This document is designed to tell you how we look after any data and personal details you provide us with. We take your privacy very seriously and aim to treat your information as we would want our own handling. This is how we do things:

1.0 What is data?
2.0 Named person
3.0 Who has access to your data?
3.1 Consumer sales
3.2 Thrive Partners
3.3 Communication
4.0 What data do we collect and why do we collect it?
4.1 Consumer sales
4.2 Thrive Partners
4.3 Suppliers
5.0 Communication – How do we keep you up to date with The Thrive PLace news
6.0 How do we store and protect your information?
6.1 Website
6.2 Shopify
6.3 Mailchimp
7.0 How do we protect against data breaches?
8.0 How long do we keep data for and how do we keep it up to date?
9.0 Further reading
1.0 What is data?

Data is defined as facts and statistics collected together for reference or analysis. We don’t believe in collecting information we don’t need but there are some things that are essential for us to do our job such as name, address and contact details when processing an order.

2.0 Named person
Helen Russell is the named person for data handling at The Thrive Place. If you have any questions about how your details are used (that aren’t answered in this document) then please get in touch with her directly helen@thethriveplace.co.uk
Where we use a third-party organisation such as Shopify, we will also provide a link to their privacy policy in the section called further reading.

3.0 Who has access to your data?
We are a sole trader business and like to keep things as simple as possible, so the number of people involved in handling your data is quite small.

3.1 Consumer Sales (private sales through the website):
• Web sales – Helen manages all sales that come through The Thrive Place website
• Shopify – We use Shopify for receiving payment of items bought on The Thrive Place website. Occasionally Helen will invoice a customer directly using the Paypal platform.
• Gmail – if we need to chat to you about anything specific (such as event details) we tend to use email so we have a record of what has been discussed and can then ensure we get things right.

3.2 Thrive Partners (people we collaborate with)
• We use Gmail for communicating with our Thive partners
3.3 Communications:
• Mailchimp is used for newsletters
4.0 What data do we collect and why do we collect it?
4.1 Consumer sales
• The Thrive Place website – guest checkout
When you buy event tickets or order a product from us, and you haven’t signed up as a returning customer, you can check out as a guest. When you do this our website system shows us the following information – your first and surname; your email/payment linked email address; the item/s you have ordered; the shipping address; date of the order and the amount you have paid. We do not see your financial details. We need this information to process the order and to contact you if there is anything we need to check with you. The information on items bought helps us keep track of which products/services sell.
• The Thrive Place website – returning customer account
If you have signed up as a return customer we have access to all the information listed above plus your telephone number and website details (if you have chosen to share them). We can also access your order history, so what you have bought; your total spend and when you have bought things. This is very useful as it gives us a good indication of buying patterns in terms of time of year and whether product type relates to this. As a small business this is invaluable for product development and planning.

• Blog posts
If you choose to comment on a blog post then you are required to submit your name and an email address. You also have the option of sharing your own website address with us. This information helps us to make sure that comments submitted for approval are suitable for the audience who sees the site and if not we can report them as spam. Including your web address, particularly if you are a fellow creative, gives us chance to find out about your work. Sometimes this leads to collaboration and partnership opportunities.

• Paypal
We use Shopify payment to help us complete transactions through our website shop. Shopify manages the monetary exchange for us (in return for a commission fee). When Helen logs in to Shopify to confirm a sale and mark it as sent she can see your name; the date; the products purchased, and the email address linked to the customer account used. The data that is collected during these transactions is used to process your order and make sure we can track your purchase activity if any follow up action is required.
Shopify’s privacy policy can be found in the further reading section at the end of this document.

• Google analytics
We use Google Analytics on the website to show how many visits to the site there have been, how long people have stayed, which pages are most looked at and where people have been referred to the site from e.g. Facebook, Instagram. We do not have access to any information about individuals who have visited the website unless you make a purchase (please see above for details on this data collection)
Google analytics is also used on our Facebook business page. Facebook allows us to access data such as which geographic area visitors to the page live in, what level of interaction a page is receiving, the gender of visitors and the age category that visitors fall into. Again, we do not see individual personal data unless you choose to share that information on our newsfeed in the form of a comment. The information collected through Google Analytics is invaluable as it allows us to see who our primary customer groups are. This helps during the planning and design of products or services. Google analytics privacy policy can be found in the further reading section at the end of this document. If you want to prevent Facebook from collating data on your age/gender etc then you can change your privacy setting from your Facebook account.

