Related policies: This Policy should be read alongside our [Cookie Policy], [Safeguarding & Online Safety Policy], and [GDPR Compliance Policy] and [Cyber Security Policy]. Where those policies address a topic in more detail, we reference them below rather than repeat them here — this keeps a single source of truth for each subject.

1. Introduction

Thoughtful Insight (“Thoughtful Insight”, “we”, “our”, “us” — see Section 3) respects your privacy and is committed to protecting your Personal Data. This Policy explains how we collect, use, disclose, store and protect Personal Data when you:

• visit our Websites (as defined below);

• register to use any of the Thoughtful Insight services, including our online learning/training platform (the “Services”);

• attend or register to attend sponsored events or other events at which Thoughtful Insight participates (“Attendees”);

• are identified through data we gather from external third parties, from publicly available information, or from other Thoughtful Insight Group companies as part of our lead generation programme; or

• supply goods or services to Thoughtful Insight.

Thoughtful Insight’s Services are used both by employees enrolled through workplace accounts and by individual learners, including people facing personal or workplace challenges. This Policy applies to both groups equally; where something applies only to one, we say so.

2. Definitions

3. Who We Are

Thoughtful Insight refers to Thoughtful Insight and its group companies operating under this Policy. Details of the specific entity acting as data controller, and its registered address, are set out in Section 17 (Contact Us).

4. The Data We Collect About You

• Identity Data — first name, last name, marital status, title, date of birth, gender.
• Contact Data — billing address, delivery address, email address, telephone number.
• Financial Data — bank account, payment card and electronic payment details.
• Transaction Data — payments to/from you and details of products/services purchased.
• Technical Data — IP address, login data, browser type/version, time zone, location, plug-ins, OS/platform and other device technology.
• Profile Data — username, password, interests, preferences, feedback, survey responses.
• Usage Data — information about how you use our Websites, products and Services.
• Learning Data (new category) — course enrolment, progress, assessment results, quiz/assignment submissions, and completion or certification records. Where you are enrolled via an employer or other organisation, summarised Learning Data (e.g. completion status) may be shared with that organisation’s administrator for reporting purposes.
• Marketing and Communications Data — your preferences for marketing from us and third parties, and communication preferences.
• We may also collect and share Aggregated Data (statistical/demographic data) for any purpose. Aggregated Data does not identify you.

We do not knowingly collect Special Category Data (health, disability, religious belief, etc.) as part of standard course enrolment. If you choose to disclose such information yourself — for example, in a forum post, assignment, or a wellbeing-related course activity — it is handled under the stricter safeguards in Section 12 and our Safeguarding & Online Safety Policy, not under standard marketing or analytics processing.

5. How We Collect Your Data

• Direct interactions — forms, correspondence, account creation, course enrolment, subscriptions, competitions/surveys, or feedback.
• Automated technologies — Technical and Usage Data collected via cookies, server logs and similar technologies. Full detail on what we use, why, and how to manage it is in our Cookie Policy — this Privacy Policy does not repeat that detail so that a single, current version exists.
• Third parties / public sources — other Thoughtful Insight Group companies (lead generation), business partners and sub-contractors (including LMS, video-hosting and payment providers — see Section 10), analytics providers, credit reference agencies, public sources, and event organisers.

6. How We Use Your Data

We use your Personal Data to:

• register and manage your account, including employer/organisation-linked accounts;

• provide, manage and administer the courses and Services you’re enrolled in;

• track course progress and issue completion records or certificates;

• process orders and payments;

• manage our relationship with you, including policy or Service change notices;

• run competitions, promotions or surveys;

• administer and protect our business, Websites and Platform (troubleshooting, testing, support, hosting, security monitoring);

• deliver relevant content/advertising and measure effectiveness;

• improve Websites, Services, marketing and learner experience through analytics;

• make relevant course or product suggestions;

• manage events and communicate with Attendees;

• identify and respond to safeguarding concerns, in line with our Safeguarding & Online Safety Policy; and

• comply with legal or regulatory obligations.

7. Legal Basis for Processing

We rely on Consent, Contract necessity, Legitimate interests, and Legal obligation, as applicable under UK GDPR/EU GDPR. Where we process information arising from a safeguarding concern (for example, a disclosure in a course forum), our legal basis is typically legal obligation or vital interests, reflecting the protective purpose rather than a commercial one — see Section 12.

8. Cookies

Our Websites and Platform use cookies and similar technologies. Full details — what cookies we use, why, their retention periods, third parties involved, and how to manage your preferences — are set out in our Cookie Policy, which forms part of your agreement with us alongside this Privacy Policy.

9. User Consent Management

• Granular consent — separate consent per purpose (e.g. cookies vs. marketing emails).
• Clear, informed requests — plain language, presented separately from other terms.
• Consent records — logged, including what, when and how you consented.
• Easy withdrawal — unsubscribe links, account preference settings, cookie preference centre, or direct contact. Withdrawal is not retroactive.
• Organisation-linked accounts — if you were enrolled by an employer or other organisation, some processing (e.g. sharing your completion status with that organisation) may be a condition of that enrolment rather than something you can individually opt out of. We’ll tell you where this applies at enrolment.

