Privacy & Cookies Policy

intogreat Ltd (“intogreat”, “Us”, “We”, or “Our”) understands the importance of your privacy and that you want to clearly understand how your Personal Data is used. We will only collect and use Personal Data in ways that are described here, and in away that is consistent with our obligations and your rights under all relevant data privacy laws.

‍

This Website Privacy and Cookies Policy explains how intogreat Ltd collects and uses personal information when you:

•      visit our website;

•      contact us;

•      subscribe to marketing communications;

•      enquire about our services;

•      attend events or webinars; and

•      otherwise interact with us through our website.

‍

If you participate in the Thrive 8 Index assessment or related learning and development services, please refer to our separate Thrive 8 Privacy Notice.

‍

Effective date:  September 2026
‍

1. Who we are and how to contact us

intogreat Ltd is a leadership, organisational development and workplace wellbeing consultancy and the owner of the Thrive 8 Index® assessment methodology.

‍

The data controller within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is Intogreat Ltd (company number 13734084).

Registered address: Suite 6a, 10 Duke Street, Liverpool, L1 5AS, UK

Telephone: +44(0) 7597 487 220

General and privacy enquiries email: hello@intogreat.net

‍

This means Intogreat, not your employer, decides how and why your information is used, and is legally responsible for it. You can contact us about anything in this Privacy and Cookies Policy using the details above.

‍

2. Data protection officer (DPO)

Intogreat has assessed its obligations under applicable data protection laws and has determined that it is not currently required to appoint a statutory Data Protection Officer. Responsibility for privacy compliance sits with Intogreat's CEO and privacy enquiries can be directed to hello@intogreat.net or write to the address above, marked “Privacy”.

‍

3. Personal information we collect‍

Depending onhow you interact with us, we may collect:

•      name;

•      email address;

•      telephone number;

•      organisation name;

•      job title;

•      country or geographic location;

•      correspondence and enquiry details;

•      event registration information;

•      marketing preferences;

•      technical information about your use of our website.

‍

4. How we use personal information

We use personal information:

•      to respond to enquiries;

•      to provide information about our services;

•      to manage business relationships;

•      to administer events, webinars and workshops;

•      to provide newsletters and marketing communications where permitted;

•      to improve our website;

•      to maintain website security;

•      to comply with legal obligations;

•      to establish, exercise or defend legal claims.

‍

5. Lawful basis

We rely on one or more of the following lawful basis:

•      consent;

•      performance of a contract;

•      legitimate interests;

•      compliancewith legal obligations.

‍

1. Purpose: Responding to enquiries submitted through the website or by email. Personal Information: Contact details, organisation details and correspondence records. Lawful Basis: Legitimate interests (Article 6(1)(f) UK GDPR) to respond to enquiries, provide information about our services and manage business relationships.

2. Purpose: Providing information requested by prospective clients and discussing potential engagements. Personal Information: Contact details, organisation details and correspondence. Lawful Basis: Taking steps prior to entering into a contract (Article 6(1)(b) UK GDPR) and legitimate interests where appropriate.

3. Purpose: Sending newsletters and marketing communications. Personal Information: Name, email address and marketing preferences. Lawful Basis: Consent (Article 6(1)(a) UK GDPR). You may withdraw your consent at any time.

4. Purpose: Maintaining website functionality and security. Personal Information: IP address, browser information, device information and log data. Lawful Basis: Legitimate interests (Article 6(1)(f) UK GDPR) in operating, maintaining and securing our website and systems.

5. Purpose: Website analytics, performance monitoring and advertising conversion measurement. Personal Information: Website usage data, cookie identifiers and technical information. Lawful Basis: Consent (Article 6(1)(a) UK GDPR) where analytics cookies are used and consent is required.

6. Purpose: Preventing spam, fraud and misuse of website forms. Personal Information: IP address and technical verification data. Lawful Basis: Legitimate interests (Article 6(1)(f) UK GDPR) in protecting our website and preventing misuse.

7. Purpose: Compliance with legal and regulatory obligations. Personal Information: Any information necessary for compliance purposes. Lawful Basis: Compliance with a legal obligation (Article 6(1)(c) UK GDPR).

