Privacy

Thrive by Blackfinch Limited respects your privacy and is committed to protecting your Personal Data (as defined below). This includes keeping your Personal Data safe and private, not selling your Personal Data and allowing you to manage your marketing choices and opt out at any time.

This privacy notice will inform you as to how we look after your Personal Data when you sign up to and use our products and services, access and use our platform known as ‘Thrive’ (“Thrive Platform”), download/use the Thrive application (the “Thrive App”) or visit our website at www.mythrive.co.uk (the “Thrive Website”)), regardless of where you visit it from, and tell you about your privacy rights and how the law protects you.
‍

This privacy notice is provided in a layered format so you can click through to the specific areas set out below. Please also use the Glossary set out in paragraph 11 of this privacy notice (“Glossary”) to understand the meaning of some of the terms used in this privacy notice.
‍

1. IMPORTANT INFORMATION AND WHO WE ARE
‍

Who we are

This privacy notice is issued on behalf of Thrive by Blackfinch Limited so when we mention Thrive by Blackfinch, “we”, “us” or “our” in this privacy notice, we are referring to Thrive by Blackfinch Limited, who is responsible for processing your Personal Data.
‍

Purpose of this privacy notice

This privacy notice applies to: (i) individuals who visit, use or engage with us via the Thrive App, Thrive Website and/or Thrive Platform; (ii) individuals who use, or engage with us in connection with, any of our other products and services; (iii) individuals who engage with us in connection with any purchases, contracts or related matters; and (iv) individuals we deal with in a business capacity, such as representatives of our customers, partners or suppliers.

This privacy notice aims to give you information on how Thrive by Blackfinch collects and processes your Personal Data when you use the Thrive App, Thrive Website or Thrive Platform (including the Broker Portal, the Customer Dashboard or the Employee Portal), when you sign up to our products and services, when you sign up to our mailing list, or when you take part in a competition. For the purpose of this privacy notice, references to the Thrive Platform include references to the Broker Portal, the Customer Dashboard and/or the Employee Portal of the Thrive Platform (as applicable).
‍

Our Thrive App, Thrive Website and Thrive Platform are not intended for children, and we do not knowingly collect Personal Data relating to children.

It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing Personal Data about you so that you are fully aware of how and why we are using your Personal Data. This privacy notice supplements the other notices and is not intended to override them.
‍

This privacy notice does not describe processing activities that we carry out solely on behalf of a third party (such as, our customers) as a data processor under Article 28 of the UK GDPR. Where we process Personal Data on behalf of a third party, that third party is the data controller and is responsible for providing you with information about how your Personal Data is used.
‍

Contacting Us About Your Personal Data

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.
‍

Our full details are:

Full name of legal entity: Thrive by Blackfinch Limited Name of DPO: Robert Stainsby Email address: r.stainsby@blackfinch.com Postal address: Meadow Barn, Elkstone Studios, Cheltenham, United Kingdom, GL53 9PQ

Telephone number: 01452 717070

ICO Registration Number: ZC088204

You have the right to make a complaint at any time to the UK supervisory authority for data protection issues (currently known as the Information Commissioner’s Office (“ICO”)) (www.ico.org.uk). Please see the complaint section below for further details. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.
‍

Changes to the privacy notice and your duty to inform us of changes

This version was last updated in August 2026, and historic versions can be obtained by contacting us. We will generally notify you of any material changes to this privacy notice, through a notice provided via the Thrive App, Thrive Website or Thrive Platform, or via email. However, you should look at this privacy notice regularly to check for any changes. When we make any changes to this privacy notice, we will also update the “last updated” date at the beginning of this paragraph, which reflects the effective date of the amended privacy notice. Your continued use of the Thrive App, Thrive Website or Thrive Platform or your continued engagement with us after the effective date of the updated privacy notice constitutes your acceptance of the updated privacy notice. If you do not accept the updated privacy notice, you must stop using the Thrive App, Thrive Website and Thrive Platform and cease all other engagements with us.
‍

It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during your relationship with us.

