Privacy policy.

Thornbridge Solutions Ltd (“Thornbridge”, “we”, “us” or “our”) is a company registered in England & Wales that provides a workforce, compliance and care-management platform to organisations in the health, social care and adjacent regulated sectors. This policy explains how we process personal data as part of operating our website, handling enquiries, and providing our platform.

Controller and processor roles

Thornbridge acts in two distinct capacities, and it is important to understand which applies to you:

• As a data controller, for personal data collected through our website (for example enquiry and demo-request details), for our own marketing activity, for our website analytics, and for personal data about our own staff and job applicants. We decide the purposes and means of this processing.
• As a data processor, for personal data that our customers upload into, or generate within, the platform (for example workforce, rota, training, safeguarding and care records). In this capacity we act only on our customer’s documented instructions, under the terms of our Data Processing Agreement. If you are an individual whose data has been uploaded to the platform by an organisation you deal with, that organisation is the controller and the right first port of call for your enquiries or rights requests; we will support them in responding.

This policy applies to personal data processed in connection with: our marketing website; enquiry, demo-request and sales correspondence; onboarding and account administration for platform customers; the operation, support and security of the platform; and our own recruitment and employment activities. It does not override the specific terms of our Data Processing Agreement with customers, which governs our processing of customer data as a processor and takes precedence in the event of any conflict on that topic.

• Personal data, any information relating to an identified or identifiable living individual.
• Special category data, personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, or data concerning a person’s sex life or sexual orientation.
• Criminal offence data, personal data relating to criminal convictions, offences, allegations or related proceedings, including DBS check outcomes and safeguarding referrals.
• Processing, anything done with personal data, including collection, storage, use, disclosure and deletion.
• Controller and processor have the meanings given in Article 4 of the UK GDPR.
• UK GDPR and DPA 2018 mean the UK General Data Protection Regulation and the Data Protection Act 2018 respectively, as the applicable data protection framework in the United Kingdom.

Website visitors

Technical and usage data such as IP address, device and browser information, pages visited, referral source, and cookie or local storage identifiers necessary to run the site (see Cookies policy).

Enquirers and prospective customers

Name, work email address, telephone number, job title, organisation, sector, the content of any message or requirements you share with us, and records of our correspondence and calls.

Platform users (our customers’ staff)

Sign-in identity (name and work email), assigned role and permissions, authentication events, session and audit logs, and support correspondence.

Customer data (processed on behalf of our customers)

Depending on how a customer configures and uses the platform, this may include workforce records (names, contact details, employment status, right-to-work information), rota and attendance data, training and competency records, and compliance documentation. Where a customer operates in safeguarding, health or social care contexts, this can extend to:

• Special category data, health information relevant to fitness to work or to the people being cared for, and, in limited cases, information about racial or ethnic origin or religious belief where relevant to care planning.
• Criminal offence data, DBS disclosure outcomes, safeguarding concerns, allegations and investigation records, held for HR vetting and safeguarding purposes.

We do not decide what customer data is entered into the platform; our customers, as controllers, are responsible for ensuring they have a lawful basis (and, where relevant, an Article 9 condition and DPA 2018 Schedule 1 condition) for the data they upload.

• Directly from you, when you submit a form, email us or speak with our team.
• Automatically, through your use of our website (cookies and similar technologies).
• From your employer or the organisation you work for, where they have set you up as a platform user or entered your details as part of their workforce or care records.
• From publicly available sources such as company registers or professional networking sites, used sparingly for legitimate business development purposes.

The table below summarises the main purposes for which we process personal data as a controller, and the lawful basis or bases we rely on under Article 6 UK GDPR, together with any applicable Article 9 condition and DPA 2018 Schedule 1 condition where special category or criminal offence data is involved.

Where a customer is the controller for special category or criminal offence data processed within the platform, the customer is responsible for identifying and documenting the relevant Article 9 condition and DPA 2018 Schedule 1 condition, including maintaining an appropriate policy document where one is required. We support this through platform configuration and our Data Processing Agreement.

