Privacy Policy.

1. Introduction

Thryvio ("we", "us", "our") is committed to protecting your privacy and handling your personal data transparently and lawfully. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the rights you have over your data.

This policy applies to all visitors, clients, and users of thryvio.co.uk (the "Site"), our automation services, our contact channels (including email, phone, WhatsApp, and web forms), and any other services we provide (collectively, the "Services").

By using our Site or Services, you acknowledge you have read and understood this Privacy Policy. If you do not agree with any part of this policy, please do not use our Site or Services.

2. Who We Are (Data Controller)

Thryvio is the "data controller" of the personal information you provide. This means we are responsible for deciding how and why your data is processed.

Data Controller: Thryvio
Trading Address: 171 Clough Close, Middlesbrough, TS5 5EX, United Kingdom
Email: info@thryvio.co.uk
Website: thryvio.co.uk

For any questions or requests regarding your personal data, contact us at the email above.

3. Information We Collect

We only collect the personal data we genuinely need to provide our Services or communicate with you. This falls into the following categories:

3.1 Information You Give Us Directly

• Contact form submissions: Name, email address, phone number (optional), service interest, and any message content you provide.
• Email correspondence: Your email address, the content of your messages, and any attachments.
• Phone and WhatsApp communications: Your phone number, the content of calls and messages, voicemails and call recordings (only where lawfully required or with your explicit consent).
• Booking data: When you book a call with us, we may collect your name, business name, availability, and any information you volunteer about your business.
• Client onboarding: If you become a client, we may collect additional information required to deliver services — business details, invoicing information, integration credentials via official OAuth (we do not store passwords), and any information you choose to share about your operations.

3.2 Information We Collect Automatically

• Technical data: IP address, browser type, device type, operating system, referring URL, pages visited, and time spent on pages.
• Analytics data: Anonymous or pseudonymous usage statistics collected via privacy-friendly analytics tools.
• Cookies and similar technologies: See section 11 for full details.

3.3 Information from Third Parties

We may receive information about you from third-party platforms if you interact with us through them (for example, if you message us via WhatsApp, LinkedIn, or a social media platform). We only receive the information those platforms share with us in accordance with their own policies and your privacy settings.

4. How We Use Your Information

We use your personal data only for specific, defined purposes:

Purpose	Data Used
Responding to enquiries and providing information	Name, email, phone, message content
Booking and conducting client calls	Name, email, phone, business details
Delivering our automation and web services	All client information provided during onboarding
Invoicing and financial administration	Business details, invoicing information
Sending service updates and follow-ups	Email, phone, name
Improving our website and services	Technical and analytics data
Complying with legal obligations	Any data as required by law
Preventing fraud and unauthorised access	Technical data, contact data

We do not sell your personal data to any third party under any circumstances.

5. Lawful Basis for Processing

Under UK GDPR, we must have a lawful basis to process your personal data. We rely on the following:

• Consent: Where you have given clear, informed consent (for example, when you submit our contact form, opt in to marketing emails, or agree to WhatsApp communications).
• Contract: Where processing is necessary to enter into or perform a contract with you (for example, delivering the services you've engaged us for).
• Legitimate interests: Where processing is necessary for our legitimate business interests (for example, responding to enquiries, improving our services, or preventing fraud), provided your fundamental rights do not override those interests.
• Legal obligation: Where we are required to process data to comply with a legal obligation (for example, tax records or lawful requests from public authorities).

6. Data Sharing & Third Parties

We only share your personal data with third parties where necessary to provide our Services or comply with legal obligations. All third parties we use are bound by data protection obligations and only process your data on our behalf.

6.1 Service Providers We Use

• Cloudflare (Cloudflare, Inc.): Website hosting via Cloudflare Pages and content delivery. Cloudflare may process technical data such as IP addresses for security and performance purposes.
• n8n (n8n GmbH): Our automation platform. Data submitted through our contact form is sent to an n8n workflow that routes the enquiry to us via email or CRM.
• Google (Google LLC): Google Fonts (for typography) and, if used, Google Workspace for email correspondence.
• YouTube (Google LLC): Embedded video content on our Site may set cookies and process technical data.
• Meta (Meta Platforms, Inc.): If you communicate with us via WhatsApp, Meta processes the message content in accordance with their own privacy policy. See section 12 for full details.
• Email and messaging providers: Standard email service providers, SMS providers, and CRM platforms used to communicate with clients and manage enquiries.
• Payment processors: If you become a paying client, payment information is processed by regulated third-party payment providers. We do not store card details on our systems.

6.2 When We Would Disclose Data

We may disclose your personal data if legally compelled to do so (for example, in response to a court order, valid legal process, or lawful request from a public authority), or if necessary to protect our legal rights, prevent fraud, or protect the safety of any person.

7. International Data Transfers

Some of the third-party providers we use (such as Cloudflare, Google, and Meta) are based outside the United Kingdom, including in the United States. When your personal data is transferred outside the UK, we ensure it is protected by appropriate safeguards, including:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO).
• UK-approved adequacy decisions (where applicable).
• Additional technical and organisational measures (such as encryption) where necessary.