8. Purpose: Establishing, exercising or defending legal claims. Personal Information: Relevant correspondence, records and contractual information. Lawful Basis: Legitimate interests (Article 6(1)(f) UK GDPR) and, where applicable, for the establishment, exercise or defence of legal claims.

‍

6. Who can see your information

We may share personal information with:

•      website hosting providers;

•      email and communications providers;

•      marketing platform providers;

•      IT support providers;

•      professional advisers;

•      insurers;

•      regulators and public authorities;

•      carefully selected contractors and consultants who assist in delivering services.

‍

All service providers are required to protect personal information and only process it for authorised purposes.

‍

7. How long we keep information

•      email and communications providers;

1. Enquiry records - Up to 3 years after the last interaction.

2. Marketing records - Until consent is withdrawn, or after 24 months of inactivity (for example, no engagement with our marketing communications), whichever is earlier.

3. Website logs - Normally no longer than 12 months.

4. Contractual and businss records - Up to 6 years following completion of the relevant engagement.

5. Information required for legal or regulatory purposes - As required by applicable law.

•      marketing platform providers;

8. Website security

Data collected through our website is held in Intogreat’s secure Microsoft 365 environment, protected by access controls, encryption in transit and at rest, and multi-factor authentication. Access is restricted to Intogreat personnel and contractors who need it to respond to enquiries, manage marketing communications and maintain the website.

‍

We use a range of technical and organisational measures including:

•      access controls;

•      password management procedures;

•      multi-factor authentication;

•      website security monitoring;

•      secure hosting arrangements;

•      encryption technologies where appropriate;

•      confidentiality obligations applying to personnel and contractors.

‍

We maintain procedures to identify, investigate, and remediate personal data breaches. Where required, we will notify the ICO without undue delay and, where feasible,within 72 hours of becoming aware of a notifiable personal data breach. Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform you without undue delay, providing information about the nature of the breach, likely consequences, and measures taken.

‍

9. Your rights

Under UK data protection law you have the right to:

•      Withdraw your consent at any time. Email hello@intogreat.net marked "Privacy"and we will stop the relevant processing, for example by removing you from our mailing list or ceasing to use non-essential cookies for your visit. Withdrawing is as easy as consenting and does not affect anything done before you withdrew.

•      Access a copy of the personal information we hold about you.

•      Correct information that is inaccurate or incomplete.

•      Have your information erased, restrict how we use it, or object to its use.

•      Data portability: receive the information you gave us in a usable electronic format.

‍

To exercise any of these rights, contact hello@intogreat.net. We will respond within one month. There is no charge.

You also have the right to complain to the UK’s data protection regulator, the InformationCommissioner’s Office (ICO): ico.org.uk • 0303 123 1113 • Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would welcome the chance to address any concern first, but you may contact the ICO at any time.

‍

10. International users

If you access our website from outside the UK, please note that your data may be processed in the UK or other countries where our website and service providers operate, including the United States and the European Economic Area. We implement appropriate safeguards for any such transfers as described in section 18 below.

‍

11. Provision of the website and creation of log files

Each time you access our website, our system automatically collects data and information from the computer system of the accessing computer.

‍

The following data is collected:

•      Information about the browser type and the version used.

•      The operating system of the user.

•      The Internet service provider of the user.

•      The IP address of the user.

•      Date and time of access.

•      Websites from which the user’s system accesses our website.

•      Websites that are accessed by the user’s system via our website.

‍

This data is stored in the log files of our system. This data is not stored together with other personal data of the user.

The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session.

‍

The storage in log files is done to ensure the functionality of the website. An evaluation of the data for marketing purposes does not take place in this context.

‍

These purposes also constitute our legitimate interest in data processing under Article 6(1)(f)UK GDPR, which is the legal basis for the temporary storage of the data and the log files.

‍

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended. Where data is stored in log files, it is retained in accordance with the retention periods set out in section 7 above (normally no longer than 12 months), save that it may be retained for longer where necessary for fraud prevention or security purposes, in which case IP addresses are deleted or anonymised so that individual users can no longer be identified.

‍

The collection of data for the provision of the website and the storage of the data in log files is necessary for the operation of the website. Consequently, there is no possibility for the user to object.

‍

12. Use of cookies

Our website uses cookies and similar technologies to ensure that the website functions properly, improve your browsing experience, understand how visitors use our website and support our marketing communications.

