1. Who we are
This policy explains how THREAD ID LTD (ThreadID, we, us) collects and uses personal data through our website thread-id.com, our Digital Product Passport platform (the Service), and public Passport pages. We’re registered in England and Wales under number 17032928 at 66, Talbot Skyline 204-226 Imperial Drive, Harrow, United Kingdom, HA2 7HA.
We follow the UK GDPR and Data Protection Act 2018, and the EU GDPR where it applies to people in the EU.
2. Our two roles
- Controller — for data about our own customers, account users, website visitors and people who contact us. We decide how that data is used, and this policy covers it.
- Processor — for personal data our business customers put into the Service (for example, supplier contact names in product records). We process it only on the customer’s instructions. The customer is the controller, so their own privacy notice applies — contact them first about that data.
3. What we collect
- Account data — name, work email, job title, company, password (stored hashed), phone number.
- Billing data — billing contact, address, VAT number, payment history. Card details are handled by Stripe; we never see or store full card numbers.
- Usage data — log-ins, actions in the Service, IP address, browser and device type, error and crash logs.
- Communications — emails, support requests, feedback and survey answers.
- Website and Passport visitors — IP address, device and browser, pages viewed, approximate location from IP, and cookie data (see section 9). When someone scans a QR code, we log the scan but don’t identify the person.
- Marketing data — newsletter sign-ups and your contact preferences.
We don’t intentionally collect special category data (such as health or ethnicity). Please don’t put it in the Service.
4. How we use it and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing the Service and managing your account | Account, usage | Contract |
| Billing and collecting payments | Account, billing | Contract; legal obligation (tax records) |
| Customer support | Account, communications | Contract; legitimate interests |
| Security, fraud prevention, fixing crashes and bugs | Usage, logs | Legitimate interests |
| Improving the Service and product analytics | Usage (aggregated where possible) | Legitimate interests |
| Passport scan statistics shown to customers | Visitor data (aggregated) | Legitimate interests |
| Service and legal notices | Account | Contract; legal obligation |
| Marketing emails | Marketing data | Consent, or legitimate interests for existing business customers (you can opt out any time) |
| Non-essential cookies | Cookie data | Consent |
| Legal claims and complying with the law | Any relevant data | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we’ve balanced our interests against your rights. You can ask us for details.
5. Who we share it with
We don’t sell personal data. We share it only with:
- Service providers acting for us under contract — AWS (hosting, Europe), Stripe, Resend, and our contracted developers for maintenance and support.
- Professional advisers — accountants, lawyers and insurers, where needed.
- Authorities — regulators, courts or police where the law requires it, or to protect our rights or someone’s safety.
- A buyer or successor — if we sell, merge or restructure the business, under confidentiality.
- The public — only Passport content a customer chooses to publish.
6. International transfers
Some providers may process data outside the UK or EEA. When they do, we use a lawful safeguard: a UK or EU adequacy decision, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses. Ask us at Harrison@thread-id.com for a copy.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account data | Life of the account, then 30 days for export, then deleted |
| Billing and tax records | 6 years after the financial year ends (UK legal requirement) |
| Backups | Up to 35 days on a rolling cycle, then overwritten |
| Usage and security logs | Up to 12 months |
| Support emails | 2 years after the issue is closed |
| Marketing data | Until you unsubscribe, then a suppression record so we don’t email you again |
| Passport scan data | 24 months, then aggregated or deleted |
We may keep data longer if we need it for a legal claim or the law requires it.
8. Security and breaches
We use reasonable technical and organisational measures, including encryption in transit, access controls and regular backups. But no online system is completely secure, and we can’t guarantee your data will never be accessed, lost or altered without authorisation.
If a breach is likely to risk your rights, we’ll notify the ICO within 72 hours where required, and tell you without undue delay where the law requires it. Where we’re a processor, we’ll tell the affected customer without undue delay so they can meet their own obligations.
9. Cookies
We use strictly necessary cookies to run the site and Service (log-in, security). We only set analytics or marketing cookies if you agree through our cookie banner, and you can change your choice at any time.
10. Your rights
Under UK and EU data protection law you can ask us to:
- give you a copy of your personal data;
- correct data that’s wrong or incomplete;
- delete your data;
- restrict or object to how we use it, including objecting to direct marketing at any time;
- move your data to another provider (portability);
- withdraw consent, where we rely on it (this doesn’t affect what we did before).
Email Harrison@thread-id.com. We’ll reply within one month, and may ask you to prove your identity. Some rights have legal limits — we’ll explain if one applies. If your data is in a customer’s Passport or account, we may pass your request to that customer as the controller.
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
11. Children
The Service is for businesses and not aimed at anyone under 18. We don’t knowingly collect children’s data.
12. Changes to this policy
We may update this policy. We’ll post the new version here with an updated date and, for significant changes, email account holders.
13. Contact and complaints
Questions or requests: Harrison@thread-id.com.
If you’re unhappy with how we’ve handled your data, please contact us first. You can also complain to the UK Information Commissioner’s Office at ico.org.uk or 0303 123 1113, or to your local data protection authority if you’re in the EU.