8. Data Retention

We only keep your personal data for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

Data Type	Retention Period
Contact form enquiries (non-clients)	Up to 12 months from last contact
Client business records	7 years from end of engagement (UK tax requirement)
Invoices and financial records	7 years (UK legal requirement)
Email correspondence	Up to 3 years or until deleted at your request
WhatsApp / SMS messages	Up to 12 months from last message, unless required for legal reasons
Website analytics	Up to 26 months (aggregated / anonymised)

Once the retention period expires, we securely delete or anonymise your personal data.

9. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. Measures include:

• Encrypted data transmission (HTTPS across the site).
• Access controls and authentication on all systems.
• OAuth-based integrations (we never store third-party passwords).
• Regular software updates and security reviews.
• Limited access to personal data on a need-to-know basis.

While we work hard to protect your data, no method of transmission over the internet or method of electronic storage is 100% secure. If you believe your personal data has been compromised, please contact us immediately.

10. Your Rights

Under UK GDPR, you have the following rights over your personal data:

• Right to access: Request a copy of the personal data we hold about you.
• Right to rectification: Request that we correct any inaccurate or incomplete personal data.
• Right to erasure ("right to be forgotten"): Request that we delete your personal data where there is no valid reason for us to continue holding it.
• Right to restrict processing: Request that we pause processing your personal data.
• Right to data portability: Request a copy of your personal data in a structured, machine-readable format.
• Right to object: Object to us processing your personal data on the basis of legitimate interests or for direct marketing.
• Right to withdraw consent: Where we rely on consent as the lawful basis, you can withdraw it at any time.
• Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects on you.

To exercise any of these rights, email us at info@thryvio.co.uk. We will respond within one month. There is no fee for exercising your rights, though we may charge a reasonable fee for manifestly unfounded or excessive requests, or refuse to comply as permitted by law.

11. Cookies & Tracking

Our Site uses a minimal number of cookies and tracking technologies. Cookies are small text files placed on your device when you visit a website.

11.1 Types of Cookies We Use

• Strictly necessary cookies: Required for the Site to function. These cannot be disabled.
• Third-party cookies: When you interact with embedded content (such as YouTube videos), those services may set their own cookies in accordance with their policies.

11.2 Managing Cookies

You can control and delete cookies through your browser settings. Blocking all cookies may affect the functionality of the Site.

12. WhatsApp & Messaging Communications

We may communicate with you via WhatsApp, SMS, or other messaging platforms. This section explains how we handle those communications.

12.1 How WhatsApp Communications Work

When you message us on WhatsApp or when we message you (with your consent or as part of an active engagement), the following applies:

• Messages are transmitted through WhatsApp (a service of Meta Platforms, Inc.) and are subject to WhatsApp's Privacy Policy in addition to this policy.
• WhatsApp messages are end-to-end encrypted between your device and ours, but Meta may process metadata (such as phone numbers and timestamps) in accordance with their own policies.
• We use WhatsApp Business tools to organise and respond to conversations. Message content and phone numbers may be temporarily stored on WhatsApp Business Platform infrastructure.

12.2 Opt-In and Opt-Out

• Opt-in: By initiating a WhatsApp conversation with us, sharing your number via our contact form, or expressly agreeing to WhatsApp communications, you consent to receiving messages from us on that channel.
• Opt-out: You can opt out of WhatsApp communications at any time by replying "STOP", "UNSUBSCRIBE", or emailing us at info@thryvio.co.uk. Once you opt out, we will not send you further messages except as required to complete a service you have already engaged us for.

12.3 Message Content and Retention

We may retain WhatsApp message logs and content for up to 12 months from the last message to provide continuity of service, respond to follow-ups, and resolve disputes. Longer retention may apply where required by law.

12.4 Automated Messages

Some messages we send may be automated (for example, appointment confirmations or follow-ups on an active enquiry). All automated messaging complies with the ICO's guidance and, where applicable, WhatsApp's Business Policies. You may still reply to a human at any time.

12.5 What We Will Not Do

• We will not sell your phone number or WhatsApp messages to any third party.
• We will not spam you with promotional messages you have not agreed to receive.
• We will not use WhatsApp to share confidential documents that are unsuitable for that channel.

13. Children's Privacy

Our Services are directed at businesses and business owners, not children. We do not knowingly collect personal data from children under 16 years of age. If you are under 16, please do not submit any personal information through our Site or Services. If we become aware that we have collected personal data from a child under 16 without verified parental consent, we will delete that information promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other reasons. The updated version will be indicated by a revised "Last Updated" date at the top of this policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. For material changes, we may notify you directly (for example, by email) where reasonable to do so.

15. Complaints & ICO

If you believe we have not handled your personal data in accordance with the law, please contact us first at info@thryvio.co.uk so we can try to resolve your concern.

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO), the UK's data protection regulator:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk

16. Contact Us

For any questions, requests, or concerns about this Privacy Policy or how we handle your personal data, please contact us:

Email: info@thryvio.co.uk
Website: thryvio.co.uk/contact
Post: Thryvio, 171 Clough Close, Middlesbrough, TS5 5EX, United Kingdom