Your Privacy is Our Priority
At Thirdex, we believe in transparency. This Privacy Policy explains what data we collect, why we collect it, and how we keep it safe. We are committed to protecting your privacy and complying with UK data protection laws.
We only collect what's necessary
Enterprise-grade encryption
We never sell your data
Access, update, or delete anytime
Who We Are
Thirdex is a customer relationship management (CRM) platform designed specifically for UK-based charities, non-profit organisations, social enterprises, and faith-based organisations.
Data Controller Information
Company Name: Thirdex Ltd
Registered in: England and Wales
Email: privacy@thirdex.co.uk
Website: https://thirdex.co.uk
This Privacy Policy applies to personal data we collect when you visit our website, use our services, or interact with us in any way. It does not cover how our customers use the Thirdex platform to manage their own data—that is governed by their own privacy policies.
Information We Collect
We collect different types of information depending on how you interact with us:
Information You Provide Directly
Name, email address, phone number, organisation name, job title when you create an account or request a demo.
Payment card details (processed securely by Stripe), billing address, VAT number if applicable.
Emails, support tickets, feedback, and any other communications you send to us.
Details you provide when filling out forms on our website, such as demo requests or contact forms.
Information Collected Automatically
Browser type, operating system, device type, screen resolution.
Pages visited, features used, time spent on pages, click patterns, error logs.
Approximate location based on IP address (country/region level only).
See our Cookies section for details.
How We Use Your Information
We use your personal information for the following purposes:
Service Delivery
To provide, maintain, and improve our CRM platform and services.
Customer Support
To respond to your enquiries, provide technical support, and resolve issues.
Billing & Accounts
To process payments, manage subscriptions, and send invoices.
Communications
To send service updates, security alerts, and (with consent) marketing communications.
Analytics & Improvement
To understand how our service is used and identify areas for improvement.
Security & Compliance
To protect against fraud, enforce our terms, and comply with legal obligations.
Lawful Basis for Processing
Under UK GDPR, we process your personal data based on the following lawful bases:
| Purpose | Lawful Basis |
|---|---|
| Providing our services | Contract performance |
| Processing payments | Contract performance |
| Sending service communications | Contract performance / Legitimate interests |
| Marketing communications | Consent |
| Analytics and service improvement | Legitimate interests |
| Security and fraud prevention | Legitimate interests / Legal obligation |
| Compliance with law | Legal obligation |
Where we rely on legitimate interests, we have conducted balancing tests to ensure your rights are not overridden. You can request details of these assessments by contacting us.
International Data Transfers
Your data is primarily stored in the United Kingdom. However, some of our service providers may process data in other countries.
When we transfer data outside the UK, we ensure appropriate safeguards are in place:
- Standard Contractual Clauses (SCCs) approved by the ICO
- Transfers to countries with UK adequacy decisions
- Additional technical and organisational measures where necessary
Customer Data (Data You Store in Thirdex)
When you use Thirdex to manage your organisation's data (donors, beneficiaries, volunteers, etc.), you are the Data Controller for that information, and we act as a Data Processor on your behalf.
Your Responsibilities: You are responsible for ensuring you have appropriate lawful bases, privacy notices, and consent (where required) for the personal data you store in Thirdex. We provide the tools; you determine how to use them compliantly.
Our responsibilities as Data Processor include:
- Processing data only on your documented instructions
- Implementing appropriate security measures
- Assisting you with data subject requests
- Notifying you of any data breaches
- Deleting or returning data upon termination
For more details, see our GDPR Compliance page and Data Processing Agreement.
Data Security
We take the security of your data seriously and implement industry-standard measures to protect it:
AES-256 at rest, TLS 1.3 in transit
Role-based access, MFA available
Daily automated backups
24/7 security monitoring
Regular penetration testing
Staff security awareness training
While we implement robust security measures, no method of transmission over the internet is 100% secure. We encourage you to use strong passwords and enable multi-factor authentication.
Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 30 days |
| Billing records | 7 years (legal requirement) |
| Support tickets | 3 years after resolution |
| Marketing preferences | Until you unsubscribe + 1 year |
| Website analytics | 26 months |
| Enquiry form submissions | 2 years |
After the retention period, data is securely deleted or anonymised.
Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
Right to Access
Request a copy of your personal data
Right to Rectification
Correct inaccurate or incomplete data
Right to Erasure
Request deletion of your data
Right to Restriction
Limit how we use your data
Right to Portability
Receive data in a portable format
Right to Object
Object to certain processing activities
To exercise any of these rights, please contact us at privacy@thirdex.co.uk. We will respond within one month. There is no fee for most requests, but we may charge a reasonable fee for excessive or unfounded requests.
Children's Privacy
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children.
If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@thirdex.co.uk and we will take steps to delete such information.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes:
- We will update the "Last Updated" date at the top of this page
- For significant changes, we will notify you by email or prominent notice on our website
- We encourage you to review this policy periodically
Your continued use of our services after changes are posted constitutes acceptance of the updated policy.
Contact Us
If you have any questions about this Privacy Policy or how we handle your data, please contact us:
Privacy Enquiries
For privacy questions, data requests, and policy queries.
Data Protection Officer
For formal data protection matters and complaints.
Supervisory Authority
You have the right to lodge a complaint with the UK supervisory authority: