Privacy Policy

Last updated: May 2026

Who We Are

Let’s Thrive is an education programme created and operated by Baasit Siddiqui trading as Siddiqui Education LTD (“we”, “us”, “our”).

• Website: https://letsthrive.digital
• Email: contact@baasitsiddiqui.com
• Postal address: 1 Derwent Business Centre, Clarke Street, Derby, United Kingdom, DE1 2BU

We are the data controller for the personal information collected through this website and our programmes. This means we decide how and why your personal data is used.

We are registered with the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection. You can verify our registration at https://ico.org.uk/ESDWebPages/Search.

What This Policy Covers

This Privacy Policy explains:

• What personal information we collect and why
• How we use it and who we share it with
• How long we keep it
• Your rights and how to exercise them

It applies to all visitors to letsthrive.digital and anyone who engages with our programmes, services, or communications.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (PECR). Where our services are accessed by or relate to children, we also follow the ICO’s Children’s Code (Age Appropriate Design Code).

The Information We Collect

1. Enquiry and Discovery Call Information

When you complete our Discovery Call request form (hosted via Google Forms), we collect:

• Your name
• Your email address
• Your school, college, organisation, or company name
• Your role or job title
• A phone number (if provided)
• Any information you choose to include about your enquiry or needs

Why we collect this: To respond to your enquiry, arrange a discovery call, and explore how Let’s Thrive can support your setting.

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) — it is in both your interest and ours to respond to a request you have initiated. We will also rely on this basis to follow up on your enquiry within a reasonable period if we have not heard from you.

2. Email Marketing and Newsletter Sign-ups

If you subscribe to our email newsletter or marketing communications, we collect:

• Your name
• Your email address

Our email marketing is delivered via Flowdesk, a third-party email marketing platform. By subscribing, your data is stored and processed by Flowdesk on our behalf.

Why we collect this: To send you updates about Let’s Thrive programmes, news, resources, and events.

Legal basis: Consent (Article 6(1)(a) UK GDPR). You can withdraw your consent at any time by clicking the unsubscribe link in any email we send, or by emailing us directly. Withdrawing consent does not affect the lawfulness of any processing that took place before you withdrew it.

3. Passport to Thrive — Learner Progress Submissions

The Passport to Thrive programme is a free, self-guided digital resource. When a learner chooses to share their progress with the Let’s Thrive team upon completion, they may provide:

• A name or username
• Progress information or reflections from their workbook

Why we collect this: To acknowledge their completion, celebrate their achievement, and (where relevant) to invite them to the next stage of their Let’s Thrive journey.

Legal basis: Consent (Article 6(1)(a) UK GDPR) — submission of progress is voluntary and not required to access the resource.

Important note on children’s data

Our programmes are designed for learners of all ages, including children under the age of 18. Where a learner is a child:

• We expect schools, colleges, or other educational institutions to act as the appropriate gateway for obtaining consent and sharing information with us.
• Schools and educational settings that work with us are responsible for ensuring that the appropriate data sharing arrangements and parental or guardian consents are in place before any child’s data is shared with us.
• We do not knowingly collect personal data directly from children under the age of 13 without verifiable parental or guardian consent, or without the school acting as the appropriate data controller under their own safeguarding and data protection policies.
• Where a child’s data is shared with us by a school or educational setting, we process it only for the purposes described in our agreed arrangements with that institution, and in accordance with our obligations as a data processor on their behalf.
• We do not use children’s data for marketing purposes.
• We apply the principles of the ICO’s Children’s Code (Age Appropriate Design Code) and take appropriate care in how we handle any data relating to children.

If you are a parent or guardian and have concerns about data relating to your child, please contact us using the details at the top of this policy.

4. Website Usage and Technical Data

When you visit letsthrive.digital, we (and the third-party services we use) may automatically collect certain technical data, including:

• Your IP address
• Browser type and version
• Device type and operating system
• Pages visited and time spent on each page
• Referring URLs (where you came from)
• Date and time of your visit

This data is typically collected through cookies and similar technologies. Please see the Cookies section below for more detail.

Why we collect this: To maintain and improve the performance and security of our website, understand how visitors use it, and improve the user experience.

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) for technical/security data; consent (Article 6(1)(a)) for analytics cookies where these are used.

5. Google Fonts

Our website uses Google Fonts, a web font service provided by Google LLC. When you visit the site, your browser requests the fonts directly from Google’s servers, which may result in your IP address being transmitted to Google.

• Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
• Google’s Privacy Policy: https://policies.google.com/privacy

Legal basis: Legitimate interests (Article 6(1)(f) UK GDPR) in providing a consistent and well-rendered website experience.

6. Booking and Contractual Information

When a school or organisation books a paid Let’s Thrive programme, keynote, CPD session, or in-person event, we will collect and process information necessary to fulfil that contract, which may include:

• Contact details for the booking lead and invoicing contact
• School or organisation name and address
• Any relevant information about the event, dates, and learner group

Legal basis: Performance of a contract (Article 6(1)(b) UK GDPR), and legal obligation (Article 6(1)(c)) for financial record-keeping.

