Privacy Policy

1. Who We Are

Thornfield Institute Ltd ("we", "us", "our") is a company registered in England and Wales under company number 10927438, with its registered office at 12 Colmore Row, Birmingham B3 2QD, United Kingdom. Our VAT registration number is GB 304 5891 72.

We are the data controller for the personal data we collect through this website and our services. If you have questions about how we handle your data, or if you wish to exercise any of your rights, you can reach our data protection contact at privacy@thornfieldinstitute.co.uk.

2. What This Policy Covers

This privacy policy explains how we collect, use, store, share, and protect your personal data when you visit our website, submit forms, subscribe to our newsletter, or enrol in one of our professional development programmes. It applies to all visitors, subscribers, prospective clients, and enrolled participants.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We take our obligations seriously and have put appropriate measures in place to protect the data you entrust to us.

3. What Data We Collect

We collect several categories of personal data depending on how you interact with us:

• Contact information: your name, email address, phone number, and company name, collected when you submit our quote request form or newsletter signup.
• Enquiry details: the number of seats, preferred programme track, timeline preferences, and any notes you include in the quote form.
• Enrolment data: if you proceed to enrol, we collect billing address, payment card details (processed by our payment provider, not stored on our servers), and any dietary or accessibility requirements you share for in-person sessions.
• Programme participation data: attendance records, assessment results, and feedback you submit during or after a programme.
• Technical data: your IP address, browser type and version, operating system, time zone setting, and pages visited on our website. This data is collected through cookies and server logs.
• Communication data: records of any correspondence between you and our team, including emails and meeting notes.

4. How We Use Your Data

We use the data we collect for the following purposes:

• To respond to your enquiry: when you submit a quote request, we use your contact details and enquiry details to prepare and send you a quote. The legal basis for this processing is our legitimate interest in responding to business enquiries (Article 6(1)(f) UK GDPR).
• To deliver our programmes: if you enrol, we use your data to manage your place, deliver sessions, track attendance, conduct assessments, and issue completion certificates. The legal basis is performance of a contract (Article 6(1)(b)).
• To send our newsletter: if you subscribe, we use your email address to send our monthly operations notes. The legal basis is your consent (Article 6(1)(a)). You can unsubscribe at any time by clicking the link in any newsletter email.
• To improve our website: we analyse technical data to understand how visitors use our site, identify issues, and make improvements. The legal basis is our legitimate interest in maintaining and improving our website (Article 6(1)(f)).
• To comply with legal obligations: we may process your data to comply with tax, accounting, and regulatory requirements (Article 6(1)(c)).

5. Cookies

Our website uses cookies. When you first visit our site, you will see a cookie consent banner offering you two choices: "Accept All" or "Necessary Only."

• Strictly necessary cookies: these are required for the website to function correctly. They include your cookie consent preference, stored in your browser's local storage. These do not require your consent under the Privacy and Electronic Communications Regulations 2003 (PECR).
• Analytics cookies: if you click "Accept All," we may load third-party analytics scripts (such as a tag management service) to understand how visitors interact with our site. These cookies are only set with your explicit consent. If you click "Necessary Only," no analytics cookies will be placed.

You can change your cookie preferences at any time by clearing your browser's local storage for this site or by using your browser's cookie management settings.

6. Who We Share Your Data With

We do not sell your personal data. Full stop. We share data only in the following circumstances:

• Service providers: we use a small number of third-party services to operate our business, including email delivery, payment processing, and web hosting. These providers process data on our behalf and under our instructions, subject to data processing agreements that comply with UK GDPR.
• Professional advisers: we may share data with our accountants, solicitors, or insurers where necessary for the operation of our business.
• Legal requirements: we may disclose data if required by law, regulation, court order, or governmental request.

All our service providers are based in the United Kingdom or in jurisdictions that provide adequate protection for personal data as recognised by the UK government. If we ever need to transfer data to a jurisdiction without an adequacy decision, we will put appropriate safeguards in place (such as standard contractual clauses) and inform you.

7. How Long We Keep Your Data

We retain your data only for as long as necessary for the purpose it was collected:

• Quote enquiries: if you submit a quote request but do not enrol, we retain your data for 12 months from the date of your enquiry, after which it is deleted.
• Newsletter subscriptions: we retain your email address until you unsubscribe. After unsubscribing, we remove your address from our mailing list within 30 days.
• Enrolled participants: we retain programme-related data (attendance, assessments, certificates) for 6 years after completion to satisfy accounting and tax requirements, and to provide replacement certificates if requested.
• Technical data: server logs are retained for 90 days, after which they are automatically deleted.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate or incomplete data.
• Right to erasure: you can ask us to delete your data, subject to any legal obligations we have to retain it.
• Right to restrict processing: you can ask us to limit how we use your data in certain circumstances.
• Right to data portability: you can request that we provide your data in a structured, commonly used, machine-readable format.
• Right to object: you can object to processing based on our legitimate interests. We will stop processing unless we have compelling legitimate grounds that override your interests.
• Right to withdraw consent: where we rely on your consent (e.g. for the newsletter), you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email us at privacy@thornfieldinstitute.co.uk. We will respond within one month of receiving your request. If your request is complex or we receive a high volume of requests, we may extend this by a further two months, and we will let you know if that is the case.

9. Data Security

We take the security of your data seriously. We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit using TLS, restricted access controls on our systems, regular security reviews, and staff training on data protection practices.

That said, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security. If you become aware of any security issues, please contact us immediately.

10. Children's Data

Our services are aimed at adult professionals and we do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it promptly. If you believe we may have collected data from a child, please contact us at privacy@thornfieldinstitute.co.uk.

11. Third-Party Links

Our website may contain links to other websites. We are not responsible for the privacy practices of those websites. We encourage you to read the privacy policies of any external sites you visit. This policy applies only to data collected through our own website and services.

12. Complaints

If you are unhappy with how we have handled your personal data, we encourage you to contact us first at privacy@thornfieldinstitute.co.uk so we can try to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), which is the UK's supervisory authority for data protection. You can contact the ICO through their website at ico.org.uk, by telephone on 0303 123 1113, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

13. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, our services, or applicable law. When we make material changes, we will update the "last updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of our website and services after any changes constitutes acceptance of the updated policy.

If you have any questions about this policy or about how we handle your data, please get in touch at privacy@thornfieldinstitute.co.uk. We will do our best to address your concerns promptly and transparently.