Third-party links

The Thrive App, Thrive Website and Thrive Platform may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Thrive App, Thrive Website and Thrive Platform, we encourage you to read the privacy notice of every app and website you visit.

2. THE PERSONAL DATA WE COLLECT ABOUT YOU

Personal Data means any information relating to an identified or identifiable person. It does not include data where you are not able to identify a person (anonymous data).

We may collect, use, store, transfer and otherwise process different kinds of Personal Data about you which we have grouped together as follows:
‍

Identity Data includes first name, middle name(s), maiden name, last name, username or similar identifier, marital status, title, job title, date of birth, nationality, occupation, gender, national insurance number and security, fraud-prevention and identity-verification information.
‍
Documentary Data includes details about you that are stored in documents in different formats, or copies of them. This could include things like your passport, driving licence and birth certificate.

Contact Data includes billing address, correspondence address, work address, personal and work email address and personal and work telephone numbers. This also includes things like how you want us to contact you or if you prefer large-print formats.
‍
Health Data includes any information relating to an individual’s physical or mental health, health conditions, ill health, emotional wellbeing or vulnerability (for example, if we need to be aware of such data to support you to use the Thrive App, Thrive Website or Thrive Platform or our other products or services).
‍
Financial Data includes bank account details, payment information, financial circumstances, investment and ISA preferences, financial goals and risk preferences, financial wellbeing assessments, and other financial wellbeing data.
‍
Transaction Data includes details about payments to and from you and details of products and services you have purchased from us.
‍
Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, unique identifiers, authentication tokens, operating system and platform and other technical information relating to the devices you use to access the Thrive App, Thrive Website or Thrive Platform.
‍
Profile Data includes your username and password, products and services subscribed to by you, your interests, selections, preferences, feedback and survey responses.
‍
Employment and Benefits Data means your Employer (as defined below), employment and workplace information, your salary/ payroll information and categories, your and your Employer’s contribution information, benefits membership, eligibility and enrolment information, information required to administer workplace benefits, financial-wellbeing services and payroll-linked contributions, policy, plan and coverage information, account balances and benefit values, premiums, payments and contributions records, benefit usage and claims information, benefits provider identifiers and reference numbers, service status and eligibility information, and transaction, withdrawal, transfer or investment information relating to applicable savings, pensions and investments products, benefits dashboards and consolidated benefit information, personalised insights, recommendations and educational content, ISA account and transaction records, savings and investment performance information and benefits valuations and projections.

Contractual and Usage Data includes information about how you use our Thrive App, Thrive Website, Thrive Platform, details on the products and services we provide to you and audit records.
‍
Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties, your communication preferences, consents provided or withdrawn by you, customer-service records and any queries and complaints made by you. Communications data also includes what we learn about you from letters and emails you write to us, conversations between us and interactions you have with us on social media.
‍
Open Data and Public Records Data includes details about you that are in public records such as the Electoral Register, and information about you that is openly available on the internet.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. We may generate Aggregated Data from your Personal Data. Where the Aggregated Data has been anonymised so that you cannot be identified, directly or indirectly, it is not treated as Personal Data under applicable data protection laws. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific app or website feature. However, if the Aggregated Data has not been anonymised (for example, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you), we treat the combined data as Personal Data which will be used and/or otherwise processed in accordance with this privacy notice.

Applicable data protection laws and regulations treat some types of sensitive Personal Data as special. This Personal Data is called ‘special categories of Personal Data’. Where applicable for certain products, some special categories of Personal Data may be collected about you. For example, information about health or medical conditions will be obtained should these details be relevant to the product or service being provided. Other than this we do not collect special categories of Personal Data about you such as details of your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership and genetic and biometric data. Nor do we collect any information about criminal convictions and offences.
‍

If you fail to provide Personal Data

Where we need to collect Personal Data by law, or under the terms of a contract we have with you and you fail to provide that Personal Data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our products and services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.
‍

3. HOW IS YOUR PERSONAL DATA COLLECTED

We use different methods to collect Personal Data from and about you including through:

