Privacy Policy

1. Introduction

ThoughtSeed (“we”, “us”) is a consultancy working at the intersection of learning, technology and strategy. We respect your privacy and are committed to protecting your personal information in accordance with the New Zealand Privacy Act 2020, the UK General Data Protection Regulation (UK GDPR) and the European Union’s General Data Protection Regulation (GDPR).

This policy explains what personal information we collect, why we collect it, how we use it, who we share it with, and the rights you have over your data.

2. Information We Collect

We collect only the personal information necessary to deliver our services and to operate this website:

• Contact details: name, email address, phone number and organisation when you engage us, request a conversation, or subscribe to updates.
• Engagement data: responses, assessments and feedback gathered during workshops, assessments (including the VITALS AI Readiness Pulse), consultations and facilitated sessions.
• Correspondence: the content of messages you send us and any notes taken during facilitated work.
• Technical data: IP address, browser type and access times collected through standard web analytics. This is used in aggregate form and is not linked to your identity unless you provide contact details.

3. How We Use Your Information

We process your personal information for the following lawful purposes:

• To deliver consultancy, facilitation and advisory services you have requested.
• To run workshops, assessments and strategic planning sessions, and to produce the related reports and deliverables.
• To respond to your enquiries and communicate about our services.
• To send you a requested report, such as a VITALS AI Readiness Report, by email.
• To improve our services, website and user experience.
• Where you have given consent, to send occasional updates and thought leadership. You may withdraw this consent at any time.

Where we rely on consent, you may withdraw it at any time. Where we rely on a contract (to deliver services you have engaged us for) or on our legitimate interests (to operate and improve our practice), we will process only what is necessary for that purpose.

4. International Data Transfers

ThoughtSeed is based in New Zealand. Because we use cloud hosting and email providers that may operate servers outside New Zealand, your information may be processed in countries such as the United States, the United Kingdom, Australia or the European Union. We only transfer personal information to countries that provide an adequate level of protection, or under appropriate safeguards such as standard contractual clauses, and only to the extent necessary to deliver our services.

5. Third-Party Service Providers

We use a small number of trusted providers to operate our website and deliver our services. Each is bound by confidentiality and may only process your information on our behalf, for the purposes we specify. These include:

• Cloud hosting and secure file storage for our website and engagement deliverables.
• Email and communication platforms used to correspond with you and send requested reports.
• Web analytics services that help us understand how the site is used.

We do not sell, trade or rent your personal information to anyone, and we do not use your data to train third-party artificial intelligence models.

6. Data Storage and Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure or destruction, including:

• Encryption of data in transit (SSL/TLS) and at rest.
• Access controls and authentication, with access limited to those who need it.
• Regular reviews of our systems and processes.

No system can be guaranteed completely secure, but we take reasonable steps to safeguard your information and to notify affected individuals and relevant authorities without undue delay in the event of a personal data breach.

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes set out in this policy, to comply with our legal and professional obligations, or to establish, exercise or defend legal claims. Engagement data from completed work is typically retained for the duration of the engagement and a limited period thereafter for reference and continuity, after which it is deleted or anonymised.

8. Your Privacy Rights

Depending on where you live, you may have the following rights over your personal information:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate or incomplete information.
• Erasure: request that we delete your personal information, subject to legal and contractual obligations.
• Restriction and objection: ask us to limit processing or object to certain uses.
• Portability: receive a copy of your information in a structured, machine-readable format.
• Withdrawal of consent: withdraw consent for processing that relied on it, at any time.
• Complaint: lodge a complaint with the relevant privacy authority.

To exercise any of these rights, contact us using the details in section 11. We will respond within the timeframe required by applicable law (generally within 30 days).

9. Cookies and Analytics

Our website uses cookies and similar technologies for essential functionality and to analyse traffic in aggregate. We do not use cookies to build advertising profiles or to sell your data. You can control or disable cookies through your browser settings; some site features may be affected if cookies are disabled.

10. Children’s Privacy

Our services and website are not directed at children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Changes to This Policy

We may update this policy from time to time. We will post the updated version on this page with a revised “Last updated” date. We encourage you to review it periodically.

12. Contact Us

If you have questions about this policy, wish to exercise your privacy rights, or have concerns about how we handle your personal information, please contact us:

You also have the right to lodge a complaint with the Office of the Privacy Commissioner for New Zealand at www.privacy.org.nz.

If you are in the United Kingdom or the European Union, you may also contact the UK Information Commissioner’s Office (ico.org.uk) or your local data protection authority.