Home / Privacy Policy
Privacy Policy
Last updated: 8 September 2026
This statement explains what personal information I collect, why I use it, who I share it with and the choices you have.
1. Who I am
Rhys Morgan, trading as Thrive With Rhys, is a UK sole trader and the controller of the personal information covered by this statement.
- Business address: 1 Izabella House, 24-26 Regent Place, Birmingham B1 3NJ
- Email: rhys@thrivewithrhys.com
This statement covers the Thrive With Rhys website, digital products, mailing list, enquiries, one-to-one services, speaking work and services supplied to organisations.
2. Information I collect
Information you give me
- Your name, email address and other contact details.
- Order, booking and contract details, including what you bought and when.
- Messages, enquiries, feedback and support requests.
- Information you choose to share during a one-to-one service, discovery call, workshop or speaking enquiry.
- Your marketing choices and evidence of consent, including the wording shown, date, time and connected IP address where this is recorded at checkout.
Payment information
Stripe processes payments. I receive order and payment-status information, but I do not receive or store your full card details.
Website and device information
If you accept analytics cookies, Google Analytics and Metricool may collect information such as pages visited, visit times, device and browser details, approximate location, IP address and interactions with the site. See the Cookie Policy for more detail and to change your choice.
Sensitive information
You may choose to share information about neurodivergence, disability, physical or mental health, or other sensitive matters. This is special category data under UK data protection law. I only ask for it where it is relevant, use it with your explicit consent, and limit access to it. Please do not send sensitive information that I have not asked for or do not need.
3. How I collect information
I collect information when you:
- buy or download a product;
- join the mailing list or request a free resource;
- contact me by email, the website or social media;
- book or take part in a call, service, event or programme;
- work with me or invite me to speak; or
- use the website and accept optional analytics cookies.
I may also receive limited information from services you use to contact, book or pay me, and from an organisation that has arranged a service for you. If an organisation gives me your details, it should have authority to do so.
4. Why I use information and my legal basis
| Information / activity | Why I use it | Legal basis |
|---|---|---|
| Orders, bookings and customer support | Take payment, deliver what you bought, provide access and deal with support. | Contract |
| Enquiries and business contacts | Reply, prepare proposals, arrange speaking or organisational work and manage business relationships. | Legitimate interests or steps before a contract |
| Accounting, tax and legal records | Keep required records, prevent fraud and deal with disputes. | Legal obligation and legitimate interests |
| Marketing | Send emails you asked to receive and keep evidence of your choice. | Consent |
| Optional analytics | Understand how the site is used and improve it. | Consent |
| Sensitive information | Adapt or provide a service where you choose to share relevant health or disability information. | Contract or legitimate interests, plus explicit consent for special category data |
Where I rely on legitimate interests, I consider whether the use is necessary and whether your rights outweigh my business need. You can object to this processing.
5. Email marketing
I send marketing emails when you have actively opted in. Buying a product does not automatically add you to marketing. You can unsubscribe using the link in any marketing email or by emailing me. I may keep a small suppression record so I do not add you back by mistake.
6. AI tools
I may use AI tools to help with drafting, summarising, research or business administration. I minimise or remove identifying information before using these tools. I do not knowingly submit confidential coaching notes, private messages, recordings or special category data to a general-purpose AI service unless I have told you what I plan to do and have a lawful basis to do it. I do not give permission for service providers to use your private information to train public AI models.
7. Who I share information with
I share information only where needed to run the business or comply with the law. Providers may include:
- Stripe, for payment processing;
- MailerLite, for email delivery and mailing-list management;
- Google Analytics and Metricool, for analytics when you consent;
- website hosting, cloud storage, email, booking and video-call providers;
- professional advisers, accountants, insurers or IT support where needed; and
- public authorities, courts or regulators where the law requires it.
These providers act under their own privacy terms or under contracts requiring them to protect the information. I do not sell or rent your personal information. I do not share it with third parties for their own marketing without your consent.
8. International transfers
Some service providers may process information outside the UK. Where UK transfer rules apply, I use a recognised safeguard. This may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework for an eligible US provider, the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses. The safeguard depends on the provider and transfer.
9. How long I keep information
| Type of record | Usual retention |
|---|---|
| Orders, invoices, contracts and accounting records | Usually 6 years, or longer if the law requires it or a dispute is active. |
| Mailing-list details | Until you unsubscribe or ask me to delete them. |
| Consent and unsubscribe records | While I rely on the consent, with a limited record kept afterwards where needed to prove the choice or respect an unsubscribe. |
| Enquiries that do not become paid work | Usually up to 2 years after the last contact. |
| One-to-one service notes and related messages | Usually up to 3 years after the service ends, unless a shorter or longer period is needed. |
| Google Analytics user-level data | Up to 14 months, depending on the property setting. Aggregated reports may remain longer. |
I may keep information longer where needed for tax, insurance, legal claims, complaints or fraud prevention. I delete or anonymise information when it is no longer needed.
10. Security
I use reasonable technical and organisational measures to protect information. These include access controls, passwords and security features offered by my service providers. No online system is completely secure. If a personal data breach creates a legal duty to notify the ICO or affected people, I will do so.
11. Recordings and testimonials
I will tell you before recording a call, workshop or event and explain the intended use. I will obtain any consent or agreement needed before using an identifiable testimonial, case study, image, audio or video for marketing. You may refuse optional recording or marketing use without losing the underlying service, unless recording is an agreed and necessary part of that service.
12. Your rights
Depending on the circumstances, you may have the right to:
- ask for a copy of your personal information;
- correct inaccurate or incomplete information;
- ask for information to be deleted or its use restricted;
- object to processing based on legitimate interests or to direct marketing;
- receive certain information in a portable format;
- withdraw consent at any time; and
- complain to the Information Commissioner's Office (ICO).
These rights have legal limits, so I may sometimes need to keep or continue using information. To make a request, email rhys@thrivewithrhys.com. I may need to confirm your identity. I normally respond within one month.
You can contact the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
13. Links and other websites
The website may link to other websites and platforms. Their privacy notices apply when you use them. I am not responsible for how an independent site handles your information.
14. Changes to this statement
I may update this statement when the business, its service providers or the law changes. The current version and update date will appear on thrivewithrhys.com. I will give extra notice where a change materially affects how I use your information.
15. Contact
Questions, concerns and rights requests can be sent to Rhys Morgan at rhys@thrivewithrhys.com.