‍

Cookies are small text files placed on your device when you visit a website. They allow websites to recognise your device and remember certain information about your visit. We use the following categories of cookies. Some are session cookies, which expire when you close your browser, and others are persistent cookies, which remain on your device for a defined period until they expire or you delete them.

‍

Strictly necessary cookies

These cookies are required for the operation of our website and cannot be switched off in our systems. They are usually set in response to actions made by you, such as setting privacy preferences, completing forms or accessing secure areas of the website.

Analytics cookies

We use Google Analytics and Google conversion tracking technologies to help us understand how visitors use our website, including information about page visits, websitetraffic, user journeys, site performance and marketing campaign effectiveness. These cookies help us improve our website, services and marketing communications. Analytics cookies are only used where you have provided the necessary consent through our cookie banner.

Functionality cookies

These cookies allow the website to remember choices you make and provide enhanced functionality and personalisation.

Security an danti-spam technologies

We use CAPTCHA and similar technologies to help protect our website, contact forms and newsletter subscriptions from automated abuse, spam and malicious activity. These technologies are strictly necessary for the security of our website and do not require your consent, although we provide this information for transparency.

Third-Party technologies

Our website is hosted and operated using Webflow. Certain website functionality may involve the use of cookies or similar technologies provided by Webflow and its service providers.

‍

We embed video content hosted by Vimeo. Vimeo cookies used for video playback analytics and player settings (vuid, player and flags) are non-essential and are only set where you have provided consent through our cookie banner. Cloudflare cookies delivered via our Vimeo embeds (cf_clearance, __cf_bm and _cfuvid) are used for bot prevention and rate-limiting and are treated as strictly necessary. We will update this notice where further third-party technologies are used.

‍

1. Cookie name: wf-csrf

Provider: Webflow

Purpose: Security token that protects form submissions against cross-site request forgery

Duration: Session

‍

2. Cookie name: fs-cc

Provider: Intogreat.net

Purpose: Records your cookie preferences so you are not asked again

Duration: 6 months

‍

3. Cookie name: _ga

Provider: Google Analytics

Purpose: Distinguishes individual visitors by assigning a randomly generated ID

Duration: 2 years

‍

4. Cookie name: _ga_W7YDE0YVYQ

Provider: Google Analytics

Purpose: Maintain session state and campaign information for this property

Duration: 2 years

‍

5. Cookie name: _gcl_ls

Provider: Google

Purpose: Local storage entry supporting conversion measurement

Duration: Until cleared

‍

6. Cookie name: vuid

Provider: Vimeo

Purpose: Generates analytics about video playback

Duration: 2 years

‍

7. Cookie name: player

Provider: Vimeo

Purpose: Remembers player settings such as volume, quality and captions

Duration: 1 year

‍

8. Cookie name: flags

Provider: Vimeo

Purpose: Records feature settings chosen by the video owner

Duration: 1 year

‍

9. Cookie name: player_clearance

Provider: Vimeo

Purpose: Bot prevention

Duration: 7 days

‍

10. Cookie name: cf_clearance

Provider: Cloudflare, via Vimeo

Purpose: Bot prevention

Duration: 1 year

‍

11. Cookie name: __cf_bm

Provider: Cloudflare, via Vimeo

Purpose: Identifies and manages automated traffic

Duration: 30 minutes

‍

12. Cookie name: _cfuvid

Provider: Cloudflare, via Vimeo

Purpose: Enforces rate limiting

Duration: Session

‍

Cookie management

When you first visit our website, non-essential cookies are switched off by default. You will be presented with a cookie banner allowing you to accept, reject or manage non-essential cookies, and you can withdraw or change your consent at any time as easily as you gave it.

‍

You can also control cookies through your browser settings. Most browsers allow you to block, restrict or delete cookies. However, if you disable certain cookies, some website functionality may not operate correctly. We use Cloudflare Turnstile to protect our forms from automated abuse. Turnstile itself does not set cookies on your device; however, separate Cloudflare cookies (cf_clearance, __cf_bm and _cfuvid) are set via our Vimeo video embeds or bot prevention and rate-limiting purposes and are treated as strictly necessary, as described in this section 12.

‍

Further information about managing cookies can be found through your browser provider's support documentation.

