Privacy Policy

At Thornbury, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services. We are committed to protecting your personal data and respecting your privacy rights.

Last updated: January 2026

Information We Collect

Personal Information You Provide

We collect personal information that you voluntarily provide to us when you express interest in our services, contact us, or otherwise interact with our website. The types of personal information we may collect include:

• Name and contact details (email address, phone number, postal address)
• Company name and business information
• Professional details and job title
• Communication preferences
• Any other information you choose to provide in forms or correspondence

Automatically Collected Information

When you visit our website, we automatically collect certain information about your device and browsing behavior, including:

• IP address and location data
• Browser type and version
• Device information and operating system
• Pages visited and time spent on our website
• Referring website addresses
• Clickstream data and navigation patterns

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect information about your browsing activities. For detailed information about our use of cookies, please refer to our Cookie Policy.

How We Use Your Information

We use the information we collect for various legitimate business purposes, including:

• Providing Services: To deliver the consulting services you request and communicate with you about your inquiries
• Communication: To respond to your questions, send you updates, and provide customer support
• Website Improvement: To analyze usage patterns and improve our website's functionality and user experience
• Marketing: To send you information about our services, industry insights, and relevant updates (with your consent where required)
• Legal Compliance: To comply with applicable laws, regulations, and legal obligations
• Security: To protect against fraud, unauthorized access, and other security threats
• Business Operations: To manage our internal business operations and maintain business records

Legal Basis for Processing

We process your personal data based on the following legal grounds under UK GDPR:

• Consent: You have given clear consent for us to process your personal data for specific purposes
• Contract: Processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract
• Legal Obligation: Processing is necessary to comply with legal obligations
• Legitimate Interests: Processing is necessary for our legitimate business interests, provided these do not override your rights and freedoms

How We Share Your Information

We may share your information in the following circumstances:

• Service Providers: With trusted third-party service providers who assist us in operating our website, conducting our business, or servicing you (such as hosting providers, analytics services, and email platforms)
• Professional Advisors: With our legal, financial, and professional advisors when necessary for business purposes
• Legal Requirements: When required by law, regulation, legal process, or governmental request
• Business Transfers: In connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business
• With Your Consent: For any other purpose with your explicit consent

We ensure that all third parties who process your data on our behalf are bound by appropriate confidentiality and security obligations.

Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. The retention period depends on:

• The nature of the information and how it is used
• Legal, regulatory, tax, or accounting requirements
• Whether we have an ongoing relationship with you
• Our legitimate business interests

When we no longer need your personal information, we will securely delete or anonymize it in accordance with applicable data protection laws.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication procedures
• Employee training on data protection and security practices
• Secure backup and disaster recovery procedures

However, please note that no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security.

Your Rights and Opt-Out Instructions

You are not required to provide any personal information when using this website. If you prefer not to share your data, you may:

• Avoid filling out contact forms, account registrations, or any data-submitting features
• Disable cookies through your browser settings (see our Cookie Policy for more details)
• Contact us directly to request the deletion of any previously shared personal data

We respect your privacy choices. If you would like us to delete your data, please reach out to us using the contact details provided below. We will process your request promptly in accordance with applicable law.

Your Data Protection Rights

Under UK data protection law, you have the following rights:

• Right to Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data under certain circumstances
• Right to Restrict Processing: Request limitation of how we use your personal data
• Right to Data Portability: Request transfer of your personal data to another organization or to you
• Right to Object: Object to processing of your personal data for certain purposes
• Right to Withdraw Consent: Withdraw consent where processing is based on consent
• Right to Lodge a Complaint: Complain to the Information Commissioner's Office (ICO) if you believe your rights have been violated

International Data Transfers

Your personal information may be transferred to and processed in countries outside the United Kingdom. When we transfer data internationally, we ensure appropriate safeguards are in place to protect your information in accordance with UK data protection laws, including the use of standard contractual clauses or other approved transfer mechanisms.

Children's Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information without parental consent, please contact us, and we will take steps to remove such information.

Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party websites you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.