Direct interactions. You may give us your Identity Data, Documentary Data, Contact Data, Financial Data, Health Data, Profile Data, Financial Data, Transaction Data, Employment and Benefits Data, Contractual and Usage Data and Marketing and Communications Data by filling in forms or by corresponding with us by post, phone, email or otherwise. Such categories of Personal Data may also be provided when you: apply for our products or services; create an account on, or otherwise access or use, the Thrive App, Thrive Website and/or Thrive Platform; subscribe to our service or publications; request marketing to be sent to you; enter a competition, promotion or survey; or give us feedback.
Automated technologies or interactions. As you interact with the Thrive App, Thrive Website and/or Thrive Platform, we may automatically collect Technical Data about you, including relating to your equipment, browsing actions and patterns. We collect this Personal Data by using cookies, server logs, browser local storage and session storage and other similar technologies. We may also receive Technical Data about you if you visit other apps or websites employing our cookies.
Third parties or publicly available sources. We may receive Personal Data about you from various third parties and public sources as set out below: ▪ Technical Data from the following parties: analytics providers; advertising networks; and search information providers.
- Identity Data, Contact Data and Open Data and Public Records Data from publicly availably open data sources such as Companies House, HM Treasury financial sanctions targets list, identity verification websites and the Electoral Register.
- Identity Data, Documentary Data, Financial Data, Contact Data and Employment and Benefits Data from your or your Employer’s financial intermediary or by people linked with you or your business’s product or service, or people working on your behalf. This could mean a joint account holder, trustee, fellow company director or partner.
- Identity Data, Documentary Data, Financial Data, Contact Data, Employment and Benefits Data from your Employer.
- Identity Data, Financial Data, Health Data and Employment and Benefits Data from our subcontractors, suppliers and third parties who provide employee benefit or reward-related products and/or services to you, your Employer or us on your behalf.

4. HOW WE USE YOUR PERSONAL DATA

We will only use your Personal Data when the law allows us to. Most commonly, we will use your Personal Data in the following circumstances:

Where we need to perform the contract we are about to enter into or have entered into with you.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Where we need to comply with a legal or regulatory obligation.
Where we need to protect your vital interests (or someone else’s vital interests).

Generally, we do not rely on consent as a lawful basis for processing your Personal Data other than where required by law, which may include in relation to sending third-party direct marketing communications to you via email or text message or sharing your Personal Data with third parties for marketing purposes. You have the right to withdraw consent to marketing at any time by contacting us or opting-out (as set out further below).

‍

We need to have a further justification for processing Special Categories of Personal Data (as defined in the Glossary). We may process Special Categories of Personal Data in the following circumstances:
‍

With your explicit consent.

Where it is needed to protect your vital interests (or someone else’s vital interests) and you are not capable of giving your consent.

Where it is needed to protect you from physical, mental or emotional harm, or to protect your physical, mental or emotional well-being, and you can’t give consent or we can’t reasonably be expected to obtain your consent.

Where it is needed in relation to legal claims.

‍

Purposes for which we will use your Personal Data

We have set out below, in a table format, a description of all the ways we may use your Personal Data, and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your Personal Data for more than one lawful basis depending on the specific purpose for which we are using your Personal Data. Please contact us if you need details about the specific lawful basis we are relying on to process your Personal Data where more than one lawful basis has been set out in the table below.

Thrive by Blackfinch offers a range of different products and services. Each one may have different requirements for the collection and use of your Personal Data. For this reason, some sections of this privacy notice do not apply to all Thrive by Blackfinch products and services.

‍

PROVIDING OUR PRODUCTS AND SERVICES

Reason for using your information

To fulfil our contracts 
Thrive by Blackfinch’s legal duty
Our legitimate interests

What we use your personal information for

To register you as a new customer.
To manage our relationship with you or the business you work for.
To promote, provide, deliver, sell, distribute, support and renew subscriptions for, our products and services.
To communicate with you about our products and services.
To make and manage customer payments.
To manage fees and charges.

