Privacy Policy

Thryve Leader Retreats — Privacy Policy

Last updated: 11 June 2026

This Privacy Policy explains how Thryve Pro Academy (company number 16573922), trading as Thryve Leader Retreats ("we", "us", "our"), collects, uses, stores, and protects your personal data when you visit our website or book our online wellbeing retreat services.

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

This Privacy Policy should be read alongside our Terms and Conditions, which are available on our website. Where our Terms and Conditions contain a summary of our data protection practices (Section 9), this Privacy Policy provides the full detail.

  1. Who We Are

Thryve Pro Academy is a company registered in England and Wales (company number 16573922), with its registered office at 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE. We trade as Thryve Leader Retreats.

For the purposes of UK data protection law, we are the data controller responsible for your personal data.

Data protection contact: Michael Chalmers, Sole Director

Email: hello@thryve3.com

Postal address: 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE

ICO registration number: ZC019699

We are not required under UK GDPR to appoint a Data Protection Officer (DPO) because we are a small organisation that does not carry out large-scale processing of special category data or large-scale systematic monitoring. Our sole director serves as the primary data protection contact and is responsible for overseeing compliance with this Privacy Policy.

  1. What Personal Data We Collect

We collect and process the following categories of personal data:

Information you provide to us:

  1. Booking and account information — your name, email address, and phone number, provided when you book a retreat or contact us.
  2. Payment information — your payment card details are processed by our payment provider, Stripe. We do not store your full payment card details. We retain only transaction records (amounts, dates, and confirmation references) for our accounting records.
  3. Communications — any correspondence you send to us by email, through our website, or via other channels, including any information you include in those messages.

Information that may be disclosed during retreats:

  1. Health information — we do not systematically collect health information. However, if you voluntarily disclose health information (for example, by informing an instructor of a physical limitation via private message on Zoom during a retreat), we will treat this as special category data under UK GDPR. We encourage you to share any health information directly with your instructor via private Zoom message so that it is not processed or stored by us. Where we do receive health information, we process it solely to facilitate your safe participation in the retreat and delete it promptly after the retreat concludes.

Information collected automatically:

  1. Website analytics data — when you visit our website, we collect information about how you use it through Google Analytics, including pages visited, time spent on pages, referral sources, browser type, device type, and approximate geographic location (at city level). This data is collected using cookies and is typically pseudonymised.
  2. Cookie data — our website uses cookies, including Google Analytics cookies and basic session and functional cookies. Full details are set out in Section 10 of this Privacy Policy.
  1. How We Use Your Personal Data

We use your personal data for the following purposes:

  1. Processing your bookings — to confirm your retreat booking, send joining instructions, and provide the services you have purchased.
  2. Providing our services — to deliver our online retreat experiences, including facilitating access to Zoom sessions and communicating retreat schedules and updates.
  3. Processing payments — to take payment for our services through our payment provider, Stripe, and to maintain financial records.
  4. Communicating with you — to respond to your enquiries, provide customer support, and send important service-related communications (such as changes to retreat schedules or our terms).
  5. Marketing communications — where you have booked our services, we may use your email address to send you information about similar programmes, retreats, and wellness offerings from Thryve Leader Retreats (soft opt-in under PECR Regulation 22). You will be informed of this at the point of booking and every such email will include a clear and easy way to opt out of future communications. We will not sell, rent, or share your personal data with third parties for their own marketing purposes.
  6. Improving our services — to analyse how our website is used and to improve our website content, user experience, and service offerings.
  7. Legal and regulatory compliance — to comply with applicable legal obligations, including financial record-keeping requirements under the Companies Act 2006 and HMRC regulations.
  8. Facilitating safe participation — where you voluntarily disclose health information, to enable our instructors to adapt activities to accommodate your needs during a retreat.

Nature of data provision — Booking and account information (your name, email address, phone number, and payment details) is required to enter into and perform a contract with you. If you do not provide this information, we will be unable to confirm your booking or deliver the retreat services. Health information is voluntary — you are not required to provide it, and you may participate in our retreats without doing so. Website analytics data is collected via cookies only where you have provided consent, which you may withhold or withdraw at any time without affecting your ability to use the website.

  1. Lawful Bases for Processing

Under UK GDPR, we must have a lawful basis for each processing activity. The table below sets out how we rely on the lawful bases provided by Article 6(1) and, where applicable, Article 9(2) of UK GDPR.

