Thrive 8 Privacy Notice

Intogreat Ltd (“Intogreat”, “Us”, “We”, or “Our”) understands the importance of your privacy and that you want to clearly understand how your Personal Data is used. We will only collect and use Personal Data in ways that are described here, and in a way that is consistent with our obligations and your rights under all relevant data privacy laws.

‍

This Privacy Notice explains how we collect, use, store, protect and share personal data when you complete the Thrive 8 Index. This Privacy Notice is intended for individuals in the United Kingdom and is designed to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations.

‍

Effective date:  27th January 2026

‍

Who we are and how to contact us

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations is Intogreat Ltd (company number 13734084)

Registered address: Suite 6a, 10 Duke Street, Liverpool L1 5AS, UK

Telephone: +44 (0) 7597 487 220

General and privacy enquiries email: hello@intogreat.net

‍

This means Intogreat, not your employer, decides how and why your information is used,and is legally responsible for it. You can contact us about anything in this Privacy Notice using the details above.

‍

Data protection officer (DPO)

We have assessed our obligations and, at present, a statutory Data Protection Officer is not required. If you have questions about this assessment or wish to contact the person responsible for privacy matters, please email hello@intogreat.net or write to the address above, marked “Privacy”.

‍

The data we collect‍

When you complete the Thrive 8 Index, we collect:

•   Identifying details: your name, email address, the organisation you belong to, the country you work in, where relevant, details of the learning programme you attended, and any other demographic details that are relevant to the ongoing development of the Thrive 8 Index.

•   Your assessment responses: your answers to questions about how different parts of your life are feeling, including how you are coping under pressure, your energy, and how connected and supported you feel.

•   Your Thrive 8 Index results: the scores and personal report we generate from your responses.

‍

Because the assessment asks about your well-being, your responses include information about your health. Health information is “special category data” under UK data protection law, which means it has extra legal protection and we may only use it with your explicit consent.

‍

How we use your information, and our legal basis for processing

We use yourinformation for two purposes only:

•   To create your personal Thrive 8 Index report, which is provided to you and to no one else.

•   To produce anonymised, aggregated insights for your organisation, showing patterns across the whole group. Before any group results are shared, all identifying information is removed and responses are combined so that no individual can be identified. We never produce group results for fewer than 10 people, so results cannot be traced back to you even in small teams.

‍

Our legal basis for collecting and using your information is your consent (Article6(1)(a) UK GDPR), and for your health information, your explicit consent (Article 9(2)(a) UK GDPR), which we ask for at the start of the assessment. We do not use your information for marketing, and we do not sell it or share it with anyone for their own purposes.

‍

Only Intogreat; never your organisation, your manager, or anyone else sees your data. You, and only you, receive your report. Once group data has been fully anonymised it is no longer personal data, and we may retain anduse it, for example, to improve and validate the Thrive 8 Index. This never includes anything that could identify you.

‍

Your report is generated by Intogreat using our own scoring tools within our secure Microsoft365 environment. No decisions are made about you by automated means, and your individual results are never used to evaluate you for employment purposes.

‍

Taking part is voluntary

Completing the Thrive 8 Index is entirely your choice. Your organisation has commissioned the assessment, but it does not see who has or has not taken part in individual terms, and choosing not to participate, or withdrawing later, has no consequences for you. Consent given under pressure is not valid consent, and we have designed the assessment so that no such pressure can arise.

s

Who can see your information

Your individual answers, scores and report are seen only by Intogreat. They are never shared with your organisation, your manager, HR, or any other third party. You are the only person who receives your personal report.

‍

We use Microsoft365 (including Microsoft Forms, Excel and OneDrive) to collect, store and process assessment data. Microsoft acts as our data processor under contract terms that require it to protect your data and use it only on our instructions. We do not use any other service providers to process your assessment data. Microsoft may store data in data centres outside the UK. Where this involves a transfer of your data internationally, it takes place under safeguards recognised by UK law, including UK adequacy regulations and the International Data Transfer Addendum to the EU Standard Contractual Clauses.

‍

We would disclose personal data to other parties only if required to do so by law.

‍

How long we keep your information

We keep your identifiable responses, scores and personal report for the duration of your organisation’s assessment cycle plus 12 months: an assessment cycle is usually 12 months, so in most cases your data is deleted within 24 months of completing the assessment. This allows us to support you and your organisation through the cycle, including any re-assessment, before your data is securely deleted.

‍

Anonymised, aggregated group results contain nothing that identifies you and may be kept for longer.

‍

How we protect your information

Your data is held in Intogreat’s secure Microsoft 365 environment, protected by access controls, encryption in transit and at rest, and multi-factor authentication. Access is restricted to the Intogreat team members who need it to run the assessment and produce reports.

‍

We maintain procedures to identify, investigate, and remediate personal data breaches. Where required, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a notifiable personal data breach. Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay, providing information about the nature of the breach, likely consequences, and measures taken.

‍

Your rights

Under UK data protection law you have the right to:

•   Withdraw your consent at any time. Email hello@intogreat.net marked "Privacy" and we will stop processing your data and delete your responses and report. Withdrawing is as easy as consenting, and does not affect anything done before you withdrew. Where your responses have already been included in fully anonymised group results, those results cannot be unpicked, but they contain nothing that identifies you.

•   Access a copy of the personal information we hold about you.

•   Correct information that is inaccurate or incomplete.

•   Have your information erased, restrict how we use it, or object to its use.

•   Data portability: receive the information you gave us in a usable electronic format.

‍

To exercise any of these rights, contact hello@intogreat.net. We will respond within one month. There is no charge.

‍

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO): ico.org.uk • 0303 123 1113 • Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would welcome the chance to address any concern first, but you may contactthe ICO at any time.

‍

International users

If you access the Thrive 8 Index from outside the UK, please note that your data may be processed in the UK or other countries where our providers operate. We will implement appropriate safeguards for any transfers as described above.

‍

Changes to this notice

We may update this Privacy Notice from time to time. We will post any changes on this page and, where appropriate, notify you by email. Please review this Privacy Notice regularly.

‍

Contact

For privacy questions, to exercise your rights, or to make a complaint, please contact:

Data Controller: intogreat Ltd

Address: Suite 6A, 10 Duke Street, Liverpool, L1 5AS, UK

Email: hello@intogreat.net

Telephone: +44 (0)7597 487 220

‍

We will respond as soon as reasonably practicable and within the timeframes required by UK data protection law.

‍

‍