‍

• Following rules and guidance from regulators.
• Being efficient about how we fulfil our legal and contractual duties.
• To collect and recover debts owed to us.
• Developing products and services, and what we charge for them.
• To study our customers and how they use our products and services.
• Keeping our records up to date, working out which of our products and services may interest you and telling you about them.
• Defining types of customers for new products or services.
• Increase our revenue and grow our business.

BUSINESS MANAGEMENT AND DEVELOPMENT

Reason for using your information

To fulfil our contracts
‍
Thrive by Blackfinch’s legal duty

Our legitimate interests

Your consent

What we use your personal information for

To conduct our business in an efficient and proper way. This includes managing our financial position, business capability, planning, adding and testing systems and processes. It also includes managing communications, corporate governance, and audit.
To administer and protect our businesses, the Thrive App, Thrive Website and Thrive Platform. This includes troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data.
To improve, develop and personalise the Thrive App, Thrive Website, Thrive Platform and our other products and services, marketing, customer relationships and experiences (including by using analytics).
To develop and carry out marketing activities, including sending you news, information and promotions which we think you may be interested in.
To test new products and services.
To manage how we work with other companies that provide products and services to us and our customers.
To develop new ways to meet our customers’ needs and to grow our business.
To exercise our rights and perform our obligations set out in agreements or contracts.
To anonymise Personal Data.
To create aggregated data and reports.
To introduce you or the organisation you work for to benefits providers, suppliers and other third parties.

Following rules and guidance from regulators.
Being efficient about how we fulfil our legal and contractual duties.
Provision of IT and administration services.
Developing products and services, and what we charge for them.
To study our customers and how they use our products and services.
Defining types of customers for new products or services.
Being efficient about how we fulfil our legal and contractual duties.
Increase our revenue and grow our business.

MANAGE SECURITY, CRIME PREVENTION AND ANY RISKS

Reason for using your information

To fulfil our contracts
Thrive by Blackfinch’s legal duty
Our legitimate interests
Vital Interests

What we use your personal information for

To administer, secure and protect our businesses, the Thrive App, Thrive Website, and Thrive Platform. This includes troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data.
To detect, investigate, report, and seek to prevent financial crime.
To manage risk for us and our customers.
To comply with any laws and regulations that apply to us.
To respond to complaints and seek to resolve them.
To respond to and address any safeguarding concerns or issues.

Provision of IT and administration services, including network and security in order to prevent fraud or financial crime.
Developing and improving how we deal with financial crime
Completing our legal duties in regards to financial crime.
Following rules and guidance from regulators.
Being efficient about how we fulfil our legal and contractual duties.

Marketing

This section confirms how Thrive by Blackfinch decides what marketing to show or send you. It also explains how we work out what you may be interested in.
‍
We may use your Personal Data to make decisions about what products, services and offers we think you may be interested in. This is what we mean when we talk about ‘marketing’. We may show or send you marketing material online (on the Thrive App, Thrive Website, Thrive Platform and social media), or by email, post or through other digital channels (whether owned and operated by us or a third party).
You may receive marketing communications from us where you have consented to receive them or where we are otherwise permitted to send them under applicable law.
‍
As set out above, generally, we do not rely on consent as a lawful basis for processing your Personal Data other than where required by law, which may include in relation to sending third-party direct marketing communications to you via email or text message, or to share your Personal Data with third parties for marketing purposes.
‍
You can tell us to stop sending you marketing at any time as per the opting out section below.

Opting out

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time.

Where you opt out of receiving these marketing messages, we may still send you non-marketing communications. For example, where necessary to provide you with a product or service you have requested, to administer your account or in connection with any transaction you have entered into with us.

Cookies and similar technologies

We may store information about you using cookies. A cookie is a small text file received and stored by your browser. Cookies are useful because they enable the technology we use to recognise your browser and to send individualised information to it. A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer. A cookie is not a program, and it cannot contain a virus. Some cookies are automatically deleted when the Thrive App, Thrive Website or Thrive Platform is shut down, while others remain live for several months.
‍
Cookies are used to enable the personalisation of your visits to our Thrive App, Thrive Website and Thrive Platform and to keep track of your preferences. This is to provide us with generic usage statistics to help us understand and improve the Thrive App, Thrive Website, Thrive Platform and our other products and services.

