ThinkX Privacy Notice

Last updated: 13 October 2026

This notice explains what personal data ThinkX collects when you visit thinkx.ie, contact us, ask about building an app or MVP, receive a business email from us. It covers what we do with that data, why, who we share it with, how long we keep it, and your rights.

1. Who we are

ThinkX is a trading name of Think X Intelligent Systems LTD, a company registered in Ireland (company number 706889), with its registered office at [Registered office address: to be confirmed].

Think X Intelligent Systems LTD is the controller of the personal data described in this notice. That means we decide how and why it is used, and we are responsible for it.

Contact for privacy questions: [privacy contact email] Post: Think X Intelligent Systems LTD, [Registered office address: to be confirmed]

We have not appointed a Data Protection Officer because the law does not require us to. Please send any privacy question to the email address above.

Client projects: when we build or run apps for clients, we may handle personal data about our clients' own users. For that data, our client is the controller and we act as its processor under a written contract. This notice does not cover that data; the client's own privacy notice does.

2. What personal data we collect

When you use our contact form or email us - Your name, email address, phone number (if you give it) and company - Your message and any follow-up correspondence

When you use our MVP or project enquiry forms - Your name, email address, phone number (if you give it), company and role - Details of your idea or project, such as goals, features, timelines and any files you send

When we contact you about our services (business outreach) - Your name, job title, company, business email address and, sometimes, business phone number or public professional profile - Notes of any replies and whether you have asked us not to contact you again

When you become a client - Contact and billing details for you and your colleagues - Project communications, contracts and invoices

When you visit our website - Technical data such as your IP address, browser type, device and the pages you request, which our servers log automatically - If you accept analytics cookies: information about how you use our website, from Google Analytics. See our Cookie Policy.

We do not ask for special category data (such as health information). Please don't include it in forms or emails.

3. Where we get your data

Most of the data we hold comes directly from you. For business outreach, we collect business contact details from [lead sources, e.g. company websites, LinkedIn, business directories, Companies Registration Office records]. We note where each contact came from.

4. Why we use your data and our lawful basis

Data protection law says we must have a lawful basis for each use of your data. This table sets them out.

What we do	Lawful basis
Reply to contact form messages, emails and calls	Legitimate interests: answering people who contact us
Review MVP and project enquiries, prepare proposals and arrange calls	Steps you ask for before entering a contract, and legitimate interests
Deliver projects and manage our relationship with clients	Contract
Send invoices and keep accounting records	Legal obligation: Irish company and tax law
Send business outreach emails to business contacts about our services	Legitimate interests: telling businesses about services that may be relevant to them (see section 5)
Keep a "do not contact" list	Legitimate interests and legal obligation: making sure we respect your objection
Measure website use with Google Analytics	Consent, given through our cookie banner
Keep our website and systems secure and prevent spam and abuse	Legitimate interests: protecting our website and the people who use it
Establish, exercise or defend legal claims	Legitimate interests

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for more detail and you can object at any time (see section 9).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not sell your personal data.

5. Business outreach

Business outreach: we sometimes email people at businesses that we think may need app or MVP development, using business email addresses only. Every outreach email:

• says who we are and how we got your details;
• links to this notice; and
• tells you how to opt out, with a working unsubscribe link or a simple "reply to stop" option.

We do not send unsolicited marketing emails to personal email addresses or to individuals acting in a personal capacity. If you ask us to stop, we will add you to our suppression list and will not contact you again.

6. Who we share your data with

We share personal data only where we need to, and only with:

• Hosting: [hosting provider and region], which hosts our website and form submissions.
• Email: [email provider], which handles our business email.
• Outreach tools: [outreach/CRM provider], which store contact records.
• Payments: Stripe, if you pay an invoice through it. Stripe acts as an independent controller for some activities, such as fraud prevention. See stripe.com/privacy. [Delete if Stripe is not used by ThinkX.]
• Google: Google Analytics, only if you accept analytics cookies.
• Content delivery networks: our pages load files from cdn.jsdelivr.net and cdnjs.cloudflare.com, which receive your IP address so that they can deliver them.
• Subcontractors who work with us on a specific project, under confidentiality terms, where you are a client or prospective client.
• Professional advisers, such as our accountants and lawyers, where needed.
• Authorities and others, where the law requires it or to protect our rights.
• A buyer or investor, if our business is sold or restructured, under confidentiality terms.

Our processors may use your data only on our instructions, under written contracts that meet the GDPR. We do not use the Meta Pixel or other advertising cookies on thinkx.ie.

7. International transfers

Some of our providers, including Google and Cloudflare, are based outside the European Economic Area (EEA) or may access data from outside it. When personal data leaves the EEA, we make sure it is protected by one of these:

• an EU adequacy decision, including the EU-US Data Privacy Framework for US companies certified under it; or
• Standard Contractual Clauses approved by the European Commission, with extra safeguards where needed.

You can ask us for more information about the safeguards we use, or a copy of them, using the contact details in section 1.

8. How long we keep your data

Data	How long
Contact form and MVP enquiries that do not lead to a project	[retention period] after our last contact
Client and project records	For the project, then [retention period] after it ends
Invoices and accounting records	6 years after the end of the financial year they relate to, as Irish tax and company law requires
Business outreach contacts	[retention period] after our last contact, unless you become a client
Suppression ("do not contact") list	Only your email address and the date you opted out, kept for as long as we send marketing emails, so that we do not contact you again
Server and security logs	[retention period]
Google Analytics data	[Google Analytics retention setting], then deleted automatically

After these periods we delete the data or anonymise it so that it can no longer identify you.

9. Your rights

You have the following rights over your personal data:

• Access: ask for a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate data or complete incomplete data.
• Erasure: ask us to delete your data, for example when we no longer need it or you withdraw consent.
• Restriction: ask us to limit how we use your data, for example while we check whether it is accurate.
• Portability: ask for data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another organisation, where we rely on contract or consent.
• Objection: object to processing based on our legitimate interests. You can object to direct marketing, including our business outreach, at any time, and we will stop.
• Automated decisions: not to be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make such decisions.
• Withdraw consent: at any time, where we rely on consent (see section 10).

To use any of these rights, email [privacy contact email]. Using your rights is free. We will reply within one month. If your request is complex, or you have sent several, we may need up to two more months; if so, we will tell you within the first month and explain why. We may ask you to confirm your identity before we act.

10. Withdrawing consent

You can withdraw your consent at any time, and doing so is as easy as giving it:

• Cookies: click Cookie settings at the bottom of any page and switch analytics off.

Withdrawing consent does not affect processing that took place before you withdrew it.

11. Your right to complain

If you are unhappy with how we handle your personal data, please tell us first at [privacy contact email] so we can try to put it right.

You also have the right to complain to the Data Protection Commission (DPC), Ireland's data protection authority, at www.dataprotection.ie. If you live or work in another EEA country, you can also complain to the data protection authority there. If you are in the UK, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

12. Children

Our services are for businesses and adults and are not aimed at children. We do not knowingly collect personal data from anyone under 18. If you think a child has given us personal data, contact us and we will delete it.

13. How we protect your data

We use technical and organisational measures to protect personal data, including encryption in transit, access controls and limiting access to people who need it. If a breach is likely to put your rights at risk, we will tell the Data Protection Commission within 72 hours, and we will tell you where the law requires it.

14. Changes to this notice

We may update this notice when our services, providers or the law change. The date at the top shows when it was last updated. If we make a significant change, we will make it clear on this page, and where appropriate we will tell you directly.