‍

13. Newsletter

If you choose to subscribe to receive updates from Intogreat, we will collect your name and email address and add your details to our mailing list managed through Mailchimp.

‍

We use this information to send newsletters, insights, thought leadership content, updates about our services and other communications that may be of interest to you. We will only send marketing communications where you have provided your consent or where otherwise permitted by applicable law. You can unsubscribe from marketing communications at any time by clicking the unsubscribe link contained in our emails or by contacting us directly.

‍

Mailchimp processes personal information on our behalf in accordance with its own privacy and security obligations.

‍

14. E-mail contact
‍

You may contact us via the email address provided on our website. Where you do so, the personal data you send us by email will be stored and used exclusively for the purposeof dealing with your enquiry. The legal basis for this processing is our legitimate interest in responding to correspondence (Article 6(1)(f) UK GDPR) or, where applicable, your consent (Article 6(1)(a)UK GDPR).

‍

The data is deleted in accordance with the retention period set out in section 7 above (normally up to 3 years after the last interaction), unless it is required for longer to comply with a legal obligation or to establish, exercise or defend legal claims.

The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

‍

You may withdraw your consent to the processing of your personal data at any time. If you contact us by email, you can object to the storage of your personal data at anytime. In such a case, we may not be able to continue the conversation.

The data will be used exclusively for the processing of the conversation and will be deleted afterwards.

‍

15. Contact form

If you contact us through our website, email us directly or submit information through our contact form, we will collect the information you choose to provide, which may include:

•      your name;

•      email address;

•      telephone number;

•      organisation name;

•      job title; and

•      details of your enquiry.

‍

We use this information to respond to your enquiry, manage communications with you and, where appropriate, discuss potential business opportunities or client engagements.

‍

The legal basis for this processing is our legitimate interests in responding to enquiries and developing business relationships, and, where applicable, taking steps at your request prior to entering into a contract.

‍

16. Hosting
‍

The website is hosted on servers provided by our service provider. Our service provider is Webflow.

‍

The servers automatically collect and store information in so-called server log files, which your browser automatically transmits when you visit the website. The information stored is:

•      Browser type and browser version.

•      Operating system used.

•      Referrer URL.

•      Host name of the accessing computer.

•      Date and time of the server request.

•      IP address.

‍

This data is not merged with other data sources. The collection of this data is based on Article6(1)(f) UK GDPR. We have a legitimate interest in the technically error-free presentation and optimisation of our website, for which purpose the server log files must be collected. The location of the server of the website is geographically in Ireland.

‍

17. Disclosure to third parties
‍

We may share personal information with carefully selected third-party service providers who support our business operations, including:

•      Webflow (website hosting and website management);

•      Google Analytics (website analytics);

•      Mailchimp (email marketing and newsletter management);

•      Microsoft365 (business communications and document management);

•      professional advisers, insurers and auditors; and

•      regulators, law enforcement authorities or courts where required by law.

‍

We do not sell personal information to third parties. We may share personal information with service providers who support our business operations, professional advisers, regulators, law enforcement agencies and other parties where required by law or necessary to protect legal rights.

‍

18. International transfers

Some of our suppliers, including Google Analytics, Mailchimp, Vimeo and Cloudflare, may process personal information outside the UK, including in the United States. Where personal information is transferred outside the UK, we implement appropriate safeguards including adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms.

‍

19. Your consent

This Privacy and Cookies Policy explains how we process your personal information. Where we rely on your consent as the lawful basis for processing, for example for non-essential cookies or marketing communications, we obtain that consent separately and specifically as described in sections 12 and 13 above, and you may withdraw it at any time.

‍

20. Changes to this policy

We may update this Privacy and Cookies Policy from time to time. We will post any changes on this page and, where appropriate, notify you by email. Please review this Privacy and Cookies Policy regularly.

‍

21. Contact

For privacy questions, to exercise your rights, or to make a complaint, please contact:

•      Data Controller: intogreat Ltd

•      Address: Suite 6a, 10 Duke Street, Liverpool, L1 5AS, UK

•      Email: hello@intogreat.net

•      Telephone:+44 (0)7597 487 220

‍

We will respond as soon as reasonably practicable and within the timeframes required by UK data protection law.

‍

‍

‍

‍

‍