You can find more information about the cookies we use and the purposes for which we use them in the table below:

Cookie Title

Purposes

Reason for using your information

Essentials

The essentials cookies are used to store and remember your core consent choices, ensuring the Thrive Website can apply your privacy preferences consistently across pages and future visits.

Thrive
ConsentPro

Analytics

The analytics cookies are used to track and measure user behaviours across the Thrive Website, helping us understand how visitors navigate pages, interact with features, and engage with content. These insights support user experience improvements by identifying friction points and optimising design.

Thrive
Google
Analytics

Marketing

The marketing cookies are used to support personalised marketing and measure campaign effectiveness, allowing us to understand which content, promotions, or channels users engage with most. It helps deliver more relevant marketing experiences, optimise targeting, and evaluate performance across user journeys.

Thrive
GoogleAnalytics
LinkedIn

Cookies will not be used to contact you for marketing purposes other than as set out in the table above.
‍
You can set up your browser to block all cookies, delete existing cookies or issue a warning before any new cookie is downloaded. Please consult your browser’s Help function for instructions on how to do this. Further information about how to manage cookies is
available at Introduction to cookies - About Cookies.
‍
Cookies are often used to enable and improve certain functions on our Thrive App, Thrive Website or Thrive Platform. If you choose to switch cookies off, you could lose the benefits of enhanced speed of access and navigation of the Thrive App, Thrive Website or Thrive Platform.
Google Analytics uses cookies to gather statistics about Thrive App, Thrive Website or Thrive Platform such as the number and date of visits, the number of clicks and how long each visit lasts, and how users find their way to our Thrive App, Thrive Website or Thrive Platform.
‍
Our Thrive App, Thrive Website and the Thrive Platform includes links to other apps, websites and social media platforms, such as LinkedIn, which also use cookies. Thrive by Blackfinch is not responsible for the use of cookies by third-party apps, websites and platforms linked to the Thrive App, Thrive Website or Thrive Platform.
‍
When you access or use the Thrive App, Thrive Website or Thrive Platform, we may use technologies including browser local storage and session storage, to authenticate your identity, maintain secure login sessions, remember your authentication status and ensure
the security and functionality of the Thrive App, Thrive Website and Thrive Platform.

Change of purpose
‍We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us using the contact details at the top of this privacy notice.

If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so. Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5. DISCLOSURES OF YOUR PERSONAL DATA

Data Sharing Within the Blackfinch Group
‍
Thrive by Blackfinch may share your Personal Data with other entities within the Blackfinch Group (as defined in the Glossary) where it is necessary for the provision of services, regulatory compliance, internal governance, or business administration. Personal Data shared with entities within the Blackfinch Group is handled in accordance with applicable data protection laws and subject to appropriate safeguards to ensure the confidentiality, integrity, and security of your Personal Data. Sharing is limited to what is necessary for legitimate business purposes, including but not limited to investment administration, client servicing, and reporting obligations.
‍
Sharing Your Personal Data with Suppliers and Partners
To provide you with the services available through the Thrive App, the Thrive Website and Thrive Platform, we may need to share certain Personal Data with trusted third-party suppliers or partners. These parties support us in delivering and administering products and services, such as technology infrastructure, customer support, communications, data processing, financial services facilitation, compliance functions and benefits products or services which we make available to you via the Thrive Platform.
‍
We only share the Personal Data necessary for them to fulfil their role, and we require all such parties to handle your Personal Data securely and in accordance with applicable data protection laws. These organisations are contractually obliged to use your Personal Data solely for the specific purposes we instruct and not for their own independent use.
‍
Some third parties may retain Personal Data for as long as required to fulfil legal or regulatory obligations or to deliver services to you as part of your Thrive experience. We maintain oversight of these arrangements and take steps to ensure appropriate safeguards are in place to protect your information at all times.
‍
We do not sell your Personal Data to any third party.

