1. Important information and who we are

Thinking Machine Systems Limited (“TMS”, “we“, “us”) is committed to protecting and respecting your privacy. This Privacy and Cookies Policy (“Policy”) (together with and any other documents referred to therein) sets out the basis on which the personal data collected from you, or that you provide to us will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it.

For the purpose of the General Data Protection Regulation (GDPR), the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018 we may act both as a Data Processor on behalf of our clients who are Data Controllers, and as a Data Controller for certain types of data that we collect directly from you. TMS is registered in England and Wales with registered office at First Floor, 85 Great Portland Street, London, United Kingdom, W1W 7LT (Company Number 12031891).

This Policy gives you information about how we collect and use your personal data through your use of this website or our platform, including any data you may provide when you purchase a product or service.

 Our Role as a Data Controller

In certain situations, TMS may act as a Data Controller, which means that we determine the purposes and means of processing your personal data. For example, we may be a Data Controller in the following scenarios:

• When we collect and process your personal data directly for our own purposes, such as for marketing communications, customer support, or product improvement.
• When we use your contact details to send you information about our products or services, with your consent.
• When we analyse aggregated or anonymized data for our own business insights and strategy development.

As a Data Controller, we are responsible for ensuring that your personal data is processed lawfully, fairly, and transparently, and that your rights under data protection law are upheld.

Our Role as a Data Processor

In the majority of cases, TMS acts as a Data Processor on behalf of our clients who are Data Controllers. This means we process personal data according to the instructions of our clients and do not determine the purpose or means of the processing. For example:

• When processing supplier contract and invoice data on behalf of a client as part of our service offering.

In our role as a Data Processor, we handle your personal data strictly under the instructions of the Data Controller and in compliance with applicable data protection laws.

We have appointed a Privacy Manager who is responsible for overseeing questions in relation to this Policy. If you have any questions about this Policy, including any requests to exercise your legal rights (paragraph 8), please contact the Privacy Manager using the information set out in the contact details section (paragraph 9).

2.              The types of personal data we collect about you

Personal data means any information about an individual from which that person can be identified.

We collect and process some or all of the following types of information from you in the course of your use of https://thinkingmachine.co/ (the “Website”) or providing our services: 

   · Information that you provide by filling in in forms on the Website or filing in forms as part of the registration process. This includes information provided at the time of registering to use the Website, subscribing to our service, or requesting further information or services. We may also ask you for information when you report a problem with the Website. 

   · Specifically, we will collect personal details such as your name, business email address, business phone number, business address, organisation name, job title or any information input by you when using the Website or using our Services.

   · Payment information, such as bank card number, expiration date and security code.

   ·  Technical information such as details of your visits to the Website including, but not limited to, traffic data, location data, weblogs and other communication data, and the resources that you access.

   · Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses. 

   · This Website is not intended for children, and we do not knowingly collect data relating to children.

   · We do not collect any special categories of data about you (i.e. information about your race or ethnicity religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate individuals’ Usage Data to calculate the percentage of users accessing a specific website feature in order to analyse general trends in how users are interacting with our website to help improve the website and our service offering.

The provision of your name, and email address is required from you to enable us to provide log- in access to the Website. We will inform you at the point of collecting information from you, whether you are required to provide the information to us.

Information we collect from other sources

Where your employer sets up an organisation account, we will also obtain personal data from your employer, such as your name and email address.

3.              How we use your personal data

Legal basis

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

·       Performance of a contract: We rely on “performance of a contract” to collect, use and share (in accordance with this policy only) your personal data in order to provide our services pursuant to an agreement with you or your employer. If you object to this, please discontinue use of our website and take this up with your employer.

If you are entering personal data of your employer’s staff on behalf of your employer, you must ensure that you have a lawful basis under applicable data protection laws to do so. If you are unsure whether you have this, please discontinue use of Our website and take this up with your employer.

·       Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

·       Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

·       Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

4.              Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Purpose/Use	Type of data	Legal basis
To register you as a new customer	Contact details	Performance of a contract with you or you employer
To process and deliver your order including: (a) Manage payments, fees and charges (b) Collect and recover money owed to us	Payment information, and contact details	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to recover debts due to us)
To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy policy (b) Dealing with your requests, complaints and queries (c) Notifying you about any maintenance to the Website (d) to keep our records updated	Contact details	(a) Performance of a contract with you or your employer (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and manage our relationship with you
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	Contact details and technical information	(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation
To use data analytics to improve our website, products/services, customer relationships and experiences and to measure the effectiveness of our communications and marketing	Technical information	Necessary for our legitimate interests (to keep our website updated and relevant, to develop our business and to inform our marketing strategy and monitor visitors to our site and analyse their behaviour)
To send you relevant marketing communications and make personalised suggestions and recommendations to you about goods or services that may be of interest to you based on your Profile Data	Contact details and marketing preference	Necessary for our legitimate interests (to carry out direct marketing, develop our products/services and grow our business)

5.              Direct marketing

During the registration process on our website when your personal data is collected, you will be asked to indicate your preferences for receiving direct marketing communications from us via You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving the marketing.

We may also analyse your Identity, Contact, Technical, Usage and Profile Data to form a view of which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

Opting out of marketing

You can ask to stop sending you marketing communications at any time by following the opt-out links within any marketing communication sent to you.

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes for example relating to order confirmations for a product/service, updates to our Terms and Conditions, checking that your contact details are correct.

Cookies

For more information about the cookies we use and how to change your cookie preferences, please see below.  

6.              Disclosures of your personal data

We may disclose your personal data to third parties:

·       in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets; or

·       if we or substantially all of our assets are acquired by a third party, in which case personal data held by us about our customers will be one of the transferred assets; or

·       if we are under a duty to disclose or share your personal data in order to comply with any legal obligation; or

·       to protect our rights, property, or safety and our users and any third party we interact with to provide the Website; or

·       to our professional advisers, where needed.

Other than as set out above, and save insofar as is necessary in order for us to carry out our obligations arising from any contracts entered into between you and/or your employer and us, we will not share your data with third parties unless we have procured your express consent to do so

7.              International transfers

We do not transfer your personal data outside the UK.

8.              Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

9.              Data retention

How long will you use my personal data for?

We will hold personal data including but not limited to name, business address and contact details for the period we are required to retain this information by applicable UK tax law, currently six years.

We may store other personal information that you have provided us for as long as it is reasonably necessary taking into consideration our need to provide you with the services you have signed up to, to resolve any disputes, enforce our rights and/or respond to queries.

10.              Your legal rights

Under the General Data Protection Regulation you have a number of important rights free of charge. In summary, those include rights to:

·       this Policy is already designed to address

·       require us to correct any mistakes in your information which we hold

·  require the erasure of personal data concerning you in certain situations

·     receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations

·       object at any time to processing of personal data concerning you for direct marketing

·       object to decisions being taken by automated means which produce legal effects concerning you or similarly significantly affect you

·       object in certain other situations to our continued processing of your personal data

·       otherwise restrict our processing of your personal data in certain circumstances

·       claim compensation for damages caused by our breach of any data protection laws

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals rights under the General Data Protection Regulation.

If you would like to exercise any of those rights, please:

·       email, call or write to us (see ‘Contact’ below)

·     let us have enough information to identify you for example your name, registration details.

·       let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill), and

·       let us know the information to which your request relates, including any account or reference numbers, if you have them.

11.           Contact details

If you have any questions about this Policy or about the use of your personal data or you want to exercise your privacy rights, please contact our Privacy Manager at privacy@thinkingmachine.co.

12.           Complaints

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

13.           Changes to the privacy policy and your duty to inform us of changes  

We reserve the right to modify this policy at any time. Any changes we may make to our policy in the future will be made available to on our Website. Your continued use of the Website, services and platforms shall be deemed your acceptance of the varied Privacy Policy.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

14.           Third-party links 

This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

INFORMATION ABOUT OUR USE OF COOKIES

We may collect information about you including where available your IP address, operating system and browser type, for systems administration. This is statistical data about our users’ browsing actions and patterns and does not identify any individual. We may, however, use such information in conjunction with the data we have about you in order to track your usage of our services.

Our Website uses cookies to distinguish you from other users of our Website. This helps us to provide you with a good experience when you browse our Website and also allows us to improve the Website. By using our Website you agree to our use of cookies as more specifically set out below.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive

The cookies we use include:

·       “Strictly necessary” cookies. These are cookies that are required for the operation of our Website. They include, for example, cookies that enable you to log into secure areas of our Website.

·  “Analytical” cookies. They allow us to recognise and count the number of visitors and to see how visitors move around the Website when they are using it. This helps us to improve the way our Website works, for example, by ensuring that users are finding what they are looking for easily.

·     “Functionality” cookies. These are used to recognise you when you return to our Website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

·     “Targeting” cookies. These cookies record your visit to our Website, the pages you have visited and the links you have followed to our affiliates’ websites. We will use this information to make our Website, offers e-mailed to you and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

Cookies which are strictly necessary for the core functionality of the website are enabled by default and set automatically at the point you access the Website.

Any cookies which are not strictly necessary for the functioning of the website will not be set unless you expressly consent to them through the cookie banner by clicking “accept”. 

You may block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of the Website.