THINKING FREELY LTD · WEBSITE POLICIES

Privacy notice

How we use personal information supplied through enquiries and our services.

Issue 2 · Updated 19 October 2026 · Contact: info@thinkingfreely.co.uk

Who is responsible?

Thinking Freely Ltd is responsible for the personal information it uses to manage enquiries and client relationships. We have offices in County Durham and London serving the UK. For privacy questions or requests, email info@thinkingfreely.co.uk.

What information is involved?

You may provide your name, business contact details, role and enquiry details. Client work may involve agreed business records, audit evidence and training attendance information. Please do not include sensitive personal data in an initial enquiry. We agree any necessary handling of confidential client evidence separately.

What happens when you use the enquiry form?

The proposed independent Thinking Freely Ltd enquiry service checks an anti-abuse token with Cloudflare Turnstile, then uses Resend to email a verification link to the address you provide. Your enquiry is forwarded to info@thinkingfreely.co.uk only after you deliberately confirm the request. Optional email updates are separate, unticked by default and activated only after confirmation. The service records the relevant wording, choices and server timestamps in Thinking Freely Ltd’s own contact and consent records. A download or enquiry without marketing consent does not subscribe you to updates. This service remains an unpublished draft until its own hosting, security and email settings pass acceptance testing.

Why we use information

We use enquiry details to respond and take steps you request before a contract. Where you are a business representative rather than the contracting individual, our legitimate interest is dealing with relevant business enquiries. Contract administration, agreed services, business record keeping and any applicable legal obligations may require further processing. Where we handle personal data on a client’s instructions, the roles and applicable processing terms must be agreed for that engagement.

Who information may be shared with

Relevant information may be handled by email, hosting and business IT providers, people assigned to your engagement, and professional advisers where necessary. We may disclose information where lawfully required. Client evidence is shared with an independent certification body only under agreed arrangements or another applicable lawful basis.

International processing

Service providers may process information outside the UK. Before a restricted transfer is made, the applicable destination and lawful transfer mechanism must be established, such as UK adequacy regulations or appropriate contractual safeguards. Contact us for details of the arrangements applicable to your information; we do not claim that all information remains in the UK.

How long information is kept

Retention depends on the purpose: whether an enquiry remains active, whether it leads to an engagement, contractual record requirements, applicable legal obligations and the need to establish or defend legal claims. Information should be removed or anonymised when it is no longer needed. A minimal marketing suppression record may be retained to honour an opt-out.

Your choices and rights

Providing enquiry details is voluntary, but we need sufficient contact information to respond. Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your information. You can object to processing based on legitimate interests. Where consent is used, you can withdraw it without affecting earlier lawful processing. The website enquiry tool does not make automated decisions or profile you.

Your right to object to marketing

You can object to use of your personal information for direct marketing at any time. Email info@thinkingfreely.co.uk with “Marketing opt-out” in the subject. Making an enquiry does not subscribe you to marketing.

Concerns and complaints

Contact us first if you wish, but you can complain directly to the Information Commissioner’s Office. You do not have to raise the matter with us before contacting the ICO.

WhatsApp enquiries and optional updates

You can contact Thinking Freely on WhatsApp at 07949 535538. We use the contact details and messages you share to respond to your request and manage agreed work. Optional WhatsApp marketing uses a separate affirmative opt-in; email consent does not cover it. We retain the sent consent message and relevant dates as evidence and honour STOP or other clear opt-out requests. WhatsApp is a separate Meta service with its own processing and privacy terms. Our WhatsApp communications and privacy policy explains the information involved, lawful bases, record keeping, choices and how to stop messages.

Related information

Privacy notice · Data protection policy · Information security policy · Marketing & communications policy · WhatsApp policy · Cookie notice · Website & resource terms ·

Free Downloads And Email Updates

When you request a free resource, we use your name, email address, optional organisation name and selected resource to verify your email and provide the download. Cloudflare Turnstile checks for automated abuse. Email verification is separate from the bot check: neither proves your professional identity or that other information you enter is accurate.

Downloading a resource does not subscribe you to marketing. If you choose optional email updates, we record the consent wording and version, your selected topics and frequency, server timestamps and your email confirmation. You may change your preferences or unsubscribe using the links in our marketing emails, or contact info@thinkingfreely.co.uk. Withdrawal does not affect earlier lawful processing.

We use the information needed to fulfil your download request and prevent abuse. Marketing updates rely on your consent. Limited operational and aggregate usage records help us maintain the service and understand which resources are useful. We do not use advertising cookies or cross-site tracking for these counts. Counts of file responses do not prove that a person opened or read the PDF.

Service Providers And Retention For Downloads

The proposed download service uses Cloudflare Workers and D1 to process requests and store contact and consent records, Cloudflare Turnstile to check for automated abuse, and Resend to send verification and selected update emails. Turnstile processes technical browser and connection information, including the IP address. Cloudflare acts as our processor when using these signals to protect this website, and separately as a controller when using them to improve its bot detection capabilities, as explained in its Turnstile Privacy Addendum. The Cloudflare D1 database intended to hold download contact and consent records is configured with European Union jurisdiction in the Eastern Europe region, with read replication disabled. This database setting does not mean that all service-provider processing takes place in the European Union. Cloudflare D1 recovery history can retain earlier database states for up to seven days. If recovery is used, deletion and marketing opt-out records must be reapplied before the service resumes. Resend processes recipient addresses, email content and delivery information. Resend stores customer data in the United States; selecting its Ireland sending region does not move stored data to Ireland. Read the Cloudflare Turnstile Privacy Addendum and Resend data protection information for details. Resend’s Data Processing Addendum governs its handling of customer email data and includes UK transfer clauses. Resend participates in the UK Extension to the EU–US Data Privacy Framework for non-HR data; its official registration was checked on 26 October 2026 and must be reviewed periodically. Resend acts separately as a controller for specified account and service-usage information. Its agreement provides for deletion of customer data within 90 days after account termination; this is not a 90-day limit for each email. Cloudflare’s Self-Serve Subscription Agreement incorporates its Data Processing Addendum for relevant personal-data processing. That addendum includes standard contractual clauses and the UK transfer addendum for applicable restricted transfers. We do not sell your contact details or share them for other organisations’ marketing. Provider access needed to operate the service is different from marketing sharing.

Verification requests expire after 24 hours and are removed during scheduled cleanup. Operational records are normally retained for up to 90 days. Delivery failures and spam complaints may place an address on a suppression list to prevent further marketing. Separate campaign records are used to prevent duplicate messages and honour the frequency selected. Consent and preference evidence is kept while subscribed and normally for up to 24 months after withdrawal. A minimal suppression record may be retained for as long as needed to honour your opt-out. We review active subscriptions after 24 months. These periods do not override a specific legal obligation or a justified need to establish or defend legal claims.

If you have questions about our download records, email preferences or the providers used to operate this service, contact info@thinkingfreely.co.uk.