Where we rely on legitimate interests as our lawful basis, we carry out a legitimate interests assessment balancing our interests (or those of a third party) against your interests and fundamental rights and freedoms. In summary:

• Purpose test, we identify a genuine business need, such as responding to enquiries, maintaining the security of our systems, or growing our business in a way that benefits our customers.
• Necessity test, we consider whether the processing is a proportionate way to achieve that purpose and whether a less intrusive means is available.
• Balancing test, we weigh our interests against the potential impact on you, taking into account whether you would reasonably expect the processing and whether appropriate safeguards (such as opt-outs) are in place.

Records of our legitimate interests assessments are maintained internally and can be requested from hello@thornbridgesolutions.com.

Our website and platform are intended for business use by adults acting on behalf of organisations, and we do not knowingly collect personal data from children through our website. Where a customer uses the platform in connection with services provided to children (for example in children’s social care or education settings), the customer is the controller of any such data, and is responsible for ensuring appropriate safeguards and lawful bases are in place, including reliance on DPA 2018 Schedule 1 paragraph 18 (safeguarding of children and of individuals at risk) where relevant. We process such data only as a processor, on the customer’s documented instructions, and with the security measures described in this policy.

We use limited automated processing, including a lead-scoring feature that ranks sales enquiries by likely fit and readiness to proceed, based on factors such as organisation size, sector and engagement with our website. This scoring:

• Is used only to help our sales team prioritise follow-up and does not itself grant or deny access to our services.
• Does not produce legal effects, or similarly significant effects, concerning any individual.
• Is always reviewed by a member of our team before any decision affecting an enquiry is made.

We do not carry out solely automated decision-making that produces legal or similarly significant effects about individuals within the meaning of Article 22 UK GDPR. If this changes, we will update this policy and provide the safeguards and information required by law, including the right to obtain human intervention and to contest the decision.

We may send marketing communications about our platform to business contacts by email, relying on the “soft opt-in” exception under the Privacy and Electronic Communications Regulations where you are an existing contact and the message relates to similar services, or on your consent where required. You can opt out of marketing at any time by using the unsubscribe link in any email or by contacting hello@thornbridgesolutions.com. Opting out of marketing does not affect service communications necessary to operate your account or fulfil a contract.

We use cookies and local storage that are strictly necessary to operate the website and platform, such as keeping you signed in. We do not use advertising or cross-site tracking cookies. Full details of the cookies we use, their purpose and duration, and how to manage your preferences are set out in our Cookies policy.

We may share personal data with:

• Our sub-processors and service providers who host, support and secure the platform, acting under contract and on our instructions only.
• Professional advisers such as lawyers, auditors and insurers, where necessary for their services to us.
• Regulators, law enforcement or other authorities, where we are legally required to do so or to protect vital interests.
• A buyer or successor in the event of a reorganisation, merger or sale of all or part of our business, subject to appropriate confidentiality protections.

We do not sell personal data, and we do not share personal data with third parties for their own independent marketing purposes.

We engage a limited number of carefully assessed sub-processors, including our cloud hosting provider and other infrastructure and operational tooling providers, to help us deliver the platform. Each sub-processor is bound by a written contract imposing data protection obligations equivalent to those in our own contracts with customers. A current list of sub-processors, and the process for objecting to a new sub-processor, is maintained in our Data Processing Agreement.

We aim to process and store personal data within the United Kingdom wherever possible. Where a sub-processor or service provider needs to process personal data outside the UK, we ensure an appropriate transfer mechanism is in place before the transfer occurs, which may include:

• Transferring data to a country subject to UK adequacy regulations.
• Using the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, with the receiving party.
• Using the EU Standard Contractual Clauses (SCCs) alongside the UK Addendum, where relevant.
• Carrying out a Transfer Risk Assessment (TRA) to confirm that the transfer mechanism provides protection essentially equivalent to UK law, taking into account the laws and practices of the destination country.

Further detail on specific transfers relevant to our sub-processors is available in our Data Processing Agreement or on request from hello@thornbridgesolutions.com.

