Privacy Policy

We are committed to protecting your personal data and being transparent about how we use it. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights under UK data protection law. Please read this policy carefully. By using our website or becoming a member of the Thriving Card scheme, you acknowledge that you have read and understood this policy.

Who We Are

Thriving Media Ltd is a company registered in Scotland, trading as Thriving Wanders. We support local and independent businesses across Edinburgh and the Lothians through our membership community and the Thriving Card membership scheme.

Thriving Media Ltd also operates fitness and wellbeing activities, including Thriving Fitness and Get After It Girls.

For the purposes of UK data protection law, Thriving Media Ltd (trading as Thriving Wanders) is the Data Controller in respect of the personal data we collect and process. Our registered address and contact details are available at thrivingwanders.com.

Our Data Protection Officer is Abby Nash. If you have any concerns or questions about the data we hold about you, please contact Abby at hi@thrivingwanders.com. If we are unable to resolve your concerns satisfactorily, you can contact the Information Commissioner at ico.org.uk.

We are registered with the Information Commissioner’s Office (ICO). Our registration number is C1893051. You can verify our registration at ico.org.uk.

What Personal Data We Collect

Membership & Thriving Card Data

When you sign up as a member or register for the Thriving Card, we collect: full name, email address, membership type and status, date of birth and payment records (processed and stored securely via Stripe – we do not store full card details ourselves).

Student Membership

If you sign up for a Student Membership, we collect the standard membership data above plus: the name of your university or college, your expected graduation year and an image of your valid student ID card. Your student ID image is used solely to verify your eligibility and is deleted once verification is complete. The legal basis for processing this data is contract performance.

Tourist Membership

If you sign up for a Tourist Membership (7-day or 30-day pass), we collect the same standard membership data listed above. Tourist Memberships are non-recurring and your data will be retained for the standard period set out in Section 3.

Business Directory Membership

If your business signs up to be listed in the Thriving Wanders Business Directory, we collect standard membership data plus: business name, address, email, phone number and Thriving Card discount offered. These details will be displayed publicly as part of your directory listing. You may request removal or amendment at any time by contacting us at hi@thrivingwanders.com.

Events & Wellbeing Data

If you participate in a Thriving Wanders Event (including run clubs, fitness sessions, walks and wellness sessions), we may collect health and medical screening data via a health screening questionnaire. Health screening data is classified as special category data under UK GDPR and is processed on the basis of your explicit consent. You may withdraw consent at any time, though this may mean you are unable to participate in certain activities.

Website & Communications Data

When you interact with our website or communications, we may collect: email address (if you subscribe to our newsletter via Beehiiv), open and click data from emails, and basic website analytics (pages visited, browser type, approximate location).

Business & Event Enquiries

If you contact us directly or register for an event, we may collect: name and email address, the content of your message or enquiry, and any additional information you choose to provide.

How We Use Your Personal Data

We use your personal data only for the following purposes and only where we have a valid legal basis under UK GDPR:

Third-Party Services & Data Processors

We use a small number of trusted third-party platforms to operate our business. These companies act as data processors on our behalf and are contractually required to handle your data securely and in accordance with UK GDPR.

We do not sell your personal data to any third party. We may share anonymised, aggregated data with Participating Businesses to demonstrate the reach and impact of The Thriving Card. For full privacy policies of our third-party providers, please visit: joinit.com/privacy, stripe.com/gb/privacy, beehiiv.com/privacy, and policies.google.com/privacy.

International Data Transfers

Some of our third-party providers (including Join It, Stripe and Beehiiv) may process data outside the UK. Where this occurs, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the UK ICO, or that the recipient country benefits from an adequacy decision under UK GDPR.

How We Protect Your Data

We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:

• Access to personal data restricted to authorised personnel only
• Use of secure, reputable third-party platforms with their own security certifications (Stripe is PCI DSS compliant)
• Google Workspace protected by two-factor authentication
• Regular review of data handling practices
• Data held on password-protected systems and stored securely at our registered office

No method of transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. We have a process in place to identify any data breach and will inform you and the ICO of any such breach as soon as reasonably possible.

Your Rights Under UK GDPR

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — You can request a copy of the personal data we hold about you (Subject Access Request).
• Right to rectification — You can ask us to correct any inaccurate or incomplete data we hold.
• Right to erasure — You can ask us to delete your personal data in certain circumstances (the right to be forgotten).
• Right to restrict processing — You can ask us to restrict how we use your data in certain circumstances.
• Right to data portability — You can ask us to provide your data in a structured, commonly used format.
• Right to object — You can object to us processing your data where we rely on legitimate interests as our legal basis.
• Right to withdraw consent — Where we rely on your consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at hi@thrivingwanders.com. We will respond within one calendar month. If you are unhappy with how we handle your data, you have the right to lodge a complaint with the ICO at ico.org.uk or by calling 0303 123 1113.

Cookies & Website Analytics

Our website may use cookies and similar tracking technologies to help us understand how visitors use our site and to improve your experience. These may include:

Essential cookies — required for the website to function correctly.

Analytics cookies — to understand traffic and usage patterns (such as Google Analytics).

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our website. By continuing to use our website, you consent to the use of essential cookies.

Children’s Privacy

Our membership services and Thriving Wanders Events involving physical or wellbeing activities are for adults only (18 years of age and over). We do not knowingly collect personal data from children under the age of 16. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete it.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. The most current version will always be available at thrivingwanders.com. We will notify active members of any significant changes by email.

Contact Us

This Privacy Policy was prepared in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Thriving Media Ltd, trading as Thriving Wanders · November 2026