your written answers, and generalise details such as your age and job level so that no small group can be singled out. Once anonymised, the information can no longer be linked to you and is no longer personal information. We keep anonymised results for long-term research, and may analyse them using software tools, including artificial intelligence. Anonymised results are never used to make decisions about any individual.
7. Who sees your information
| Who | What they see |
|---|---|
| You | Your own answers and results |
| The Uncertainty Experts team | Authorised staff only, to run programmes, support participants and carry out research. Access is restricted and logged |
| Your organisation | Combined results from groups of five or more people. For the online course: your name, email address, course progress and average score, including a progress report that names you. If you tick the quote box, quotes from you without your name. Otherwise, your organisation never sees your individual answers or your written reflections |
| The session presenter (Leadership Lab) | Combined results for the room, from groups of five or more. The presenter does not see your email address |
| Our suppliers | Companies that provide services to us under contracts requiring them to protect your information and use it only on our instructions (below) |
| Others, where required | Professional advisers, regulators, or law enforcement where the law requires it |
Our main suppliers
| Supplier | Service | Location |
|---|---|---|
| Microsoft (Azure) | Data storage and analysis | United Kingdom (UK South, with backups in UK West). Combined, anonymised statistics may be processed in the EU |
| Twilio SendGrid | Sending our emails, such as course invitations and reminders, and the results you ask for | United States. It receives your name, your organisation's name, your email address and what each email says |
| ActiveCampaign | Course invitation and reminder emails for some programmes | It receives your work email address, first name and your organisation's name, and whether you have been invited to and have finished your starting assessment |
| Microsoft Entra External ID | Sign-in accounts for the online course | Europe |
| Cloudflare | Storing and delivering course films and images | Delivered from Cloudflare's global network. To deliver them, Cloudflare processes your device's internet (IP) address and technical details of each request, in its data centres in the United States and Europe. We do not send it your name or email address |
| Supabase | Earlier programme and Leadership Lab records, held while these systems are closed down | United Kingdom (London) and Ireland |
| LearnWorlds | Earlier course records, and names for progress reports, while this system is closed down | European Union and United States |
We do not sell your information.
8. International transfers
Your answers are stored in the United Kingdom. Where a supplier processes your information outside the UK, we make sure it is protected to the standard required by UK law:
- United States: our email providers process your email address, your organisation's name, the content of each email and, where you give it, your name. These providers are Twilio SendGrid and, for some programmes, ActiveCampaign. For Leadership Lab results, the content includes your written reflections. Cloudflare processes technical information, such as your internet address, when it delivers films and images. These transfers are protected by the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge). Twilio Inc., which provides SendGrid, Cloudflare and ActiveCampaign are each certified under it.
- European Union: the UK recognises the EU as providing adequate protection. Your sign-in account is held in Microsoft Entra External ID in Europe, some earlier Leadership Lab records are held by Supabase in Ireland, and combined, anonymised statistics may be processed there.
You can ask us for a copy of the safeguards we use (section 15).
9. How long we keep your information
| Information | How long we keep it |
|---|---|
| Anything you write in your own words | Online course: deleted when your organisation's licence ends. Leadership Lab and State of Uncertainty Survey: deleted six months after the Lab |
| Your email address, if you ask us to send your Leadership Lab results | Not stored: used only to send the email. Our email provider keeps delivery records, including your address, for up to 37 days, and some delivery event data in pseudonymised form for up to a year, for security and fraud prevention |
| Your other answers, scores, code, fingerprint and consent records | Online course: anonymised when your organisation's licence ends. Leadership Lab and State of Uncertainty Survey: anonymised six months after the Lab |
| Quotes you have agreed we may use | Deleted six months after the Lab, or at the end of your organisation's contract with us if sooner. You can change or withdraw your permission at any time before then |
| Wellbeing check alerts | Reviewed by a member of our team within five working days. Deleted with your other written answers six months after the Lab, unless the reviewer records that the alert must be kept to follow up a safeguarding concern. Any alert kept is reviewed every three months and deleted no later than 12 months after the Lab, unless the law requires us to keep it longer |
| Your course account | Your name and email address are removed when your organisation's licence ends |
| Stored progress reports | Deleted after 12 months. Names are not stored with a report: they are added each time it is opened |
| Access logs in our apps | 24 months |
| Azure diagnostic and security logs | 90 days |
| Records of your requests and complaints | 5 years |
| Anonymised research results | Kept for long-term research. These cannot identify you |
10. How we protect your information
Your answers are stored in secure, access-controlled systems in the UK, and your sign-in account in Europe. Access is limited to authorised staff and logged. Research is carried out using a random code rather than your name or email address (pseudonymisation), and email addresses are replaced with a one-way fingerprint created with a secret key. Media Zoo Limited is certified to ISO 27001, the international standard for information security management, for its software development and learning activities, and we test our safeguards regularly.
