PRIVACY POLICY

This Privacy Policy applies between you, the User of the Platform, and hood Technologies Ltd, the owner and provider of the Platform. hood takes the privacy of your information very seriously. This Privacy Policy applies to our use of any and all Data collected by us or provided by you in relation to your use of the Platform.

This Privacy Policy should be read alongside, and in addition to, our Terms and Conditions, which can be found at: gethood.app/terms.

Please read this Privacy Policy carefully.

Definitions and Interpretation

In this Privacy Policy, the following definitions are used:

• Data — collectively, all information that you submit to hood via the Platform. This definition incorporates, where applicable, the definitions provided in the Data Protection Laws.
• Cookies — a small text file placed on your computer or device by the Website when you visit certain parts of the Website and/or when you use certain features of the Website. Details of the cookies used by the Website are set out in the clause below (Cookies and Tracking Technologies).
• Data Protection Laws — any applicable law relating to the processing of personal Data, including but not limited to the GDPR, and any national implementing and supplementary laws, regulations and secondary legislation.
• GDPR — the UK General Data Protection Regulation.
• hood Technologies Ltd, hood, we or us — hood Technologies Ltd, a company incorporated in England and Wales with registered number 16569319, whose registered office is at 195 Wood Street, London, E17 3NU.
• Platform — hood's website at gethood.app (and any sub-domains) and hood's mobile applications (iOS and Android), through which the Services are advertised and booked, including all features, content, and tools made available through them.
• Website — hood's website at gethood.app and any sub-domains.
• App — hood's mobile applications for iOS and Android, available through the Apple App Store and Google Play Store.
• UK and EU Cookie Law — the Privacy and Electronic Communications (EC Directive) Regulations 2003 as amended by the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2011 & the Privacy and Electronic Communications (EC Directive) (Amendment) Regulations 2018.
• User or you — any third party that accesses the Platform and is not either (i) employed by hood and acting in the course of their employment or (ii) engaged as a consultant or otherwise providing services to hood and accessing the Platform in connection with the provision of such services.
• Vendor — a third-party provider whose services or experiences are listed on the Platform for booking by Customers and who has entered into hood's Vendor Agreement.
• Customer — a User who books or seeks to book a Service through the Platform.

In this Privacy Policy, unless the context requires a different interpretation: the singular includes the plural and vice versa; references to sub-clauses, clauses, schedules or appendices are to sub-clauses, clauses, schedules or appendices of this Privacy Policy; a reference to a person includes firms, companies, government entities, trusts and partnerships; "including" is understood to mean "including without limitation"; reference to any statutory provision includes any modification or amendment of it; the headings and sub-headings do not form part of this Privacy Policy.

Scope of this Privacy Policy

This Privacy Policy applies only to the actions of hood and Users with respect to the Platform. It does not extend to any third-party websites or services that can be accessed from the Platform including, but not limited to, any links we may provide to social media websites.

For purposes of the applicable Data Protection Laws, hood is the "data controller". This means that hood determines the purposes for which, and the manner in which, your Data is processed.

Data Collected

Depending on your role on hood (Customer, Vendor, or visitor to the Platform), we may collect the following categories of personal Data:

Identity and contact information

• Name
• Email address
• Postal address (where required for billing or service delivery)
• Telephone number (optional)

Account and authentication data

• Username and hashed password
• Account preferences

Family information (Customers)

• The age band and gender of children you are booking activities for, provided by you to enable suitable activity recommendations
• We do not collect children's names, surnames, contact details, dates of birth, or photographs (other than where you choose to include your child in your own profile photograph in your capacity as parent or legal guardian), or other directly identifying information unless you provide them voluntarily

Location data

• The postcode area or borough you are searching in (to suggest local activities)
• With your express permission, more precise location data from your device

Payment data

• Payment card details, processed by our payment processor (Stripe) — we do not store full card numbers on our systems
• Transaction records (amount, date, vendor)

Device and usage data

• Device identifiers (including Apple IDFA and Google Advertising ID, subject to your in-device tracking permissions)
• IP address, browser type, operating system
• Pages visited, features used, time spent on the Platform (see Cookies and Tracking Technologies below)

Communications with us

• The content of any messages, complaints, or support enquiries you send us
• Records of contact we have had with you

User-uploaded content

• Profile photographs, reviews, and messages you choose to upload to the Platform

Vendor-specific data (Vendors only)

• Business name, registered company number, VAT number (where applicable)
• Bank account details (for Payouts, processed by our payment processor)
• Insurance documents, safeguarding certifications, and other compliance evidence

How We Collect Data

We collect Data in the following ways:

• data is given to us by you; and
• data is collected automatically.

Data That is Given to Us by You

hood will collect your Data in a number of ways, for example:

• when you contact us through the Platform, by telephone, post, e-mail or through any other means;
• when you register with us and set up an account to use our services;
• when you elect to receive marketing communications from us;
• when you book a Service through the Platform;
• when you list as a Vendor on the Platform;
• when you provide information to us about your child for activity recommendations;
• when you upload content (such as a profile photograph, review, or message) to the Platform.

Data That is Collected Automatically

To the extent that you access the Platform, we will collect your Data automatically, for example:

• we automatically collect some information about your use of the Platform. This information helps us to make improvements to the Platform's content, navigation, and features, and includes your IP address, the date, times and frequency with which you access the Platform and the way you use and interact with its content;
• on the Website, we will collect your Data automatically via cookies, in line with the cookie settings on your browser;
• in the App, we will collect your Data automatically via embedded analytics SDKs and device identifiers, in line with the tracking permissions you have granted at the device level (e.g. Apple's App Tracking Transparency prompt) and your in-app preferences.

For more information about cookies and other tracking technologies, see the section below, headed "Cookies and Tracking Technologies".

Our Use of Data

We process your Data for the purposes set out below, on the lawful bases stated.

Providing the Services to you

When you register with us and set up an account, or when you book a Service through the Platform, we process your Data to:

• create and manage your account;
• process Bookings and (where the Service is offered for a Fee) payments;
• communicate with you about your Bookings (via in-app messages, push notifications, and email);
• enable Vendors to fulfil the Services you have booked;
• handle cancellations, refunds, and complaints.

Lawful basis: performance of a contract between you and us, and/or taking steps at your request to enter into such a contract.

Direct marketing to Customers

We will send you marketing communications about hood — for example, information about new features, new vendors, promotions, or events — only where you have given us your explicit consent to do so.

You give this consent by ticking the relevant opt-in box when you sign up for an account, or otherwise indicating in an opt-in confirmation that you wish to receive marketing from us. Consent is freely given, specific, informed, and unambiguous.

You may withdraw your consent at any time by clicking the unsubscribe link in any marketing email, or by emailing legal@gethood.app. Withdrawing consent does not affect the lawfulness of processing prior to the withdrawal.

Lawful basis: consent.

(Brevo and HubSpot, as the platforms that hold this data, are named in International Data Transfers below.)

Business outreach (Vendors, partners, and public-sector contacts)

Where we contact individuals in their professional capacity at business, charity, or public-sector organisations — for example, to invite a business to list its services on hood, or to discuss a partnership — we process their personal Data (name, job title, work email address, organisation) on the basis of legitimate interests.

The legitimate interest we pursue is operating and growing the hood marketplace. We have carried out a Legitimate Interests Assessment (LIA) and determined that the impact on individuals is minimal: we contact people only at their work address and only in connection with their professional role, we include a clear opt-out in every communication, and we honour opt-outs immediately.

You can opt out of this processing at any time by contacting legal@gethood.app or using the opt-out link in any email we send you. Our LIA is available on request.

Lawful basis: legitimate interests.

Improving the Service

We process your usage data, device data, and feedback to improve how the Platform works, identify bugs, and develop new features.

We may also derive aggregated and anonymised insights from data on the Platform — for example, platform-wide booking patterns, popular categories by borough, or activity demand trends — for product development, market research, and similar purposes. Once data has been aggregated and anonymised in this way it is no longer personal data and is outside the scope of this Policy.

Lawful basis: legitimate interests.

Compliance with legal obligations

We process your Data where we are required to do so by law — for example, to maintain financial records for tax purposes, to respond to lawful requests from public authorities, to comply with reporting obligations under HMRC's Digital Platform Reporting rules, or to investigate complaints relating to safeguarding.

Lawful basis: legal obligation.

Sharing your Data with Vendors to fulfil a Booking

When you make a Booking, we share with the Vendor only the data necessary to fulfil it: your name, contact details, Booking reference, Service details, and (where you have provided them) the age band and gender of any children attending. The Vendor is required under our Vendor Agreement to use this information solely to fulfil the Booking and not to market to you outside the Platform without your separate consent. For the purposes of UK data protection law, the Vendor acts as an independent data controller in respect of the data we share with them: once it is shared, the Vendor determines its own purposes and means for handling that data (for example, delivering the Service and keeping its own business records) and is independently responsible for complying with data protection law.

Lawful basis: performance of a contract between you and us.

Retargeting / advertising on other websites — not in use. hood does not currently run retargeted advertising on other websites. If we introduce retargeting in future, we will update this Policy, give you the opportunity to consent (for tracking cookies) and will not begin tracking you for this purpose without your consent.

Children's Data and the Age Appropriate Design Code

hood is a service for parents and carers. The Platform is not directed at children under 18, and children do not create accounts on hood.

However, parents using hood may provide us with limited information about their children — age band and gender — in order to receive suitable activity recommendations. Parents may also, in their capacity as legal guardian, choose to include their child in their own profile photograph (see User Content in the Terms and Conditions).

We treat this information as children's personal Data under the UK GDPR and the ICO's Age Appropriate Design Code, and we apply the following safeguards:

• Data minimisation — we collect only the minimum information needed for the purpose. We do not collect children's names, surnames, dates of birth, contact details, or other directly identifying information.
• Privacy by default — children's Data is not used to profile individual children, to deliver targeted advertising, or for behavioural marketing.
• No sharing with third parties for marketing purposes.
• Retention — we retain children's Data only for as long as the parent's account remains active, and we delete it on request.
• Parental control — parents can view, correct, or delete the information they have provided about their children at any time via their account or by contacting legal@gethood.app.

Aggregated and anonymised insights. hood may derive aggregated and anonymised insights from data on the Platform — for example, popular age-band-to-activity combinations across the platform as a whole, or busy booking periods by borough. These aggregated insights do not identify any individual child or family, are not used to deliver advertising or marketing to children, and may be used by hood for product development, market research, and similar purposes. Once data has been aggregated and anonymised in this way it is no longer personal data and is outside the scope of this Policy.

If we have reasonable grounds to believe an account has been created by, or is being used by, a person under 18, we will suspend the account, cancel any pending Bookings, and delete the associated personal Data, save for data we are required to retain by law.

Keeping Data Secure

We will use technical and organisational measures to safeguard your Data, for example:

• access to your account is controlled by a password and a user name that is unique to you;
• we store your Data on secure servers.

Technical and organisational measures include measures to deal with any suspected data breach.

If you suspect any misuse or loss or unauthorised access to your Data, please let us know immediately by contacting us at legal@gethood.app.

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

Data Retention

We retain your Data only for as long as is necessary for the purposes for which it was collected, after which we will delete or anonymise it. Our default retention periods are:

Category	Retention period
Account data (active accounts)	For the lifetime of your account, plus 30 days after closure to allow reactivation
Booking records	6 years from the date of the Booking, to meet HMRC record-keeping requirements
Children's data	For the lifetime of the parent's account, deleted on request or on account closure
Financial records (transactions, invoices, payouts)	6 years from the end of the tax year to which they relate (HMRC requirement)
Marketing data (consent and contact records)	Until consent is withdrawn, then deleted within 30 days
Business outreach records (LIA-based)	2 years from last contact, or until opt-out; opt-out records held indefinitely as a suppression list
Cookie data	Per the retention period set out in the Cookies Schedule below
Communications with us (support, complaints)	3 years from the last interaction

Even after deletion, your Data may persist on backup or archival media for a limited period for legal, tax, or regulatory purposes.

Your Rights

You have the following rights in relation to your Data:

• Right to access — the right to request (i) copies of the information we hold about you at any time, or (ii) that we modify, update or delete such information. If we provide you with access to the information we hold about you, we will not charge you for this, unless your request is "manifestly unfounded or excessive." Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why.
• Right to correct — the right to have your Data rectified if it is inaccurate or incomplete.
• Right to erase — the right to request that we delete or remove your Data from our systems. You may also exercise this right by closing your account through the self-serve account-closure function in the App (where available) or by emailing us.
• Right to restrict our use of your Data — the right to "block" us from using your Data or limit the way in which we can use it.
• Right to data portability — the right to request that we move, copy or transfer your Data.
• Right to object — the right to object to our use of your Data including where we use it for our legitimate interests.

To make enquiries, exercise any of your rights set out above, or withdraw your consent to the processing of your Data (where consent is our legal basis for processing your Data), please contact us at legal@gethood.app.

If you are not satisfied with the way a complaint you make in relation to your Data is handled by us, you may refer your complaint to the Information Commissioner's Office (ICO) at https://ico.org.uk/.

It is important that the Data we hold about you is accurate and current. Please keep us informed if your Data changes during the period for which we hold it.

Links to Other Websites and Services

The Platform may, from time to time, provide links to other websites or third-party services. We have no control over such websites or services and are not responsible for their content. This Privacy Policy does not extend to your use of such websites or services. You are advised to read the privacy policy or statement of any third party prior to using it.

Changes of Business Ownership and Control

If hood Technologies Ltd is sold, merged with another business, restructured, or enters administration or insolvency, your personal Data may be transferred to the acquiring or successor entity, or to advisors involved in the transaction (subject to confidentiality undertakings).

In any such transfer:

• the recipient will be bound by data protection obligations no less protective than those set out in this Privacy Policy;
• your Data will continue to be processed only for the purposes for which it was originally collected, unless we (or the successor entity) notify you of new purposes and obtain a new lawful basis where required;
• we will notify you of any material change in the controller of your personal Data within a reasonable period after the transaction completes;
• your rights under the UK GDPR — including the right to object, the right to erasure, and the right to portability — continue to apply against the new controller.

We may also disclose Data to a prospective purchaser of our business or any part of it, subject to confidentiality undertakings.

International Data Transfers

Our payment processor is Stripe Payments UK Limited, a UK entity. Payment data processed through Stripe is handled within the UK and does not rely on an international transfer mechanism.

We use HubSpot, Inc. and Brevo (Sendinblue SAS) to capture, store, and manage the contact details you provide when registering your interest through our website — as a parent or as a business partner — and to send marketing communications where you have given consent (see Direct marketing to Customers and Business outreach above).

Brevo hosts this data within the EU (France, Germany, and Belgium); as the UK recognises the EU/EEA as offering an adequate level of data protection, this does not require Standard Contractual Clauses or any additional transfer safeguard.

HubSpot is a US-based provider; transfers of your Data to HubSpot are made under the UK Extension to the EU–US Data Privacy Framework, under which HubSpot is certified.

hood may also use analytics tools such as PostHog to understand how the Platform is used. Where this (or a similar) processor is based outside the UK, transfers of your Data to it are made under the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it, or under Standard Contractual Clauses (SCCs) with appropriate supplementary measures.

Cookies and Tracking Technologies

hood uses cookies (on the Website) and analogous tracking technologies (in the App) to improve your experience of using the Platform. hood has carefully chosen these technologies and has taken steps to ensure that your privacy is protected and respected at all times.

All cookies and tracking technologies used by the Platform are used in accordance with current UK and EU Cookie Law and applicable mobile operating system rules.

Website cookies

The Website currently offers a simple registration form for parents and business partners to share their contact details and register interest in hood. It does not currently provide account login, checkout, or Booking functionality — that functionality is provided through the App. This section will be updated as the Website's functionality expands.

The cookies currently used on the Website relate to this registration form and to understanding how visitors use the site generally, via our provider HubSpot, Inc. (see International Data Transfers above). (hood is implementing a cookie consent banner that will let you accept or decline non-essential cookies by category and withdraw consent at any time — until it is live, please note HubSpot's cookies may be set when you visit or interact with the Website.) You can control or delete cookies at any time via your browser settings, as described below.

You may, if you wish, deny consent to non-essential cookies via your browser; however certain features of the Website may not function fully or as intended.

The Website currently uses the following categories of cookies:

• Strictly necessary cookies — none are currently set directly by hood on the Website, as it does not provide account login or checkout. This will be updated if that changes.
• Functionality cookies — none currently in use on the Website.
• Analytical / performance cookies — set by HubSpot to help us understand how visitors use the Website, for example how many people visit and which pages they view.
• Marketing cookies — set by HubSpot to record your registration-form submission and associate it with your contact record, for the marketing/business-outreach purposes described in Direct marketing to Customers and Business outreach above. We do not currently set any other marketing or retargeting cookies (for example, via Meta, Google Ads, or LinkedIn); if we introduce these in future, we will update this Policy and obtain your consent first.

You can find a list of the specific cookies that we use in the Cookies Schedule at the end of this Policy.

You can choose to enable or disable cookies in your internet browser. By default, most internet browsers accept cookies but this can be changed. For further details, please see the help menu in your internet browser. You can switch off cookies at any time; however, you may lose any information that enables you to access the Website more quickly and efficiently.

For more information generally on cookies, including how to disable them, please refer to aboutcookies.org.

In-App tracking technologies

The App does not use cookies in the browser sense. Instead, the App relies on the following technologies:

• Software Development Kits (SDKs) — third-party SDKs (such as PostHog for product analytics; Stripe for payments) collect usage and device data to support the functions of the App.
• Device identifiers — for example, Apple's Identifier for Advertisers (IDFA) on iOS, and Google's Advertising ID on Android. Where required by the operating system (e.g. Apple's App Tracking Transparency prompt on iOS), we will ask for your permission before tracking you across other apps and websites. You can change this permission at any time in your device settings.
• Push notification tokens — to deliver app notifications (e.g. booking reminders). You can disable push notifications in your device settings or in the App's preferences.
• In-app preferences — alongside the operating-system controls above, the App provides in-app preferences to opt out of non-essential tracking.

General

You may not transfer any of your rights under this Privacy Policy to any other person. We may transfer our rights under this Privacy Policy where we reasonably believe your rights will not be affected.

If any court or competent authority finds that any provision of this Privacy Policy (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this Privacy Policy will not be affected.

Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.

This Agreement will be governed by and interpreted according to the law of England and Wales. All disputes arising under the Agreement will be subject to the exclusive jurisdiction of the English and Welsh courts.

Changes to This Privacy Policy

hood reserves the right to change this Privacy Policy as we may deem necessary from time to time or as may be required by law.

For material changes (for example, a change in the categories of Data we collect, a new lawful basis, a new category of recipient, or a material change in retention periods) we will notify you by email to the address on your account, and we will give you a reasonable period to review the changes before they take effect.

For non-material changes (for example, typographical corrections or clarifications that do not affect your rights), we will post the updated Policy on the Platform and your continued use of the Platform after that date is taken as acceptance of the change.

You may contact hood by email at legal@gethood.app.

This Privacy Policy was last updated on 2026-06-10.

---

Cookies Schedule

Below is a list of the Cookies that the Website uses. We have tried to ensure this is complete and up to date, but if you think we have missed a cookie or there is any discrepancy, please let us know.

(In-App tracking technologies are described in the "Cookies and Tracking Technologies" section above. SDKs and device identifiers are not browser cookies and are listed there.)

Strictly necessary

None currently — the Website does not provide account login or checkout (that functionality sits in the App). This table will be updated if that changes.

Functionality

None currently in use on the Website.

Analytical / Performance

Cookie / Provider	Purpose
HubSpot, Inc.	Helps us understand how visitors use the Website — page views and navigation. See legal.hubspot.com/privacy-policy.

(PostHog is App-only and is not used on the Website — see "In-App tracking technologies" above.)

Marketing

Cookie / Provider	Purpose
HubSpot, Inc.	Records your registration-form submission and associates it with your contact record, for the marketing/business-outreach purposes described in Direct marketing to Customers and Business outreach above.

We do not currently set any other marketing or retargeting cookies on the Website (for example, via Meta, Google Ads, or LinkedIn). If we add any in future, we will update this schedule and obtain your consent before setting any such cookies.