Who we are.
thrive at work is operated by thrive at work s.r.o., a company registered in Prague, Czech Republic, with a subsidiary entity in San Francisco, California, USA.
For the purposes of the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act, thrive at work s.r.o. is the data controller for the website at thriveatwork.ai and for marketing communications. When we provide the Thrive Index to an organization, that organization is the data controller for its employees' assessment responses and thrive at work is the data processor.
Contact our data protection team at privacy@thriveatwork.ai.
What we collect.
We collect only what is necessary to run the service and to measure what the Thrive Index is designed to measure. We do not sell data. We do not use it to train third-party models.
Website visitors
- Basic request data (IP address, user agent, referrer) logged by our hosting provider
- Form submissions you send us — name, email, organization, message
- Cookie preferences and a minimal session identifier (see Cookies Deutsch)
Waitlist and marketing contacts
- Name, work email, organization, role
- Interaction history with our emails (opens, clicks) where you have consented
Platform users (when deployed with an organization)
- Authentication data — magic-link email address only; no passwords
- Assessment responses — always analyzed in aggregate, never linked to a named individual in reports
- Segment metadata provided by the organization (role, team, tenure band, location)
Why we process it.
We process each category of data for a specific, lawful purpose under GDPR Article 6:
| Data | Purpose | Lawful basis |
|---|---|---|
| Website logs | Security, abuse prevention | Legitimate interest |
| Form submissions | Respond to your enquiry | Legitimate interest |
| Waitlist emails | Keep you informed about the product | Consent |
| Assessment responses | Measure capacity and engagement | Contract (with employer) + legitimate interest |
| Benchmark contributions | Build industry norms, always anonymised | Legitimate interest |
You can withdraw consent at any time by emailing privacy@thriveatwork.ai or using the unsubscribe link in any marketing email.
How long we keep it.
We keep personal data only as long as we need it for the purpose we collected it.
| Data | Retention |
|---|---|
| Website logs | 30 days |
| Form submissions | 24 months from last contact |
| Marketing list | Until you unsubscribe, then 30 days |
| Raw assessment responses | As directed by the client organization, default 24 months |
| Anonymised benchmarks | Indefinite (no longer personal data) |
International transfers.
Personal data is stored primarily within the European Union. Where we transfer data to the United States (for example, to our San Francisco entity or to US-based sub-processors), transfers are protected by Standard Contractual Clauses approved by the European Commission, and by the EU–US Data Privacy Framework where the recipient is certified.
Your rights.
Under GDPR and equivalent laws you have the right to:
- Access a copy of your personal data
- Correct inaccurate data
- Erase your data (subject to our legal obligations)
- Restrict or object to processing
- Port your data to another service
- Withdraw consent at any time
- Lodge a complaint with a supervisory authority — in the Czech Republic, the Úřad pro ochranu osobních údajů (uoou.cz)
To exercise any of these rights, email privacy@thriveatwork.ai. We will respond within 30 days.
How we protect it.
Encryption in transit and at rest. Role-based access control. Regular security review. Penetration testing before platform release. Our architecture is designed so that no single person at thrive at work can read an individual's assessment response — aggregation happens before humans see the data.
If a breach ever occurs, we will notify affected users and the relevant supervisory authority within 72 hours, as required by GDPR.
Changes to this policy.
We may update this policy to reflect changes to the service, legal requirements, or our practices. When we make material changes, we will notify users by email and update the effective date at the top of this page. Your continued use of the service after the change signals your acceptance of the updated policy.