We keep personal data only for as long as necessary for the purposes it was collected, and in line with our retention policy and any statutory requirements. Approximate retention periods are set out below; the customer contract or Data Processing Agreement governs retention of customer data processed by us as processor.

Data subject to a legal hold (for example an ongoing complaint, claim or investigation) may be retained for longer while the hold applies.

We maintain technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure or destruction. These measures include, among others:

• Encryption of data in transit and at rest.
• Role-based access control (RBAC) limiting access to personal data to those who need it.
• Multi-factor authentication (MFA) for administrative and privileged access.
• Tamper-evident audit logging of access to and changes within the platform.
• Scheduled retention purges to remove data once it is no longer needed.
• A maintained breach register and incident response process.

A fuller description of our security architecture and practices is available on our Security page. If you have a security question or wish to report a vulnerability, contact security@thornbridgesolutions.com.

Subject to certain conditions and exemptions set out in law, you have the following rights in relation to your personal data:

Right of access

You can ask us to confirm what personal data we hold about you and provide a copy of it, together with supplementary information about how we process it.

Right to rectification

You can ask us to correct inaccurate or incomplete personal data.

Right to erasure

You can ask us to delete your personal data in certain circumstances, for example where it is no longer necessary for the purpose it was collected, or you withdraw consent and no other lawful basis applies.

Right to restriction of processing

You can ask us to limit how we use your personal data, for example while we verify its accuracy or consider an objection.

Right to data portability

Where we process data by automated means on the basis of consent or contract, you can ask us to provide it to you, or transmit it to another organisation, in a structured, commonly used and machine-readable format.

Right to object

You can object to processing based on legitimate interests, including profiling, and to processing for direct marketing at any time, in which case we will stop unless we have compelling legitimate grounds or need to continue for legal claims.

Rights related to automated decision-making

As explained in section 9, we do not currently make solely automated decisions with legal or similarly significant effects. Should this change, you would have the right to request human intervention, express your point of view and contest the decision.

Right to withdraw consent

Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

How to exercise your rights

To exercise any of these rights, email hello@thornbridgesolutions.comwith details of your request. If your personal data was provided to us by an employer or another organisation using the platform, we recommend contacting that organisation directly, as it is usually the controller and best placed to action your request; we will assist them where required under our Data Processing Agreement.

We may need to verify your identity before responding, using proportionate means such as confirming details already on file. We will respond within one calendar month of receiving a valid request and satisfactory identity verification. Where a request is complex or we have received a number of requests from you, we may extend this period by a further two months, and we will explain why within the first month. We do not normally charge a fee, but may charge a reasonable fee, or refuse to act, if a request is manifestly unfounded or excessive.

When we receive a request, we log it, confirm receipt, verify the requester’s identity, and route it to the appropriate team. For requests relating to customer data we process as a processor, we notify the relevant customer promptly and support them to respond, rather than responding directly ourselves, unless the customer instructs otherwise or we are legally required to act. We keep records of requests received and actions taken to demonstrate accountability under UK GDPR Article 5(2).

We maintain an incident response process and a breach register to record, assess and act on any personal data breach. Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to individuals, we will also notify those individuals directly without undue delay. Where we act as a processor, we will notify the affected customer without undue delay after becoming aware of a breach affecting their data, so that they can meet their own notification obligations as controller.

We hope we can resolve any concern you have about how we handle personal data, and we encourage you to contact us first at hello@thornbridgesolutions.com. You also have the right to lodge a complaint at any time with the UK supervisory authority, the Information Commissioner’s Office:

• Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
• Telephone: 0303 123 1113
• Website: ico.org.uk

We may update this policy from time to time to reflect changes in our practices, our services, or the law. We will post the revised version on this page with an updated “Last updated” date, and where changes are significant we will take reasonable steps to bring them to your attention, for example by email or an in-app notice. Please refer to related policies for further detail, including our Terms of Service, our Acceptable Use Policy, our Data Processing Agreement, our Cookies policy and our Security page.

If you have any questions about this policy or how we handle personal data, please contact us at hello@thornbridgesolutions.com. For security-related questions or to report a vulnerability or suspected breach, contact security@thornbridgesolutions.com.