Legal
Privacy Notice
How The Thistle Network collects, uses, and protects your personal information — and the choices you have.
Last updated: 30/08/2026On this page
Who we are
The Thistle Network ("we", "us") is the data controller for personal information described in this notice.
Email: general@thistle.network
What this notice covers
This notice explains how we collect and use personal information when you:
- Visit our website or contact us
- Receive an invitation to one of our events
- Register for and attend an event
- Sign up to our network or mailing list
- Partner or collaborate with us
Information we collect
From you directly: name, job title, organisation, work email, phone number (if provided), dietary and accessibility requirements, and any information you include in messages to us.
From publicly available business sources: corporate contact details we use to invite employers to relevant events, sourced from professional networks, corporate websites, and our existing employer relationships.
Automatically: limited technical information when you visit our website.
How we use your information and our lawful basis
Inviting employers to events
We use business contact details to invite organisations to events relevant to their work. Lawful basis: legitimate interests in connecting our network with employers active in early careers and Scottish apprenticeships.
Managing event registration and attendance
Once you confirm attendance, we use your details to register you, communicate logistics, and cater appropriately. Lawful basis: legitimate interests in running the event you've agreed to attend. Dietary and accessibility information that reveals health or religious data is processed on the basis of your explicit consent (given when you submit the registration form).
Sharing delegate lists with event co-hosts
Where an event is co-hosted, we share a delegate list with the co-host after the event (typically name, job title, organisation, and work email). The co-host acts as an independent controller. Lawful basis: legitimate interests in supporting joint event partners. We tell you who the co-host is and link to their privacy notice at the point of registration, and you can object before the list is shared.
Network updates and marketing
If you've subscribed to our updates, we send occasional emails about events and the network. Lawful basis: consent — you can unsubscribe at any time using the link in any email.
Responding to enquiries and managing partnerships
Lawful basis: legitimate interests in operating the network and responding to those who contact us.
Legal and compliance obligations
Where we need to comply with the law. Lawful basis: legal obligation.
International transfers
We aim to keep personal data within the UK and EU. Where any provider processes data outside this region, we put appropriate safeguards in place (such as the UK International Data Transfer Agreement or EU Standard Contractual Clauses).
How long we keep information
- Event registration data: 12 months after the event
- Email correspondence: up to 3 years from last contact
- Mailing list subscriptions: until you unsubscribe
- Partnership and contractual records: 7 years (for legal and accounting reasons)
Your rights
Under UK GDPR you have the right to:
- Access the personal information we hold about you
- Have inaccurate information corrected
- Have your information deleted in certain circumstances
- Restrict or object to our processing
- Receive your information in a portable format
- Withdraw consent where processing is based on consent
To exercise any right, email general@thistle.network. We'll respond within one month.
Changes to this notice
We may update this notice from time to time. The "last updated" date at the top shows when it was last changed. Material changes will be communicated where appropriate.
Contact us
Questions about this notice or how we handle your information? Email general@thistle.network.