Privacy notice

Who we are

Mango & Co. is the trading name of MWB Property Ltd, registered in England and Wales, company number 12353557, registered office 20-22 Wenlock Road, London N1 7GU. We are the controller of the personal data described here.

For anything about your data, email hello@mangoandco.co.uk.

What this covers

Our websites (mangoandco.co.uk, jobs.mangoandco.co.uk and app.mangoandco.co.uk), asking for a VA Action Plan or our guide, booking a call, referring someone, applying for a role, and working with us as a client or a virtual assistant.

If you ask for a VA Action Plan

We collect your name, business name, email address and your answers about your business: the work you would hand over, your hours, tools and timings. We use them to make your plan, email you the link to set up your login and see it, and follow up about working with us. Our lawful basis is legitimate interests: answering the enquiry you made.

We use AI (Anthropic's Claude) to help write the wording of some plans from your answers.

If you set up a login

We keep your email address. Your password is held by our sign-in provider, Clerk, never by us. The login lets you see your plan, book a call and follow what happens next. Lawful basis: legitimate interests, and steps you asked for before any contract.

If you join our emails or ask for the guide

We keep your name, email address and business name, and send you the guide and a short series of emails about hiring a VA. Every email has an unsubscribe link. Lawful basis: your consent, which you can withdraw at any time.

If you book a call

Calls are booked through Calendly, whose calendar appears on our booking page. We receive your name, email address and the time you chose, and record the call against your enquiry or application. Lawful basis: legitimate interests.

If you refer someone, or were referred

We keep your name and email address and who referred whom. If you choose a cash reward, we collect the name on your bank account, your sort code and account number to pay it. The account number is deleted once we have paid; we keep only its last four digits as a record of the payment. Lawful basis: contract (the referral offer's terms).

If you apply for a role or join our talent register

We collect your name, email, phone or WhatsApp number, where you live, your CV, your work history and written answers, your availability and the hours and pay you want, the specification of your computer and internet connection, the results of any tests we set, a short video if we ask for one, and the names and contact details of your referees and what they tell us. We also record whether text was pasted into the form's boxes, and how much, because some roles test your own writing.

We use these to consider you for roles with UK businesses and to contact you when a suitable role comes up. Lawful basis: legitimate interests (recruiting), and steps before a contract with you. If you give us a referee's details, please tell them.

A bot check (Cloudflare Turnstile) runs when you send the form, to keep out automated applications.

Automatic decisions on applications

Some applications are declined automatically when they are sent, because they do not meet fixed requirements that every role has. They are:

• living in the Philippines;
• being able to work a fixed shift in UK hours;
• a computer and an internet connection that meet the minimum we state on the form;
• pay expectations no higher than the most we pay for the work;
• following the form's written instructions, where the form sets checks on them (for example, a word it asks you to write in the last box, a word limit, or how to name your CV). An application is declined on these only when it misses two or more.

Your right to a person's review

If your application was declined and you think the decision was wrong, email hello@mangoandco.co.uk and a person at Mango & Co. will review it, and you can tell us your side. Applications that pass these checks are read and decided on by a person. We use AI tools (Anthropic's Claude, and a second evaluation model run through Vercel's AI Gateway) to help read them and suggest questions to ask; the decision is always ours.

If you are a client

We keep your company's details, the people we deal with, your role requirements, tasks, messages and procedures, timesheets and reports, and invoices and payment records. Direct Debit and card payments go through Stripe; we never see or store your full bank or card details. Lawful basis: contract, and legal obligation for tax and accounting records.

If you are a VA working with us

We keep your contact details, contract, the hours you work and your timesheets, the work, messages and procedures in the workspace, performance records, and what we pay you. Lawful basis: contract, legal obligation, and legitimate interests.

Messages and calls

Messages in the Mango & Co. workspace are stored in our database. If Slack or WhatsApp is connected, messages sent through them are stored alongside. Calls made from the workspace go through Twilio.

Who helps us handle it

These providers run parts of Mango & Co. for us and handle data only on our instructions. We do not sell your data.

Sharing with clients and VAs

We share a VA's details with the client they work for, and a client's details with their VA, as far as the work needs. We also share data when the law requires it.

Transfers outside the UK

Some of the providers above are in the United States, and our VAs work from the Philippines. When personal data leaves the UK we protect it with one of the safeguards UK law allows: UK adequacy regulations (including the UK-US data bridge for certified US companies), the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Ask us for the safeguard for a particular transfer.

How long we keep it

• Enquiries and VA Action Plans that do not lead to working together: 2 years from our last contact.
• Email subscribers: until you unsubscribe.
• Applicants who are not hired: 12 months, or for as long as you choose to stay on our talent register.
• Referral bank details: the account number is deleted when the reward is paid; the last four digits are kept.
• Client and VA records: 6 years after we stop working together, for tax and legal claims.

Cookies

Our own websites set the cookies needed to keep you signed in and secure. We also use Google Ads cookies, to see which of our ads led to a VA Action Plan or a booked call, but only if you accept them in our cookie banner; decline and none is set. You can change your choice at any time from "Cookie settings" at the foot of our pages. We do not use analytics cookies. We count visits to our public pages without cookies: which page was viewed, which site sent the visitor and whether it was a phone or a computer. No name, email or IP address is kept for this.

Our booking page shows Calendly's calendar, and Calendly may set its own cookies; you choose which through Calendly's cookie banner on that page.

Your rights

You can ask for a copy of your data, have it corrected or deleted, object to or restrict how we use it, move it to another provider, and withdraw consent where we rely on it. Email hello@mangoandco.co.uk and we will reply within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would like the chance to put it right first.

Changes

We update this notice when what we do changes, and change the date at the top.