Sharing your Personal Data with other third parties
‍
We may have to share your Personal Data with the parties set out below for the purposes set out in paragraph 4 above. This is so that we can, amongst other things, provide you with products and services, run our business, and obey rules that apply to us. Here we list all the types of organisations that we may share your Personal Data with.
‍
• A third party linked to a product or service we provide to you, such as a joint policy holder, trustee, fellow company director, partner or a financial intermediary/introducer.
‍
• External Third Parties as set out in the Glossary.

• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets.

• Authorities and other public bodies such as central or local government, law enforcement, HM Revenue and Customs, regulators, other tax authorities, Financial Ombudsman Service, UK Financial Services Compensation Scheme, healthcare providers, hospitals, NHS trust, medical professionals and emergency services.

• Fraud Protection agencies, see further details below

Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Data in the same way as set out in this privacy notice. We require all third parties to respect the security of your Personal Data and to treat it in accordance with the law. We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

Fraud Protection Agencies

Before we provide products or services to you or your Employer, we may need to confirm your identity and carry out money laundering or fraud checks.
‍
Once you become a customer of ours, we may share your Personal Data as needed to help combat fraud and other financial crime such as fraud, money-laundering and terrorist financing. The organisations we may share Personal Data with are:

• Registered Fraud Prevention Agencies
• Other agencies and bodies acting for the same purpose
• Industry databases used for this purpose
• Insurers

Throughout our relationship with you, we and these organisations may exchange data to help prevent, deter, detect and investigate fraud and money-laundering. We and these organisations can’t use your Personal Data unless we have a lawful basis for doing so, as further set out in paragraph 4 of this privacy notice.

We'll use the personal information to:

• Confirm identities
• Help prevent fraud and/or money-laundering
• Fulfil any contracts you/your Employer have with us.

We or a fraud protection agency may allow law enforcement agencies to access your Personal Data. This is to support their duty to prevent, detect, investigate and prosecute crime. If we or a fraud protection agency decide there is a risk of fraud, we may stop activity on the accounts or block access to them. Fraud protection agencies and cross-industry organisations may also keep a record of the risks that you or your Employer may pose, and this may result in other organisations refusing to provide you with products or services, or to employ you.

6. INTERNATIONAL TRANSFERS

Some of the parties we share your Personal Data with are based outside the UK and/or European Economic Area (EEA) so their processing of your Personal Data will involve a transfer of Personal Data outside the UK and/or EEA. This includes countries such as Switzerland and the United States.
‍
Whenever we transfer your Personal Data out of the UK or the EEA, we ensure an appropriate level of protection is afforded to it by implementing appropriate safeguards. These may include:

• transferring Personal Data to countries or territories that have been deemed to provide an adequate level of protection for Personal Data under applicable data protection laws;

• putting in place appropriate safeguards for the transfer, such as the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses or the European Commission's Standard Contractual Clauses (as applicable); or

• relying on another lawful transfer mechanism permitted under applicable data protection laws.
‍
For further details, see A guide to international transfers | ICO. Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Data outside of the UK and/or the EEA.

7. DATA SECURITY

We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. DATA RETENTION

How long will you use my Personal Data for?
‍
We retain your Personal Data for as long as it is necessary for the purposes for which it was collected and processed. For example, if you have a product or are using a service from us, and in most other situations, we retain it for up to 7 years after termination of our contract. The reasons we may do this are:

• To respond to a question or complaint, or to show whether we gave you fair treatment.
• To understand our customers as part of our own internal research.
• To obey rules that apply to us about keeping records.

We may retain your Personal Data for longer than 7 years if we archive it for historical purposes, for the purpose of satisfying any legal, regulatory, accounting, finance, tax, reporting and insurance requirements or for technical reasons.

In some circumstances you can ask us to delete your Personal Data: see Request erasure below for further information.

