Privacy Policy

Last updated 24 September 2026

This Privacy Policy explains how and why MENSCH collects, uses, stores and protects personal data when you:

• Visit our website (www.mensch.club);
• Contact us via our website;
• Engage with us in a professional capacity; or
• Receive business-to-business communications from us.

It also explains your rights under applicable data protection laws, including the Protection of Personal Information Act (POPIA), the UK General Data Protection Regulation (UK GDPR), and the EU General Data Protection Regulation (EU GDPR). We collect limited personal data and only process it where we have a lawful basis to do so. We may update this Privacy Policy from time to time. The latest version will always be published on this page. If we make material changes, we will update the “Last updated” date. If you have questions about this Policy or how we handle personal data, contact: weare@mensch.club

1. Who we are

This website is operated by:

For the purposes of data protection law, we act as a data controller unless otherwise stated.

2. Personal data we collect

2.1 Contact form data. When you contact us via our website, we may collect:

• Name
• Email address
• Company name
• Any information you include in your message

We use this data to respond to your enquiry and assess potential business relationships.

2.2 Analytics and technical data. We use Google Analytics and PostHog (product analytics, hosted in the European Union) to collect:

• IP address
• Device type and browser information
• Operating system
• Pages visited
• Time spent on pages
• Referral source
• How you use a page: clicks, scrolling, and whether a form was completed
• Session replays: a reconstruction of how a page was used, with anything you type masked before it leaves your browser

This information is used to understand website performance and improve user experience. Analytics and session replay only run after you accept Statistics cookies via our cookie banner; without that consent nothing is recorded. Private pages we share with clients are never recorded.

2.3 Business-to-business outreach. We may collect professional contact details such as:

• Name
• Job title
• Company
• Work email address

We do this where we identify a legitimate professional alignment with our services. This processing is based on legitimate interest. You may object at any time (see Section 9).

2.4 Client and project data (not collected via website). In the course of delivering brand services, we may process:

• Client contact details
• Workshop participant names and professional information
• Project-related communications
• Information voluntarily shared during brand or strategy sessions

We do not process payments or billing data via our website. Client and project data may be stored in secure cloud-based systems, including platforms such as Google Drive, Notion, or equivalent tools used in our operations.

Depending on the engagement, we may act as a data controller (where we determine how and why personal data is processed); or a data processor (where we process data on a client’s documented instructions).

2.5 Free tools and downloads. When you request a free tool from our Lab (for example the Content Pack kit), we collect:

• Name
• Email address
• Company name

We use this data to send you the tool and, occasionally, the research we make with it. Every such email carries an unsubscribe link, and you can ask us to delete your details at any time (see Section 9). The download form is protected against automated abuse by Cloudflare Turnstile, which processes your IP address and browser information to tell a person from a bot; Cloudflare's privacy policy applies to that check. The tool itself, once downloaded, runs on your own computer and sends nothing to us.

3. Lawful basis for processing

We process personal data on the following lawful bases:

• Consent — where you accept cookies or voluntarily submit information
• Legitimate interest — for B2B outreach, website improvement and business development
• Contractual necessity — where processing is required to deliver agreed services
• Legal obligation — where required under applicable law

Where we rely on legitimate interest, we ensure that such processing does not override your rights and freedoms.

4. Cookies

We use cookies to ensure core website functionality, analyse traffic and usage, and improve performance and user experience. Analytics cookies (Google Analytics, PostHog) are set only after you accept Statistics cookies. You can manage or withdraw consent to non-essential cookies at any time through our cookie banner.

5. Sharing of personal data

We may share personal data with trusted service providers, including:

• Website hosting providers
• Cloudflare (bot protection on download forms)
• Google (analytics services)
• PostHog (product analytics, EU-hosted)
• Cloud storage providers (e.g. Google Drive, Notion or similar platforms)
• Professional advisers where legally required

We do not sell personal data. We may disclose personal data where required by law or regulatory authorities.

6. International transfers

Because we operate globally and use international service providers, personal data may be transferred outside South Africa, the UK or the European Economic Area. Where this occurs, we implement appropriate safeguards, including standard contractual clauses, contractual data protection commitments, and transfers to jurisdictions with recognised adequacy decisions. All international transfers are conducted in compliance with POPIA and applicable GDPR requirements.

7. Data retention

We retain personal data indefinitely unless you request deletion; we determine the data is no longer necessary; or we are legally required to retain or delete it for a specific period. Where legally permissible, we will delete personal data upon verified request.

8. Data security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration and unlawful disclosure. However, no internet-based system can be guaranteed to be completely secure.

9. Your rights

Depending on your location, you may have the right to:

• Request access to your personal data
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing
• Withdraw consent (where processing is based on consent)
• Request data portability
• Lodge a complaint with your relevant data protection authority

If you are located in South Africa, you may contact the Information Regulator. In the United Kingdom, you may contact the Information Commissioner’s Office (ICO). In the European Union, you may contact your local Data Protection Authority.

To exercise your rights, contact: weare@mensch.club

10. Updates to this policy

We may update this Privacy Policy from time to time. The most current version will always be published on this page with the updated date. This Privacy Policy was last updated on 24 September 2026.