Privacy Policy — How We Work With You

THRINX & CO LTD

Privacy Policy

1. Introduction

THRINX & CO Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website at thrinxandco.co.uk or engage with our advisory services.

We are registered in England and Wales (Companies House No: [INSERT]) and registered with the Information Commissioner's Office (ICO Registration No: [INSERT]). We operate in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Data (Use and Access) Act 2025 (DUAA 2025).

2. Who We Are

Data Controller: THRINX & CO Ltd

Registered Address: Greater Manchester, England

Companies House Registration Number: 15586788

ICO Registration Number: [INSERT]

Email: Thrinxandco@gmail.com

Telephone: 07766866649

Website: thrinxandco.co.uk

As data controller, we determine the purposes and means of processing your personal data. If you have any questions about this policy or how we handle your data, please contact us using the details above.

3. What Personal Data We Collect

We may collect and process the following categories of personal data:

3.1 Data You Provide Directly

• Full name and job title

• Business name and sector

• Email address and telephone number

• Information submitted via our contact or enquiry forms

• Details of your business needs, challenges, or strategic objectives shared during consultations

3.2 Data We Collect Automatically

• IP address and browser type

• Pages visited and time spent on our website

• Referring website or search terms used to find us

• Cookie identifiers (see Section 9 for our full Cookie Policy)

3.3 Data From Third Parties

• Publicly available professional information (e.g. LinkedIn profiles) where relevant to a business engagement

• Referrals from existing clients or professional networks

4. How We Use Your Personal Data

We use your personal data for the following purposes. From 5 February 2026, our lawful bases reflect the updated framework introduced by the Data (Use and Access) Act 2025 (DUAA 2025), including the new "recognised legitimate interests" (RLI) basis where applicable:

• Responding to enquiries and providing advisory services — Legal basis: Contract performance

• Sending relevant updates, insights, or service information — Legal basis: Legitimate interests (you may opt out at any time)

• Maintaining records of our client engagements — Legal basis: Legal obligation / Legitimate interests

• Improving our website and user experience — Legal basis: Legitimate interests

• Complying with legal and regulatory obligations — Legal basis: Legal obligation

• Crime prevention, fraud detection, and network/information security — Legal basis: Recognised Legitimate Interests (RLI) under DUAA 2025, Article 6(1)

We will never use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you without your explicit consent.

5. How We Share Your Personal Data

THRINX & CO Ltd does not sell, rent, or trade your personal data. We may share your data only in the following limited circumstances:

• With trusted third-party data processors who support our operations (e.g. Squarespace for website hosting and analytics). All such processors are bound by written Data Processing Agreements (DPAs) in compliance with UK GDPR Article 28 and may only process your data strictly as directed by us

• With professional advisors (e.g. legal counsel or accountants) under duties of confidentiality

• Where required by law, regulatory authority, or court order

• For crime prevention or safeguarding purposes, where we may rely on the Recognised Legitimate Interests basis under DUAA 2025 without the need for a full balancing assessment

• In the event of a business transfer or restructuring, subject to appropriate confidentiality obligations

All third-party processors with whom we share your data are required to maintain appropriate technical and organisational security measures consistent with UK GDPR requirements.

6. How Long We Retain Your Data

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by applicable law:

• Enquiry and contact form data: up to 12 months from last contact, unless a client relationship is established

• Client engagement records: up to 7 years following the end of an engagement, in line with UK legal and regulatory requirements

• Data protection complaint records: up to 3 years from resolution, in line with ICO guidance

• Cookie consent records: up to 12 months from the date of consent, available to the ICO on request

• Website usage data (cookies and analytics): in accordance with our Cookie Policy (Section 9)

When your data is no longer required, we will securely delete or anonymise it.

7. Your Rights Under UK GDPR and the DUAA 2025

You have the following rights in relation to your personal data. These rights reflect the UK GDPR as updated by the Data (Use and Access) Act 2025, with key provisions in force from 5 February 2026:

• Right of access — to request a copy of the personal data we hold about you (we may "stop the clock" while awaiting clarification from you, as codified by DUAA 2025)

• Right to rectification — to request correction of inaccurate or incomplete data

• Right to erasure — to request deletion of your data in certain circumstances

• Right to restrict processing — to request that we limit how we use your data

• Right to data portability — to receive your data in a structured, machine-readable format

• Right to object — to object to processing based on legitimate interests or for direct marketing

• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

• Right to complain directly to us — under the DUAA 2025, you have the right to raise a data protection complaint directly with THRINX & CO Ltd before escalating to the ICO (see Section 8 below)

To exercise any of these rights, please contact us at Thrinxandco@gmail.com. We will acknowledge your request promptly and respond in full within 30 days, or inform you if an extension is required.

8. How to Raise a Data Protection Complaint

Under the Data (Use and Access) Act 2025, you have the right to raise a data protection complaint directly with THRINX & CO Ltd. We operate the following internal complaints procedure:

• Step 1 — Submit your complaint in writing to Thrinxandco@gmail.com with the subject line "Data Protection Complaint"

• Step 2 — We will acknowledge your complaint within 30 days of receipt

• Step 3 — We will investigate and provide a full written response without undue delay

• Step 4 — If you remain dissatisfied following our response, you may escalate your complaint to the Information Commissioner's Office (ICO)

ICO Contact Details:

Website: ico.org.uk/make-a-complaint

Telephone: 0303 123 1113

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

9. Cookies

Our website uses cookies to enhance your browsing experience and to analyse site traffic. Please refer to our standalone Cookie Policy available at thrinxandco.co.uk/cookie-policy for full details, including a complete cookie inventory, consent logging practices, and how to manage your preferences.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, including:

• Secure website hosting with SSL/TLS encryption (HTTPS) via Squarespace

• Written Data Processing Agreements with all third-party processors

• Access controls limiting who within our organisation can access personal data

• Regular review of our data handling and security practices

While we take all reasonable steps to protect your data, no transmission over the internet is completely secure. We cannot guarantee the absolute security of data transmitted to our website.

11. International Data Transfers

THRINX & CO Ltd is based in the United Kingdom. Where we use third-party service providers who process data outside the UK, we ensure that appropriate safeguards are in place, including adequacy decisions or standard contractual clauses, in accordance with UK GDPR and DUAA 2025 requirements.

12. Children's Data

Our website and services are directed at business professionals and are not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. The Data (Use and Access) Act 2025 introduced enhanced protections for children's personal data ("children's higher protection matters"), and we are committed to complying with these requirements. If you believe we have inadvertently collected data from a child, please contact us immediately at walelatunji@yahoo.com and we will take prompt steps to delete such data.

13. Third-Party Links

Our website may contain links to third-party websites. This Privacy Policy applies solely to our website and services. We are not responsible for the privacy practices of third-party websites and encourage you to review their privacy policies before submitting any personal data.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of any significant changes by updating the "Last updated" date at the top of this document. We encourage you to review this policy periodically.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please contact us:

THRINX & CO Ltd

Companies House No: 15586788

Greater Manchester, England

Email: Thrinxandco@gmail.com

Telephone: 07766866649

Website: thrinxandco.co.uk