11. Your rights
You have the following rights over your information:
| Right | What it means |
|---|---|
| Access | Ask for a copy of the information we hold about you |
| Correction | Ask us to correct information that is inaccurate or incomplete |
| Deletion | Ask us to delete your information |
| Restriction | Ask us to limit how we use your information |
| Objection | Object to our use of your information for research, or any other use based on our legitimate interests. If you object to research use, we will stop using your information for research |
| Portability | Ask for information you have given us in a format you can reuse elsewhere |
| Withdraw consent | Where we rely on your consent (neurodiversity, quotes), withdraw it at any time. This does not affect our use of your information before you withdrew |
How to use your rights. Email [email protected]. If you have a Leadership Lab code, please include it, because without your name, email address or code we may not be able to find your answers. We will respond within one month. For complex requests we may extend this by up to two further months, and we will tell you if we do. There is normally no charge.
Information in anonymised form. Once your information has been anonymised, it can no longer be linked to you, so we cannot identify or delete it. Combined results that have already been published cannot be withdrawn.
If your request concerns the running of your programme, we may pass it to your organisation, which is responsible for that use, and will help it respond.
12. Complaints
If you are unhappy with how we have used your information, please contact us first by emailing [email protected], with "Complaint" in the subject line. We will acknowledge your complaint within 30 days and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. If you are in the EU, see Annex A.
13. Automated decisions
We do not make decisions about you based solely on automated processing. Scores and results are provided to help your own development. The wellbeing check in the Leadership Lab only alerts a member of our team, who decides what action, if any, to take.
14. Changes to this notice
We will update this notice when our practices change. We will tell you about significant changes before they take effect. The version number and effective date are shown at the top.
15. Contact us
Data Protection Officer, Media Zoo Limited, 8 The Boulevard, London SW6 2UB
Email: [email protected]
Annex A: participants in the EU and EEA
This annex applies if you are in a European Union or European Economic Area country when you take part. The EU General Data Protection Regulation (GDPR) applies to our use of your information, alongside the main notice above. The rights, legal bases and safeguards described above apply to you in the same way, with the following additions.
Contact. You can contact us about any matter relating to your information at [email protected].
Legal basis for the wellbeing check. Our legitimate interests in protecting participants' wellbeing, and, where an individual's life or safety is at serious risk, the protection of their vital interests.
Transfers. The European Commission recognises the UK as providing adequate protection for personal data, so your information can be transferred to and stored in the UK. Transfers to the United States are protected as described in section 8: Twilio Inc. (SendGrid), Cloudflare and ActiveCampaign are each certified under the EU-US Data Privacy Framework.
Complaints. You can complain to the data protection authority in the EU country where you live or work, or where you believe a breach occurred. A list of authorities is available from the European Data Protection Board at edpb.europa.eu.
Annex B: participants in Canada, including Quebec
This annex applies if you are in Canada. Canadian privacy law, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector, applies to our use of your information.
Sensitive information. We ask about neurodiversity only with your express consent.
Storage outside Canada. Your information is stored in the United Kingdom, and some is processed in the United States and the European Union (section 8). While it is outside Canada, it is subject to the laws of those countries and may be accessed by their courts, law enforcement and national security authorities in accordance with those laws.
Person in charge of personal information (Quebec). The person responsible for protecting your personal information is Mike Murray, Data Protection Officer. You can contact him at Media Zoo Limited, 8 The Boulevard, London SW6 2UB, or at [email protected].
Your rights. You have the right to access and correct your information, and to withdraw your consent. In Quebec, you also have the right to have your information de-indexed or deleted where its use is unlawful, and to receive your information in a structured, commonly used technological format.
Complaints. You can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca. In Quebec, you can complain to the Commission d'accès à l'information at cai.gouv.qc.ca. In Alberta or British Columbia, you can complain to the provincial Information and Privacy Commissioner.
Annex C: participants in the United States, including California
This annex applies if you are in the United States.
All US participants. We protect your information as described in this notice. If a security incident affects your information, we will notify you as required by the law of the state where you live.
California residents: notice at collection and privacy policy
This section is provided under the California Consumer Privacy Act, as amended.
| Category of personal information | Examples | Purpose | Retention |
|---|---|---|---|
| Identifiers | Name, work email address, Lab code, account details | Running your programme; sending your results | Section 9 |
| Professional information | Organisation, job level, sector, tenure | Running your programme; research | Section 9 |
| Characteristics | Age group, gender identity | Research, as combined results only | Section 9 |
| Sensitive personal information | Neurodiversity (only with your consent); health information that may appear in your written answers | Combined counts for research; running your programme | Section 9 |
| Inferences | Scores and results from assessments | Your own results; research | Section 9 |
| Internet activity | Access and security logs | Security | Up to 24 months |
Sources. We collect this information from you, from your organisation (to set up your course account), and from our systems when you use them.
Disclosure. We disclose personal information to our service providers for the business purposes described in this notice (section 7). We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We do not knowingly collect personal information from anyone under 16.
Your rights. You have the right to:
- know what personal information we collect, use and disclose;
- delete your personal information;
- correct inaccurate personal information;
- limit our use of your sensitive personal information. You can withdraw your consent to the neurodiversity question at any time;
- not be discriminated against for exercising your rights.
How to make a request. Email [email protected]. We will verify your identity before responding, normally by asking for your Lab code or confirming details linked to your course account. You may use an authorised agent to make a request on your behalf; we will ask for proof of their authority. We will respond within 30 days.
Other US states. If you live in a state with its own consumer privacy law, you may have similar rights. Contact us using the details above.