4.2 Thrive Partners:

• Accountant
Mr Anthony Fisher of Whitehouse Accounting is the accountant for The Thrive Place. He does our annual tax return and as a result has access to sales figures and business names of Thrive Partners.
Suppliers
We keep contact details for our Thrive Partners, service and product suppliers so we can order the things we need to fulfil our orders. This information is freely available on the internet but we also keep a paper copy of the companies we work with for speedy reference. These details are stored in our non-public facing office.

5.0 Communication
How do we keep you up to date with The Thrive Place news?
• Mailchimp
The Thrive Place uses Mailchimp to update customers about the business. We try our best to make sure that newsletter content is relevant to what we do, or to things and places that we feel you will enjoy reading about. Content may include (but is not limited to) information on new products and services, collaborations, our Thrive Partners, inspirational places and things, research relevant to the themes Thrive explores and information about other practitioners. Newsletters are sent out monthly and there is an option to unsubscribe at any time. Mailchimp’s privacy policy is included in the further reading section at the end of this document.

• Gmail
We use Gmail for our email communication.
If you are a consumer visitor to The Thrive Place then we will never email you unless you have entered into a transaction or discussion with us and we need to contact you e.g. if we need to talk to you about an order or an enquiry.
If you are a Thrive Partner, fellow business owner or potential collaborator then email is our preferred method of communication for talking through new ideas etc. We sometimes email potential partners if we feel that our product is a good fit for them and that we could develop a relevant working relationship.

• Telephone
We will only use telephone contact details if they have been freely provided by the customer and we need to contact the customer urgently about an order or in the event of a cancelled session. We will never pass your telephone number on to a third party.
6.0 How do we store and protect your information?

• 1 Website
The Thrive Place website is a secure website that doesn’t store any of your financial details – the purchasing aspect of buying from us is managed through the Shopify platform. As mentioned in previous sections of this document, the website does store your contact details so we can process orders. The content management system (CMS) of the website is two-factor password protected. We always log out when we have completed updates but there is also a timed automatic log out system in place should it be required.
The site is hosted on Shopify’s dedicated server and has a SSL certificate.

• 2 Paypal
Our Shopify accounts are password protected and the devices we access our accounts from have two-step verification systems set up. We log out of the platforms each time we have completed any actions required but there are also automated log outs set up if required. We use Shopify because we prefer not to have direct access to your bank details and feel that their investment in security is far higher than we could afford as a small business.

• 3 Mailchimp
If you have chosen to sign up to our newsletter then your details are saved on a secure Mailchimp server. We never share our contact lists with people and we never bombard you with information – these are two of our pet hates and we wouldn’t want to inflict them on you!
We never autosave passwords on any of our equipment, we must log in every time

7.0 How we protect against data breaches?
Helen has access to most of the platforms mentioned in this document from her mobile phone and laptop, both of which are password and thumbprint protected in case they are stolen or lost. The website management system and any payment platforms such as Shopify require us to log in each time they are needed. We do not stay logged in to our systems indefinitely!

Individual passwords are in place for all pieces of equipment and platforms so that in the case of a data breach only one platform would be accessible. If a breach were to happen it would be reported to the ICO (Information Commissioner’s Office) within 72 hours of us becoming aware of the data breach and we would take action based on their advice.
8.0 How long do we keep data for and how do we keep it up to date?

• Our annual accounts are kept for 7 years as standard for tax purposes, after this time they are shredded.

• Sales data will be kept for the lifespan of the business The Thrive Place. It helps inform us about changes in the market, areas of growth and the success (or not) of our product ranges. Should the business cease to trade all sales and customer data would be deleted and our systems voided within 3 months of close of business.

• If you subscribe to our newsletter you are entitled to unsubscribe at any time using the button at the bottom of the newsletter.

• If you have bought anything off our website, or have a returning customer account, the information we hold about that purchase can be deleted upon your request. Please email helen@thethriveplace.co.uk to action this.

9.0 Further reading:
Shopify privacy policy
https://www.shopify.com/legal/privacy
Google analytics policy documents
https://policies.google.com/technologies/partner-sites
https://policies.google.com/privacy
https://policies.google.com/terms
Mailchimp policy documents
https://mailchimp.com/legal/