Processing Activity

Lawful Basis (Article 6)

Additional Basis (Article 9, where applicable)

Processing bookings and providing retreat services

Article 6(1)(b) — performance of a contract

Not applicable

Processing payments via Stripe

Article 6(1)(b) — performance of a contract

Not applicable

Sending service-related communications (booking confirmations, schedule changes)

Article 6(1)(b) — performance of a contract

Not applicable

Retaining financial and payment records for tax and accounting purposes

Article 6(1)(c) — legal obligation (Companies Act 2006, HMRC requirements)

Not applicable

Sending marketing communications about similar services (soft opt-in)

Article 6(1)(f) — legitimate interests (promoting our services to existing customers)

Not applicable

Website analytics via Google Analytics

Article 6(1)(a) — consent (via cookie consent)

Not applicable

Processing voluntarily disclosed health information to facilitate safe retreat participation

Article 6(1)(a) — consent

Article 9(2)(a) — explicit consent

Responding to enquiries and customer support

Article 6(1)(f) — legitimate interests (providing responsive customer service)

Not applicable

Improving our website and service offerings

Article 6(1)(f) — legitimate interests (developing and improving our services)

Not applicable

Where we rely on legitimate interests as the lawful basis, we have conducted a balancing assessment and are satisfied that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests at any time (see Section 8).

  1. Who We Share Your Data With

We do not sell, rent, or trade your personal data. We share your personal data only with the following categories of third-party service providers who process data on our behalf:

Service Provider

Purpose

Location

Transfer Safeguard

Stripe

Payment processing

United States

UK-US Data Bridge (Stripe is a certified participant under the UK Extension to the EU-US Data Privacy Framework)

Zoom

Video conferencing platform for delivering online retreats

United States

UK International Data Transfer Agreement (IDTA) and supplementary measures

Google (Google Analytics)

Website analytics and usage tracking

United States

UK-US Data Bridge (Google LLC is a certified participant under the UK Extension to the EU-US Data Privacy Framework)

Tilda

Website building and hosting

Germany and United States (distributed infrastructure)

Standard Contractual Clauses (SCCs) as set out in Tilda's Data Processing Agreement (available at https://tilda.cc/dpa/). Tilda's primary infrastructure is hosted by Hetzner (Germany) and G-Core Labs, with servers located in Germany and the United States

Each of these providers acts as a data processor and processes your data only on our instructions and in accordance with UK data protection law. We have appropriate contractual arrangements in place with each provider.

We may also disclose your personal data where required to do so by law, regulation, or court order, or to protect our rights or the rights of third parties.

  1. International Data Transfers

Some of the third-party service providers we use are based outside the United Kingdom. When we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place to protect your data, in compliance with UK GDPR Articles 44 to 49.

The safeguards we rely on include:

  1. UK-US Data Bridge — for transfers to US-based organisations that are certified participants under the UK Extension to the EU-US Data Privacy Framework (including Stripe and Google). The UK-US Data Bridge has been recognised by the UK Government as providing an adequate level of protection for personal data.
  2. UK International Data Transfer Agreement (IDTA) — for transfers to US-based organisations that are not covered by the UK-US Data Bridge, we use the UK IDTA approved by the Information Commissioner's Office, together with a transfer risk assessment.
  3. Standard Contractual Clauses (SCCs) — where appropriate, we use Standard Contractual Clauses approved by the European Commission (with the UK Addendum) to ensure adequate protection for transfers.
  4. Supplementary measures — where necessary, we implement additional technical and organisational measures to ensure that the level of protection required by UK GDPR is maintained.

You may request a copy of the safeguards we have put in place by contacting us using the details in Section 1.

  1. How Long We Keep Your Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected or as required by law. Our specific retention periods are as follows:

Data Category

Retention Period

Reason

Financial and payment records (transaction amounts, dates, references)

6 years from the end of the financial year in which the transaction occurred

Companies Act 2006, section 386; HMRC record-keeping requirements

Participant and booking data (name, email, phone number)

Duration of our relationship with you, plus 2 years

Legitimate business need; limitation period for contractual claims

Health information (voluntarily disclosed)

Deleted promptly after each retreat

Minimisation principle — retained only for the duration strictly necessary

Website analytics data (Google Analytics)

26 months

Google Analytics default retention period

Marketing consent records

Until you withdraw consent, plus 1 year

To evidence that consent was obtained and when it was withdrawn

Correspondence and enquiries

2 years from the date of last correspondence

Customer service and dispute resolution

When your personal data is no longer required, we will securely delete or anonymise it.

  1. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

  1. Right of access — you have the right to request a copy of the personal data we hold about you (a "data subject access request" or "DSAR").
  2. Right to rectification — you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
  3. Right to erasure — you have the right to request that we delete your personal data in certain circumstances (for example, where it is no longer necessary for the purpose for which it was collected).
  4. Right to restriction of processing — you have the right to request that we restrict the processing of your personal data in certain circumstances (for example, where you contest the accuracy of the data).
  5. Right to data portability — you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where the processing is based on consent or contract performance and is carried out by automated means.
  6. Right to object — you have the right to object to processing of your personal data where we rely on legitimate interests as the lawful basis, or where we process your data for direct marketing purposes. Where you object to direct marketing, we will stop processing your data for that purpose immediately.
  7. Right to withdraw consent — where we process your personal data on the basis of your consent (for example, health information or analytics cookies), you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
  8. Rights relating to automated decision-making — you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects you. We confirm that we do not carry out any automated decision-making or profiling using your personal data.
  1. How to Exercise Your Rights

To exercise any of your data protection rights, please contact us:

Email: hello@thryve3.com

Post: Michael Chalmers, Thryve Pro Academy, 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE

What to include in your request: Please provide your full name, email address (or other details we can use to identify you), and a clear description of the right you wish to exercise.

