Thirdex is Fully GDPR Compliant
We are committed to protecting the privacy and security of personal data processed through our platform. This page explains how we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Enterprise-grade encryption at rest and in transit
All data stored within United Kingdom jurisdiction
Data Processing Agreement provided to all customers
Overview
Thirdex is committed to ensuring that our platform and services comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. As a CRM provider serving UK-based charities, non-profits, and social enterprises, we understand the critical importance of data protection.
This document outlines our approach to GDPR compliance and explains how we help our customers meet their own data protection obligations when using our Service.
Key Legislation: Our compliance framework is built around the UK GDPR (as retained in UK law post-Brexit) and the Data Protection Act 2018, along with guidance from the Information Commissioner's Office (ICO).
Our Role: Controller vs Processor
Understanding the distinction between data controllers and processors is fundamental to GDPR compliance:
Your Organisation
Role: Data Controller
You determine the purposes and means of processing personal data of your donors, beneficiaries, and stakeholders. You are responsible for ensuring lawful processing and obtaining appropriate consent.
Thirdex
Role: Data Processor
We process personal data on your behalf according to your instructions. We implement appropriate technical and organisational measures to protect the data you entrust to us.
For our own business operations (e.g., managing our customer relationships, billing, and marketing), Thirdex acts as a Data Controller. Our Privacy Policy provides details on how we handle this data.
Lawful Basis for Processing
Under UK GDPR, all personal data processing must have a lawful basis. The six lawful bases are:
As a Data Controller, your organisation must identify and document the appropriate lawful basis for each processing activity. Thirdex provides features to help you record consent and manage data subject preferences.
Data Processing Agreement (DPA)
We provide a comprehensive Data Processing Agreement (DPA) to all customers, which forms part of our contractual relationship. The DPA includes:
- Subject matter and duration of processing
- Nature and purpose of processing
- Type of personal data processed
- Categories of data subjects
- Rights and obligations of both parties
- Technical and organisational security measures
- Sub-processor arrangements
- Data deletion and return procedures
Request a DPA: If you require a signed Data Processing Agreement, please contact us at legal@thirdex.co.uk and we will provide one within 5 business days.
Technical & Organisational Security Measures
Article 32 of UK GDPR requires appropriate security measures. Thirdex implements the following:
Technical Measures
AES-256 encryption at rest, TLS 1.3 in transit
Role-based access, MFA, SSO support
Daily automated backups with point-in-time recovery
24/7 security monitoring and intrusion detection
Regular penetration testing and security scans
Firewalls, DDoS protection, network segmentation
Organisational Measures
- Staff undergo regular data protection training
- Documented security policies and procedures
- Background checks for employees with data access
- Incident response procedures and regular drills
- Business continuity and disaster recovery plans
Data Retention
UK GDPR requires that personal data is kept no longer than necessary. Our retention practices include:
| Data Type | Retention Period |
|---|---|
| Active account data | Duration of subscription |
| Data after account termination | 30 days (export period), then deleted |
| Backups containing deleted data | 90 days maximum |
| Audit logs | 2 years |
| Billing and invoicing records | 7 years (legal requirement) |
You can configure your own data retention policies within Thirdex for your constituent data, and we provide tools to facilitate data deletion and anonymisation.
Data Subject Rights
UK GDPR grants individuals specific rights over their personal data. Thirdex provides tools to help you fulfil these rights:
Right of Access (Article 15)
Individuals can request a copy of their personal data. Thirdex allows you to export individual records easily.
Right to Rectification (Article 16)
Individuals can request correction of inaccurate data. Update records directly in the platform.
Right to Erasure (Article 17)
Also known as "right to be forgotten". Delete individual records with full audit trail.
Right to Restriction (Article 18)
Limit processing of personal data. Use status flags to restrict processing while retaining data.
Right to Portability (Article 20)
Receive data in machine-readable format. Export data in CSV, JSON, or XML formats.
Right to Object (Article 21)
Object to certain types of processing. Manage communication preferences and consent flags.
Data Breach Notification
In the event of a personal data breach, we follow strict notification procedures in accordance with Articles 33 and 34 of UK GDPR:
Our Breach Response Commitment
- Within 24 hours: We will notify affected customers of any breach involving their data
- Detailed report: Including nature of breach, categories of data affected, and remedial actions taken
- Ongoing support: Assistance with your ICO notification and communication to affected individuals
As the Data Controller, you are responsible for notifying the ICO within 72 hours of becoming aware of a breach that is likely to result in a risk to individuals' rights and freedoms. We will provide all information necessary to support your notification.
International Data Transfers
Thirdex stores all customer data within the United Kingdom. However, some of our sub-processors may process data in other jurisdictions.
Our commitment: Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the ICO, transfers to countries with UK adequacy decisions, or binding corporate rules where applicable.
We maintain an up-to-date list of sub-processors and their locations, which is available upon request.
Sub-processors
We use carefully selected sub-processors to provide our Service. Each sub-processor is bound by data protection obligations no less protective than those in our DPA.
Current Sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| AWS (Amazon Web Services) | Cloud infrastructure hosting | UK (London region) |
| Stripe | Payment processing | UK/EU |
| SendGrid | Transactional email delivery | UK/EU |
| Intercom | Customer support chat | EU |
We will notify customers at least 30 days before adding new sub-processors, giving you the opportunity to object. A complete and current list of sub-processors is available at legal@thirdex.co.uk.
Your Obligations as Data Controller
While Thirdex provides a compliant platform, your organisation has its own GDPR obligations:
- Lawful basis: Ensure you have a valid lawful basis for all processing activities
- Privacy notices: Provide clear privacy information to your data subjects
- Consent management: Obtain and record consent where required
- Data subject requests: Respond to rights requests within one month
- Records of processing: Maintain Article 30 records of processing activities
- DPIAs: Conduct Data Protection Impact Assessments where required
- Breach notification: Notify the ICO and affected individuals as required
Need guidance? The ICO provides excellent resources for charities and non-profits. Visit ico.org.uk for detailed guidance.
Contact & Data Protection Officer
For any questions about our GDPR compliance or to exercise your rights, please contact us:
Data Protection Officer
For data protection queries, rights requests, and compliance questions.
Legal & Contracts
For DPA requests, sub-processor lists, and contractual matters.
Information Commissioner's Office (ICO)
If you have concerns about how we handle personal data, you have the right to lodge a complaint with the UK supervisory authority: