1. Introduction
Thrivespace ("Platform") is operated by SoTech Studio Ltd ("we", "us" or "our"), a company registered in England and Wales. This Privacy Policy explains what personal data we collect when you visit our website or use the Platform, what we do with it and the rights you have.
2. Two kinds of data
There are two kinds of personal data in this policy, and we play a different part in each.
- Data about our customers and visitors. For example, the details on a trial request, or who pays for a Subscription. Here we decide how the data is used, so we are the data controller.
- Data your organisation puts into the Platform. For example, training records and certificates. Here your organisation decides how it is used and is the data controller. We process it for them, as a data processor, under our Data Processing Agreement. See section 13.
3. What we collect
When you request a trial or contact us
- Your name, work email address and phone number if you give it
- Your organisation's name and size
- Whether you would like a call, and whether you want product updates
- What you write to us
When you use the Platform
- Your name, email address, job title and profile photo if you add one
- Your sign-in details (your password is stored only as a hash we cannot read)
- How the Platform is used, through product analytics (see section 9)
- Error reports when something goes wrong (see section 9)
When you pay
- Your organisation's name and the billing contact's email address. Card details are entered on our payment provider's own pages and never reach us.
What your organisation puts into the Platform
Depending on the parts your organisation uses, this can include training records and certificates, credentials, memberships and qualifications, learning events and reflections, goals, reviews, 1-to-1 notes, skills, recognition, announcements and anonymous wellbeing check-ins.
4. How we use it
- To review trial requests and decide whether to offer a trial
- To provide, run and support the Platform
- To take payment for Subscriptions
- To understand how the Platform is used, so we can improve it
- To find and fix faults and keep the Platform secure
- To reply to you when you contact us
- To send product updates, only if you have asked for them
- To meet our legal obligations
5. Our legal basis
Under the UK General Data Protection Regulation (UK GDPR) we rely on:
- Contract: to provide the Platform to customers, and to take steps you ask for before a contract, such as reviewing a trial request
- Legitimate interests: to run, secure and improve the Platform, and to reply to enquiries, where this does not override your rights
- Consent: to send product updates. You can withdraw it at any time
- Legal obligation: where the law requires us to keep or share data
6. Who we share it with
We do not sell personal data.
We use a small number of companies to run the Platform, such as our hosting, database, email and payment providers. They may only use the data to provide their service to us. Every one of them is listed on our Subprocessors page.
We may also share data:
- Where the law requires it, for example a court order
- If our business, or part of it, is sold. We would tell you before your data came under a new owner's privacy policy.
- With your consent
7. How long we keep it
- Trial requests that do not become a customer are deleted 12 months after the request.
- Platform data is kept while your organisation uses Thrivespace. Afterwards it is deleted as set out in our Terms of Service and Data Processing Agreement.
- Billing records are kept for six years, as UK tax law requires.
- Emails to us are kept for as long as we need them to deal with what you asked, and no longer than two years.
8. How we protect it
Data is encrypted in transit and where it is stored, each organisation's data is kept apart from every other's, and access is limited by permissions. Our Security page has the detail. No system is completely secure, but we work hard to protect your data.
9. Cookies, analytics and error reports
Cookies
The Platform uses only the cookies it needs to work: to keep you signed in, and to show dates, times and numbers in your language and timezone. It uses no advertising or tracking cookies. The website sets no cookies. If you close the announcement bar at the top of the website, your browser remembers that choice on your own device.
Product analytics
Inside the Platform we use PostHog, hosted in the European Union, to see which pages and features are used so we can improve them. It sets no cookies and stores nothing on your device. You are identified only by an internal account ID and your organisation, never by name or email address. On-screen text is masked, so we see that a button or row was clicked but not what it said. Your IP address is discarded and not used to work out your location. We do not record sessions, and analytics pause while our support team is viewing an account to help you.
Error reports
When something goes wrong in the Platform, a report is sent to Sentry, in the European Union, so we can fix it. Reports leave out your name and email address, what you typed and cookies.
10. Data that leaves the UK
Some of the companies we use are outside the United Kingdom. Where data is transferred abroad, it is protected by Standard Contractual Clauses with the UK Addendum, or by a UK adequacy decision.
11. Your rights
Under the UK GDPR you have the right to:
- Ask for a copy of your personal data
- Ask us to correct it
- Ask us to delete it, in some circumstances
- Ask us to restrict how we use it, in some circumstances
- Ask for your data in a form you can take elsewhere, in some circumstances
- Object to how we use it, in some circumstances
- Withdraw consent you have given, at any time
To use any of these rights, email privacy@thrivespace.space. We will reply within one month.
If your request is about data your organisation put into the Platform, we will pass it to your organisation, because they decide how that data is used.
12. Automated decisions
We do not make decisions about people by automated means alone. Statuses in the Platform, such as "Overdue soon", are worked out from dates and rules your organisation sets, and people decide what to do about them.
13. Data your organisation puts into the Platform
When your employer or organisation uses Thrivespace, they are the data controller for the personal data they put into it about you. We process it only on their instructions.
If you have a question about how your organisation uses your data in Thrivespace, ask them first. They may have their own data protection contact.
14. Children
The Platform is for organisations and their staff. It is not meant for anyone under 16, and we do not knowingly collect their data.
15. Links to other websites
Our website links to other sites. We are not responsible for how they handle your data, so please read their privacy policies.
16. Product updates
If you ask for product updates, you can stop them at any time by using the unsubscribe link in any update, or by emailing privacy@thrivespace.space.
17. If there is a breach
If a breach of personal data is likely to put people's rights at risk, we will tell the Information Commissioner's Office within 72 hours of becoming aware of it, where we can. If the risk is high, we will also tell the people affected without undue delay.
18. Changes to this policy
We will update this policy when the way we handle personal data changes, and change the date at the top. We will tell customers about important changes by email or in the Platform.
19. Contact us
Questions about this policy or your data go to:
SoTech Studio Ltd
Email: privacy@thrivespace.space
You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk (opens in a new tab).