Identity verification: To protect your data, we may need to verify your identity before responding to your request. We will ask you to provide sufficient information to confirm you are the person whose data the request relates to.

Response timeframe: We will respond to your request within one calendar month of receiving it. If your request is complex or we receive a large number of requests, we may extend this period by a further two months. If so, we will inform you within the first month and explain the reason for the extension.

Cost: We will not normally charge a fee for handling your request. However, if your request is manifestly unfounded or excessive (for example, if you make repetitive requests), we may charge a reasonable administrative fee or refuse the request.

Complaints: If you are not satisfied with our response, or if you believe we are processing your personal data in a way that is not compliant with UK data protection law, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Telephone: 0303 123 1113

Website: https://ico.org.uk

Email: icocasework@ico.org.uk

We encourage you to contact us first so that we can try to resolve any concerns before you escalate to the ICO.

  1. Cookies

Our website uses cookies to ensure it functions correctly and to help us understand how visitors use the site.

What are cookies? Cookies are small text files placed on your device (computer, tablet, or smartphone) when you visit a website. They are widely used to make websites work efficiently and to provide information to website owners.

Types of cookies we use:

Cookie Type

Purpose

Duration

Consent Required

Strictly necessary / functional cookies

Essential for the website to function properly, including maintaining your session, remembering your preferences, and enabling core website features

Session (deleted when you close your browser) or up to 12 months

No — these are exempt under PECR Regulation 6(4) as they are strictly necessary for the service you have requested

Google Analytics cookies (_ga, _gid, _gat)

Used to collect anonymous information about how visitors use our website, including which pages are visited most often, how visitors navigate the site, and whether error messages are displayed. This information helps us improve the website

_ga: 26 months; _gid: 24 hours; _gat: 1 minute

Yes — we obtain your consent before setting analytics cookies, in accordance with PECR Regulation 6

Managing your cookie preferences: When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or reject non-essential cookies (including Google Analytics cookies). You can change your cookie preferences at any time by clearing your cookies and revisiting the site, or by adjusting your browser settings.

Browser settings: Most web browsers allow you to control cookies through their settings. You can set your browser to refuse all cookies, accept only certain cookies, or notify you when a cookie is being placed. Please note that disabling cookies may affect the functionality of our website.

For more information about cookies and how to manage them, visit www.allaboutcookies.org.

  1. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or damage. These measures include:

  1. Using secure, encrypted connections (HTTPS/TLS) for data transmitted through our website.
  2. Ensuring that payment card data is processed by Stripe, which is certified to PCI DSS Level 1 (the highest level of payment card security certification). We do not store your full payment card details.
  3. Restricting access to personal data to authorised personnel who need it to perform their duties.
  4. Regularly reviewing our data processing practices and security measures.

While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your personal data.

  1. Data Breach Notification

In the event of a personal data breach:

  1. Notification to the ICO — where a breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, as required by UK GDPR Article 33.
  2. Notification to you — where a breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, as required by UK GDPR Article 34. We will inform you of the nature of the breach, the likely consequences, and the measures we have taken or propose to take to address it.
  1. Children's Data

Our services are designed for individuals aged 18 and over. We do not knowingly collect or process personal data from anyone under the age of 18.

If you are under 18, please do not use our website or provide any personal data to us.

If we become aware that we have collected personal data from a person under 18, we will take steps to delete that data as soon as reasonably practicable. If you believe we may hold data about a child under 18, please contact us using the details in Section 1.

  1. Automated Decision-Making and Profiling

We do not use your personal data for automated decision-making (making decisions by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain personal aspects) that produces legal effects or similarly significantly affects you.

  1. Third-Party Links

Our website may contain links to third-party websites, including Stripe (for payments), Zoom (for retreat participation), and social media platforms. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of any website you visit.

  1. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make material changes, we will notify you by:

  1. posting the updated Privacy Policy on our website with a revised "Last updated" date; and
  2. where appropriate, sending you an email notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of our website and services after any changes take effect constitutes your acceptance of the updated Privacy Policy.

  1. Contact Us

If you have any questions about this Privacy Policy, your personal data, or our data protection practices, please contact us:

Thryve Pro Academy (trading as Thryve Leader Retreats)

Data protection contact: Michael Chalmers, Sole Director

Email: hello@thryve3.com

Post: 3rd Floor, 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE

Company number: 16573922

ICO registration number: ZC019699