10. Disclosure of Your Personal Data

We may share data with: other Thoughtful Insight Group companies; service providers supporting the Platform — including Learning Management System (LMS) infrastructure, video/content hosting, and payment processors (see also Cookie Policy Section 4 for the same categories in a cookie context); professional advisers; regulators/authorities; event co-organisers/sponsors; your enrolling organisation, where relevant (Learning Data only, per Section 4); and parties involved in a business sale, transfer or merger. Third parties must protect your data and use it only per our instructions.

11. International Transfers

Where Personal Data is transferred outside the UK/EEA, we use appropriate safeguards (e.g. UK/EU-approved standard contractual clauses) or rely on adequacy decisions.

12. Secure Storage of Personal Data — and Safeguarding

• Encryption in transit and, where appropriate, at rest.
• Access controls limited to those with a genuine business need.
• Infrastructure security — reputable hosting, firewalls, intrusion detection, patching. Detailed technical security controls are set out in our Cyber Security Policy; this section states our commitments, that document states our controls.
• Monitoring/testing — regular vulnerability review and security testing.
• Staff training on data protection and information security.

Safeguarding disclosures are handled differently from routine data. If you disclose something in a course, forum, or message that raises a safeguarding concern (for example, about your own or someone else’s safety), that information is handled under our Safeguarding & Online Safety Policy, not as routine Profile or Usage Data. This means:

• it may be reviewed by our Designated Safeguarding Lead, not general support staff;

• it may be shared with external authorities where there is a risk of serious harm, even without your consent, as permitted by law; and

• the reporting route is different — safeguarding concerns go through the Platform’s “Report” feature or safeguarding@thoughtfulinsight.uk not our standard data-request contact.

A personal data breach (e.g. unauthorised access to our systems) is separate again, and is handled under our internal Data Breach procedure with notification to you and the ICO within legal timeframes where required.

13. Data Retention

· Principle — we retain Personal Data only as long as necessary for the purpose collected, or as required by law.

· Category-specific periods — account and transaction records: duration of relationship plus statutory limitation period; Learning Data (progress, certificates): typically retained for the certificate’s validity period plus a defined period for audit purposes; marketing consents: reviewed periodically. Cookie-specific retention periods are set out in our Cookie Policy and are not repeated here.

· Safeguarding records are retained separately, and typically for longer, in line with statutory safeguarding record-keeping requirements — see our Safeguarding & Online Safety Policy.

· A detailed, internal Data Retention Schedule sets out exact periods per data category; this Policy states the principles that schedule follows.

14. Your Rights

You have the right to: access, correct, erase, object to, or restrict processing of your Personal Data; request portability; withdraw consent; and complain to a supervisory authority (in the UK, the ICO).

We aim to respond within one month. Requests are normally free unless clearly unfounded, repetitive or excessive. We may ask for ID verification first.

Note on Learning Data in organisation-linked accounts: if you were enrolled through an employer, some requests (e.g. erasure of a completion record your employer relies on) may need to be coordinated with that organisation, as they may also hold a copy or have a legitimate interest in it.

15. Marketing Preferences

Marketing is sent only where you’ve requested it, purchased Services and not opted out, or consented in another context (e.g. an event). Opt out anytime via unsubscribe links, account settings, or by contacting us.

16. Further Protections for Users

· Data minimisation — only collect what’s necessary.

· Privacy by design — new courses/features assessed for privacy risk, including DPIAs where appropriate.

· Children’s privacy — our Services are aimed at employees and adult learners; where any course activity is designed for or accessible to under-18s, additional safeguards from our Safeguarding & Online Safety Policy apply.

· Vulnerable users — where our Services are used by people facing personal, health or other challenges, our Safeguarding & Online Safety Policy sets out additional conduct standards, moderation, and reporting routes designed for that context.

· Third-party links — we’re not responsible for external sites’ privacy practices.

· Cyber security — our approach to technical security controls, incident detection and response are set out fully in our Cyber Security Policy

17. Changes to This Policy

Reviewed regularly; material changes posted on our Websites with an updated “last updated” date, plus additional notice (e.g. email) where appropriate. Related policies (Cookie, Safeguarding, GDPR, Cyber Security) are reviewed and versioned independently — checking each policy’s own “last updated” date will tell you if it, specifically, has changed.

18. Contact Us

Thoughtful Insight info@thoughtfulinsight.uk  Email: privacy@thoughtfulinsight.uk Telephone: 44

Use the right channel:

• Data privacy questions or rights requests → privacy@thoughtfulinsight.uk

• Safeguarding concerns → safeguarding@thoughtfulinsight.uk  or the Platform’s “Report” feature

Suspected data breach or security incident → security@thoughtfulinsight.uk  You may also complain to the ICO (www.ico.org.uk) — we’d appreciate the chance to resolve concerns directly first.