In some circumstances we may anonymise your Personal Data (so that it can no longer be associated with you) for research, development or statistical purposes in which case we may use this information indefinitely without further notice to you. For example, we may use anonymised data regarding your use of the Thrive Platform to analyse and compile performance, statistical or other information which is used to provide, develop and improve our products, software and services.

9. YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your Personal Data. Please refer to the glossary to find out more about these rights:

Request access to your Personal Data. 
Request correction of your Personal Data. 
Request erasure of your Personal Data. 
Object to processing of your Personal Data. 
Request restriction of processing your Personal Data. 
Request transfer of your Personal Data. 
Right to withdraw consent.

If you wish to exercise any of the rights set out above, please contact us using the contact details at the top of this privacy notice.

No fee usually required

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is manifestly unfounded or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

10. HOW TO COMPLAIN

If you have any concerns about our use of your Personal Data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you’re unhappy with how we’ve used your Personal Data, you can also complain to the ICO

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

11. GLOSSARY

BLACKFINCH GROUP means Thrive by Blackfinch Limited and any subsidiary or holding company from time to time of Thrive by Blackfinch Limited and any subsidiary or holding company of that company.
‍
YOUR EMPLOYER includes: (a) if you are an officer or employee, your employer; and (b) if you are engaged as a consultant or contractor, the organisation with which you are engaged.

LAWFUL BASIS
Under UK data protection law, we must have a “lawful basis” for collecting and using your Personal Data. There is a list of possible lawful bases in the UK GDPR. Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about lawful bases on the ICO’s website.
‍
Legitimate Interest means processing that is necessary for the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights or freedoms which require protection of Personal Data. Our legitimate interests may include conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your Personal Data for our legitimate interests. We do not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us using the contact details at the top of this privacy notice.
‍
Performance of Contract means processing your Personal Data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
‍
Comply with a legal or regulatory obligation means processing your Personal Data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

THIRD PARTIES

External Third Parties

• Service providers and suppliers acting as processors who provide IT, system administration services and help us to run our products or services.

• Subcontractors who are helping us to perform our obligations to you or your Employer.

• Your Employer.

• Companies that act as an intermediary between us and your Employer.

• Professional or legal advisers acting as processors, independent controllers or joint controllers including lawyers, bankers, auditors and insurers/insurance brokers who provide consultancy, banking, legal, insurance and accounting services.

• HM Revenue & Customs, regulators and other authorities acting as processors, independent controllers or joint controllers who require reporting of processing activities in certain circumstances.

We may use artificial intelligence, machine learning and other automated and interactive technologies to operate and personalise the Thrive Platform, including to provide chatbots, AI agents, digital assistants and coaches, personalise content, generate recommended actions, help you understand your workplace benefits and financial wellbeing, and improve our services. These tools may use information you provide, your activity within the Thrive Platform and other relevant information held about you on the Thrive Platform, including information you provide through financial wellbeing tools and surveys. We will process this information in accordance with applicable data protection law and this privacy notice. We will not use solely automated decision-making to make decisions about you that have legal or similarly significant effects unless permitted by law and appropriate safeguards are in place.
‍

SPECIAL CATEGORIES OF PERSONAL DATA means Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning an individual’s sex life or sexual orientation.
‍

YOUR LEGAL RIGHTS
‍

You have the following rights under applicable data protection laws:

• Your right of access - You have the right to ask us for copies of your Personal Data (commonly known as a “data subject access request”). There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.

• Your right to rectification - You have the right to ask us to correct or delete Personal Data you think is inaccurate or incomplete. You can read more about this right here.

• Your right to erasure - You have the right to ask us to delete your Personal Data. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. You can read more about this right here.

• Your right to restriction of processing - You have the right to ask us to limit how we can use your Personal Data in certain circumstances. You can read more about this right here.

• Your right to object to processing - You have the right to object to the processing of your Personal Data in certain circumstances. You can read more about this right here.

• Your right to data portability - You have the right to ask that we transfer the Personal Data you gave us to another organisation, or to you. We will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. You can read more about this right here.

• Your right to withdraw consent – When we use consent as our lawful basis for processing your Personal Data, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent. You can read more about this right here.