How We Use Your Information

In summary, we use the information we collect to:

• Respond to enquiries and arrange discovery calls
• Deliver and administer our programmes and services
• Send you newsletters and marketing communications you have signed up for
• Celebrate and acknowledge learner completions and achievements
• Manage our contractual relationships and financial obligations
• Maintain and improve our website
• Comply with our legal and regulatory obligations

We will not use your information for any purpose that is incompatible with the reason it was originally collected, unless we have your consent or are required to do so by law.

Who We Share Your Information With

We do not sell your personal data. We may share it with the following categories of third parties, only to the extent necessary and under appropriate data processing agreements:

We may also disclose personal data to:

• Professional advisers (e.g. accountants, solicitors) where necessary
• Law enforcement or regulatory authorities where we are required to do so by law
• A successor organisation if our business is transferred, merged, or restructured

Any third parties we work with are required to handle your data securely and in accordance with UK GDPR.

International Data Transfers

Some of our third-party service providers are based outside the UK. Where we transfer personal data internationally, we ensure that appropriate safeguards are in place — such as adequacy decisions, standard contractual clauses, or equivalent mechanisms approved under UK data protection law — to protect your information to a standard equivalent to the UK.

Cookies

Cookies are small text files placed on your device when you visit a website. They help the website function properly and allow us to understand how visitors use it.

Strictly Necessary Cookies

These cookies are essential for the website to function. They cannot be switched off. They are usually set in response to actions you take, such as completing a form or setting your privacy preferences. These cookies do not store any personally identifiable information.

Analytics Cookies (where used)

If analytics tools are active on this site, they may set cookies to help us understand how visitors interact with our website — for example, which pages are most visited and how long people spend on the site. These cookies collect information in aggregate and do not identify you personally.

We will only use analytics cookies with your consent, where applicable under PECR.

How to Manage Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies or delete them at any time. Please note that blocking some types of cookies may affect your experience of the site.

For more information about cookies, visit https://www.allaboutcookies.org or the ICO’s guide at https://ico.org.uk/for-the-public/online/cookies.

How Long We Keep Your Information

We keep personal data only for as long as necessary for the purpose it was collected, or as required by law.

After the applicable retention period, data is securely deleted or anonymised.

Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

1. Right of access — You can request a copy of the personal data we hold about you (a Subject Access Request).

2. Right to rectification — You can ask us to correct inaccurate or incomplete data.

3. Right to erasure — You can ask us to delete your personal data where there is no compelling reason for us to continue processing it (the “right to be forgotten”).

4. Right to restriction of processing — You can ask us to restrict how we use your data in certain circumstances (e.g. while a dispute is resolved).

5. Right to data portability — Where processing is based on consent or contract, and carried out by automated means, you can ask us to provide your data in a structured, commonly used, machine-readable format.

6. Right to object — You can object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will always stop.

7. Rights relating to automated decision-making — You have the right not to be subject to decisions made solely by automated processing that have a significant effect on you. We do not carry out automated decision-making of this kind.

8. Right to withdraw consent — Where processing is based on your consent, you can withdraw it at any time. This does not affect the lawfulness of processing that took place before withdrawal.

How to Exercise Your Rights

To exercise any of these rights, please contact us at:

• Email: contact@baasitsiddiqui.com
• Post: 1 Derwent Business Centre, Clarke Street, Derby, United Kingdom, DE1 2BU

We will respond within one month of receiving your request. In complex cases we may extend this by a further two months, in which case we will let you know. We will not charge a fee for responding to your request, unless it is manifestly unfounded or excessive.

We may need to verify your identity before we can action your request.

How We Keep Your Data Secure

We take reasonable and appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:

• Secure, password-protected access to systems containing personal data
• Using third-party services that maintain their own security standards (see their privacy policies)
• Limiting access to personal data to those who need it to carry out their role

No method of electronic transmission or storage is 100% secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, contact you directly.

Links to Other Websites

Our website may contain links to third-party websites, including our sponsor and partner organisations. This Privacy Policy applies only to letsthrive.digital. We are not responsible for the privacy practices of any third-party sites, and we encourage you to read their own privacy policies.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or the way we operate. The “Last updated” date at the top of this page will always show when the most recent change was made.

We encourage you to review this page periodically. Where we make significant changes, we will take reasonable steps to bring them to your attention.

How to Make a Complaint

If you are unhappy with how we have handled your personal data, please contact us in the first instance so we can try to resolve the matter:

• Email: contact@baasitsiddiqui.com
• Post: 1 Derwent Business Centre, Clarke Street, Derby, United Kingdom, DE1 2BU

If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

• Website: https://ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

This policy was prepared in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and the ICO’s Children’s Code. It should be reviewed at least annually or whenever there is a material change to how personal data is collected or processed.